(982,5,'2020-07-20 16:11:55','2020-07-20 15:11:55','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The decision can be summarised as follow :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations world this end of the week. At first read, the invalidated Privacy Shield is to be replaced by two other legal instruments which have been said valid by the ECJ, specifically mentioned Standard Contractual Clauses and by extension, the Binding Corporate Rules. These come with the requirement to implement a case by case analysis, assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated. Thousands of companies who relied on Privacy Shield will have to find another solution.<br> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br>Paragraph 103 of the ECJ decision states : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.<br> para 143 : return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA spying, and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option today, only IF they are adapted and re-evaluated. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more active concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>What lawyers exchanging data across the channel, will ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce liabilities. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access. Using EU companies as processor, or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called Gaia-X might be the winner of this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third parties such as Google analytics is a mean of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used Tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><br><br><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-20 16:11:55','2020-07-20 15:11:55','',975,'https://datarainbow.eu/2020/07/20/975-revision-v1/',0,'revision','',0),(983,5,'2020-07-21 12:36:45','2020-07-21 11:36:45','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The decision can be summarised as follow :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations world this end of the week. At first read, the invalidated Privacy Shield is to be replaced by two other legal instruments which have been said valid by the ECJ, specifically mentioned Standard Contractual Clauses and by extension, the Binding Corporate Rules. These come with the requirement to implement a case by case analysis, assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated. Thousands of companies who relied on Privacy Shield will have to find another solution.<br> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br>Paragraph 103 of the ECJ decision states : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.<br> para 143 : return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA spying, and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option today, only IF they are adapted and re-evaluated. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more active concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>What lawyers exchanging data across the channel, will ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce liabilities. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access. Using EU companies as processor, or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called Gaia-X might be the winner of this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third parties such as Google analytics is a mean of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used Tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><br><br><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>, <a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or <a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-21 12:36:45','2020-07-21 11:36:45','',975,'https://datarainbow.eu/2020/07/21/975-revision-v1/',0,'revision','',0),(985,5,'2020-07-21 13:05:18','2020-07-21 12:05:18','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations world this end of the week. At first read, the invalidated Privacy Shield is to be replaced by two other legal instruments which have been said valid by the ECJ, specifically mentioned Standard Contractual Clauses and by extension, the Binding Corporate Rules. These come with the requirement to implement a case by case analysis, assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated. Thousands of companies who relied on Privacy Shield will have to find another solution.<br> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br>Paragraph 103 of the ECJ decision states : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.<br> para 143 : return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA spying, and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option today, only IF they are adapted and re-evaluated. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more active concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>What lawyers exchanging data across the channel, will ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce liabilities. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access. Using EU companies as processor, or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called Gaia-X might be the winner of this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third parties such as Google analytics is a mean of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used Tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><br><br><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>, <a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or <a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-21 13:05:18','2020-07-21 12:05:18','',975,'https://datarainbow.eu/2020/07/21/975-revision-v1/',0,'revision','',0),(987,5,'2020-07-21 18:34:35','2020-07-21 17:34:35','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations in the world this end of the week. At first read, the Privacy Shield is invalidated with immediate effect. Data export to the US cant be replaced by two other legal instruments which have been said valid in principle by the ECJ, specifically Standard Contractual Clauses and Binding Corporate Rules $Article 49 GDPR derogations). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In the absence of an adequacy decision, the controller or processor should t<strong>ake measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject</strong>. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, <strong>standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority</strong>. Those safeguards should ensure compliance with d<strong>ata protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation</strong>, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default.  </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs and BCRs are subject to a strict requirement to implement a case by case analysis and assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated - only not for the UK ICO !!!. Thousands of companies who relied on Privacy Shield will have to find another solution.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraph 103 of the ECJ decision states :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.</p><p><br>Paragraph 143 to add:</p><p>Return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite the Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA bilk data collection , and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a> was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her first reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to the US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option left, only IF they are adapted and re-evaluated with the DPAs supervision. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more actively their concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they are other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>What lawyers exchanging data across the channel, will ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce liabilities. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access. Using EU companies as processor, or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called Gaia-X might be the winner of this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third parties such as Google analytics is a mean of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used Tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><br><br><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>, <a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or <a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-21 18:34:35','2020-07-21 17:34:35','',975,'https://datarainbow.eu/2020/07/21/975-revision-v1/',0,'revision','',0),(989,5,'2020-07-21 18:40:41','2020-07-21 17:40:41','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations in the world this end of the week. At first read, the Privacy Shield is invalidated with immediate effect. Data export to the US cant be replaced by two other legal instruments which have been said valid in principle by the ECJ, specifically Standard Contractual Clauses and Binding Corporate Rules $Article 49 GDPR derogations). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In the absence of an adequacy decision, the controller or processor should t<strong>ake measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject</strong>. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, <strong>standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority</strong>. Those safeguards should ensure compliance with d<strong>ata protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation</strong>, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default.  </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs and BCRs are subject to a strict requirement to implement a case by case analysis and assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated - only not for the UK ICO !!!. Thousands of companies who relied on Privacy Shield will have to find another solution.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraph 103 of the ECJ decision states :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.</p><p><br>Paragraph 143 to add:</p><p>Return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite the Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA bilk data collection , and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a> was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her first reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to the US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option left, only IF they are adapted and re-evaluated with the DPAs supervision. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more actively their concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they are other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>Ask the lawyers exchanging data across the channel, will they ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce you liability. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>, <a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or <a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access although at some point the data will need to be unencrypted and vulnerable. Using EU companies as processor, or or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called <a href=\"https://www.cnbc.com/2020/07/17/gaia-x-europes-answer-to-us-and-chinese-tech-giants-power.html\">Gaia-X </a>might be the winner in this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third party cookies such as Google Analytics or Facebook Modernizr are means of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><br><br><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>, <a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or <a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-21 18:40:41','2020-07-21 17:40:41','',975,'https://datarainbow.eu/2020/07/21/975-revision-v1/',0,'revision','',0),(992,5,'2020-07-24 14:35:01','2020-07-24 13:35:01','{{unknown}}','','','publish','closed','closed','','54dfc42c5aa074a3c8180511502c6e73','','','2020-07-24 14:35:01','2020-07-24 13:35:01','',0,'https://datarainbow.eu/2020/07/24/54dfc42c5aa074a3c8180511502c6e73/',0,'oembed_cache','',0),(993,5,'2020-07-24 14:38:51','2020-07-24 13:38:51','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>NEW IMPORTANT UPDATE 24th July 2020</strong> - <a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\">NOYB Next Steps for EU companies &amp; FAQs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>FISA 702+EO 12333 have no territorial limitation. They also apply to servers in the EU that are operated by a US \'electronic communication service provider\' or where certain operations are outsourced to a US provider. The location for hosting is therefore irrelevant.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Any non-EU/EEA provider had the duty to inform you about laws like <a href=\"https://twitter.com/hashtag/FISA?src=hashtag_click\">FISA</a> 702 and EO 12.333. If they have not done so, they are liable for all costs that result from cancelling the SCCs and transferring data back to the EU/EEA…</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> The <a href=\"https://twitter.com/hashtag/PrivacyShield?src=hashtag_click\">#PrivacyShield</a> Decision was an incorrect executive decision by the European Commission. In theory, damages claims can be brought against the EU under Article 340 TFEU.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>providers may have sufficiently limited the factual access (\'possession, custody or control\') from US entities, so that an EU/EEA server is factually beyond the reach of the US govt.” I wonder if such controls are possible without full separation </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations in the world this end of the week. At first read, the Privacy Shield is invalidated with immediate effect. Data export to the US cant be replaced by two other legal instruments which have been said valid in principle by the ECJ, specifically Standard Contractual Clauses and Binding Corporate Rules $Article 49 GDPR derogations). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In the absence of an adequacy decision, the controller or processor should t<strong>ake measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject</strong>. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, <strong>standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority</strong>. Those safeguards should ensure compliance with d<strong>ata protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation</strong>, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default.  </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs and BCRs are subject to a strict requirement to implement a case by case analysis and assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated - only not for the UK ICO !!!. Thousands of companies who relied on Privacy Shield will have to find another solution.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraph 103 of the ECJ decision states :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.</p><p><br>Paragraph 143 to add:</p><p>Return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite the Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA bilk data collection , and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her first reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to the US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option left, only IF they are adapted and re-evaluated with the DPAs supervision. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more actively their concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they are other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>Ask the lawyers exchanging data across the channel, will they ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce you liability. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access although at some point the data will need to be unencrypted and vulnerable. Using EU companies as processor, or or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called <a href=\"https://www.cnbc.com/2020/07/17/gaia-x-europes-answer-to-us-and-chinese-tech-giants-power.html\">Gaia-X </a>might be the winner in this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third party cookies such as Google Analytics or Facebook Modernizr are means of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><br><br><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-24 14:38:51','2020-07-24 13:38:51','',975,'https://datarainbow.eu/2020/07/24/975-revision-v1/',0,'revision','',0),(994,5,'2020-07-24 14:48:20','2020-07-24 13:48:20','{{unknown}}','','','publish','closed','closed','','7f521e0ff243bc9d2049a6a6ef974a41','','','2020-07-24 14:48:20','2020-07-24 13:48:20','',0,'https://datarainbow.eu/2020/07/24/7f521e0ff243bc9d2049a6a6ef974a41/',0,'oembed_cache','',0),(996,5,'2020-07-24 14:53:46','2020-07-24 13:53:46','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>NEW IMPORTANT UPDATE 24th July 2020</strong> - <a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\">NOYB Next Steps for EU companies &amp; FAQs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>FISA 702+EO 12333 have no territorial limitation. They also apply to servers in the EU that are operated by a US \'electronic communication service provider\' or where certain operations are outsourced to a US provider. The location for hosting is therefore irrelevant.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Any non-EU/EEA provider had the duty to inform you about laws like <a href=\"https://twitter.com/hashtag/FISA?src=hashtag_click\">FISA</a> 702 and EO 12.333. If they have not done so, they are liable for all costs that result from cancelling the SCCs and transferring data back to the EU/EEA…</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> The <a href=\"https://twitter.com/hashtag/PrivacyShield?src=hashtag_click\">#PrivacyShield</a> Decision was an incorrect executive decision by the European Commission. In theory, damages claims can be brought against the EU under Article 340 TFEU.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>providers may have sufficiently limited the factual access (\'possession, custody or control\') from US entities, so that an EU/EEA server is factually beyond the reach of the US govt.” I wonder if such controls are possible without full separation </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations in the world this end of the week. At first read, the Privacy Shield is invalidated with immediate effect. Data export to the US cant be replaced by two other legal instruments which have been said valid in principle by the ECJ, specifically Standard Contractual Clauses and Binding Corporate Rules $Article 49 GDPR derogations). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In the absence of an adequacy decision, the controller or processor should t<strong>ake measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject</strong>. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, <strong>standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority</strong>. Those safeguards should ensure compliance with d<strong>ata protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation</strong>, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default.  </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs and BCRs are subject to a strict requirement to implement a case by case analysis and assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated - only not for the UK ICO !!!. Thousands of companies who relied on Privacy Shield will have to find another solution.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraph 103 of the ECJ decision states :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.</p><p><br>Paragraph 143 to add:</p><p>Return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite the Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA bilk data collection , and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her first reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to the US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option left, only IF they are adapted and re-evaluated with the DPAs supervision. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more actively their concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they are other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>Ask the lawyers exchanging data across the channel, will they ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce you liability. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access although at some point the data will need to be unencrypted and vulnerable. Using EU companies as processor, or or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called <a href=\"https://www.cnbc.com/2020/07/17/gaia-x-europes-answer-to-us-and-chinese-tech-giants-power.html\">Gaia-X </a>might be the winner in this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third party cookies such as Google Analytics or Facebook Modernizr are means of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><br><br><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">Schrems and the future of EU-US data transfers (or lack thereof…) </a>this IS A LONG article. Very interesting US view. It has some good elements but still missing few important points. No mention of the lawful basis of processing and the obligation of transparency FB failed. Why should there be any uncertainty on Facebook’s basis of data transfer to the US? SCC or Privacy Shield should be clearly stated in their privacy notice.  Also no reference to the Cambridge Analytica interference into élections and manipulation of public opinion. I think this was a wake up call to many on the sort of game FB was doing when collect data and profiling. Facebook is one player in the game, they are other big ones, US corporations have somehow grow so big that are out of control even for the US government. I suggest reading Professor Lawrence Lessig on the point of Lobbying and corruption of the US Congress. Are EU countries much better? Well, surely they don’t have the same power. Plus there is some sort of partnership between EU countries offering some sort of guarantee.  The EU is based on free mouvement of people and goods. Therefore the directive 95 came to ensure the free flow of data within member states.  The real terror created by the 9/11 tragedy is the rising level of state surveillance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>State surveillance is the real threat to freedom and individual human rights. All Western countries have taken oppressive measures. What US has done is again one level higher with clear segregation against the rights of foreign citizens. Yes, in the EU we do care about our fundamental rights as much as the US is focused on free speech, Unlike the free speech in the US, The right to privacy and data protection are not absolute and have to be balanced with other fundamental rights. The right to privacy and data protection are différent despite being interconnected. Europe is a patchwork of sovereign nations with various cultures and legal systems. \nI fully agree with the authors ‘there are deep cultural differences between EU and US and you definitely need someone on your side that actually speaks and thinks “European” on this one.’\nBoth EU and US need each other. Transatlantic trade is essential but not at the cost of EU citizens rights. We might have woken up a bit late. Not sure we can actually stop the GAFAM with not enough EU competitors. Better late than never? It’s time for the Commission to play it’s role and negotiate a fairer agreement. I don’t believe a code of conduct could be sufficient. It won’t be an easy game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-24 14:53:46','2020-07-24 13:53:46','',975,'https://datarainbow.eu/2020/07/24/975-revision-v1/',0,'revision','',0),(998,5,'2020-07-24 15:27:41','2020-07-24 14:27:41','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>NEW IMPORTANT UPDATE 24th July 2020</strong> - <a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\">NOYB Next Steps for EU companies &amp; FAQs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>FISA 702+EO 12333 have no territorial limitation. They also apply to servers in the EU that are operated by a US \'electronic communication service provider\' or where certain operations are outsourced to a US provider. The location for hosting is therefore irrelevant.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Any non-EU/EEA provider had the duty to inform you about laws like <a href=\"https://twitter.com/hashtag/FISA?src=hashtag_click\">FISA</a> 702 and EO 12.333. If they have not done so, they are liable for all costs that result from cancelling the SCCs and transferring data back to the EU/EEA…</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> The <a href=\"https://twitter.com/hashtag/PrivacyShield?src=hashtag_click\">#PrivacyShield</a> Decision was an incorrect executive decision by the European Commission. In theory, damages claims can be brought against the EU under Article 340 TFEU.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>providers may have sufficiently limited the factual access (\'possession, custody or control\') from US entities, so that an EU/EEA server is factually beyond the reach of the US govt.” I wonder if such controls are possible without full separation </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations in the world this end of the week. At first read, the Privacy Shield is invalidated with immediate effect. Data export to the US cant be replaced by two other legal instruments which have been said valid in principle by the ECJ, specifically Standard Contractual Clauses and Binding Corporate Rules $Article 49 GDPR derogations). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In the absence of an adequacy decision, the controller or processor should t<strong>ake measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject</strong>. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, <strong>standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority</strong>. Those safeguards should ensure compliance with d<strong>ata protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation</strong>, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default.  </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs and BCRs are subject to a strict requirement to implement a case by case analysis and assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated - only not for the UK ICO !!!. Thousands of companies who relied on Privacy Shield will have to find another solution.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraph 103 of the ECJ decision states :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.</p><p><br>Paragraph 143 to add:</p><p>Return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite the Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA bilk data collection , and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her first reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to the US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option left, only IF they are adapted and re-evaluated with the DPAs supervision. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more actively their concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they are other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>Ask the lawyers exchanging data across the channel, will they ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce you liability. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access although at some point the data will need to be unencrypted and vulnerable. Using EU companies as processor, or or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called <a href=\"https://www.cnbc.com/2020/07/17/gaia-x-europes-answer-to-us-and-chinese-tech-giants-power.html\">Gaia-X </a>might be the winner in this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third party cookies such as Google Analytics or Facebook Modernizr are means of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><br><br><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/our-work-tools/our-documents/other/frequently-asked-questions-judgment-court-justice-european-union_en\">Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems - European Data Protection Board - European Data Protection Board</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">Schrems and the future of EU-US data transfers (or lack thereof…) </a>this is a LONG article. An interesting US view. It has some good elements but still missing few important points. No mention of the lawful basis of processing and the obligation of transparency FB failed. Why should there be any doubt on Facebook’s basis of data transfer to the US while SCC or Privacy Shield should be clearly stated in their privacy notice. Also no reference to the Cambridge Analytica interference into élections and manipulation of public opinion. I think this was a wake up call to many on the sort of game FB was playing when collecting data and profiling. Facebook is one player in the game, they are other big ones, US corporations have somehow grow so big that they are nous out of control even for the US government. I suggest reading Professor Lawrence Lessig on the point of Lobbying and corruption of the US Congress. Are EU countries much better? Well, surely they don’t have the same power. Plus there is some sort of partnership between EU countries offering some sort of guarantee. The EU is based on free mouvement of people and goods. Therefore the directive 95 came to ensure the free flow of data within member states. The real terror created by the 9/11 tragedy is the rising level of state surveillance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>State surveillance is the real threat to freedom and individual human rights. All Western countries have taken oppressive measures. What US has done is again one level higher with clear segregation against the rights of foreign citizens. Yes, in the EU we do care about our fundamental rights as much as the US is focused on free speech, Unlike the free speech in the US, The right to privacy and data protection are not absolute and have to be balanced with other fundamental rights. The right to privacy and data protection are différent despite being interconnected. Europe is a patchwork of sovereign nations with various cultures and legal systems. \nI fully agree with the authors ‘there are deep cultural differences between EU and US and you definitely need someone on your side that actually speaks and thinks “European” on this one.’\nBoth EU and US need each other. Transatlantic trade is essential but not at the cost of EU citizens rights. We might have woken up a bit late. Not sure we can actually stop the GAFAM with not enough EU competitors. Better late than never? It’s time for the Commission to play it’s role and negotiate a fairer agreement. I don’t believe a code of conduct could be sufficient. It won’t be an easy game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-24 15:27:41','2020-07-24 14:27:41','',975,'https://datarainbow.eu/2020/07/24/975-revision-v1/',0,'revision','',0),(1000,5,'2020-07-24 17:12:35','2020-07-24 16:12:35','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>NEW IMPORTANT UPDATE 24th July 2020</strong> - <a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\">NOYB Next Steps for EU companies &amp; FAQs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>FISA 702+EO 12333 have no territorial limitation. They also apply to servers in the EU that are operated by a US \'electronic communication service provider\' or where certain operations are outsourced to a US provider. The location for hosting is therefore irrelevant.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Any non-EU/EEA provider had the duty to inform you about laws like <a href=\"https://twitter.com/hashtag/FISA?src=hashtag_click\">FISA</a> 702 and EO 12.333. If they have not done so, they are liable for all costs that result from cancelling the SCCs and transferring data back to the EU/EEA…</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> The <a href=\"https://twitter.com/hashtag/PrivacyShield?src=hashtag_click\">#PrivacyShield</a> Decision was an incorrect executive decision by the European Commission. In theory, damages claims can be brought against the EU under Article 340 TFEU.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>providers may have sufficiently limited the factual access (\'possession, custody or control\') from US entities, so that an EU/EEA server is factually beyond the reach of the US govt.” I wonder if such controls are possible without full separation </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations in the world this end of the week. At first read, the Privacy Shield is invalidated with immediate effect. Data export to the US cant be replaced by two other legal instruments which have been said valid in principle by the ECJ, specifically Standard Contractual Clauses and Binding Corporate Rules $Article 49 GDPR derogations). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In the absence of an adequacy decision, the controller or processor should t<strong>ake measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject</strong>. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, <strong>standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority</strong>. Those safeguards should ensure compliance with d<strong>ata protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation</strong>, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default.  </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs and BCRs are subject to a strict requirement to implement a case by case analysis and assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated - only not for the UK ICO !!!. Thousands of companies who relied on Privacy Shield will have to find another solution.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraph 103 of the ECJ decision states :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.</p><p><br>Paragraph 143 to add:</p><p>Return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite the Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA bilk data collection , and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her first reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to the US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option left, only IF they are adapted and re-evaluated with the DPAs supervision. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more actively their concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they are other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>Ask the lawyers exchanging data across the channel, will they ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce you liability. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access although at some point the data will need to be unencrypted and vulnerable. Using EU companies as processor, or or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called <a href=\"https://www.cnbc.com/2020/07/17/gaia-x-europes-answer-to-us-and-chinese-tech-giants-power.html\">Gaia-X </a>might be the winner in this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third party cookies such as Google Analytics or Facebook Modernizr are means of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/our-work-tools/our-documents/other/frequently-asked-questions-judgment-court-justice-european-union_en\">Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems - European Data Protection Board - European Data Protection Board</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://iapp.org/news/a/using-sccs-post-schrems-ii-guidance-from-dpas/?mkt_tok=eyJpIjoiWkRsbVl6a3pZakJpTkRKaiIsInQiOiJSSVBkRGVVdFdBTXRUdDAzQzN5NktITWRaVG9QVnQ3U2hpeTQ2K09UU3BpWlJlVzZucTZjODVhSFFuV0VKcG1PdVpKQTErSTdVV09DNFJIYlwvQzl0bWxLYVVhZUxMa29QVkR4SVJcL1R6TUJpWkFlTjd2V0pFVDlpTXRXYmQ0WEdBIn0%3D&amp;utm_content=135417219&amp;utm_medium=social&amp;utm_source=linkedin&amp;hss_channel=lcp-10094295\">Using SCCs post-\'Schrems II\': Guidance from DPAs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">Schrems and the future of EU-US data transfers (or lack thereof…)&nbsp;</a>this is a LONG article. An interesting US view. It has some good elements but still missing few important points. No mention of the lawful basis of processing and the obligation of transparency FB failed. Why should there be any doubt on Facebook’s basis of data transfer to the US while SCC or Privacy Shield should be clearly stated in their privacy notice. Also no reference to the Cambridge Analytica interference into élections and manipulation of public opinion. I think this was a wake up call to many on the sort of game FB was playing when collecting data and profiling. Facebook is one player in the game, they are other big ones, US corporations have somehow grow so big that they are nous out of control even for the US government. I suggest reading Professor Lawrence Lessig on the point of Lobbying and corruption of the US Congress. Are EU countries much better? Well, surely they don’t have the same power. Plus there is some sort of partnership between EU countries offering some sort of guarantee. The EU is based on free mouvement of people and goods. Therefore the directive 95 came to ensure the free flow of data within member states. The real terror created by the 9/11 tragedy is the rising level of state surveillance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>State surveillance is the real threat to freedom and individual human rights. All Western countries have taken oppressive measures. What US has done is again one level higher with clear segregation against the rights of foreign citizens. Yes, in the EU we do care about our fundamental rights as much as the US is focused on free speech, Unlike the free speech in the US, The right to privacy and data protection are not absolute and have to be balanced with other fundamental rights. The right to privacy and data protection are différent despite being interconnected. Europe is a patchwork of sovereign nations with various cultures and legal systems. \nI fully agree with the authors ‘there are deep cultural differences between EU and US and you definitely need someone on your side that actually speaks and thinks “European” on this one.’\nBoth EU and US need each other. Transatlantic trade is essential but not at the cost of EU citizens rights. We might have woken up a bit late. Not sure we can actually stop the GAFAM with not enough EU competitors. Better late than never? It’s time for the Commission to play it’s role and negotiate a fairer agreement. I don’t believe a code of conduct could be sufficient. It won’t be an easy game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-07-24 17:12:35','2020-07-24 16:12:35','',975,'https://datarainbow.eu/2020/07/24/975-revision-v1/',0,'revision','',0),(1003,5,'2020-08-26 16:52:27','2020-08-26 15:52:27','<!-- wp:paragraph -->\n<p>We are working on building a privacy compliant website. This site does not use any analytics.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":116,\"align\":\"left\",\"width\":360,\"height\":230} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-2.png\" alt=\"\" class=\"wp-image-116\" width=\"360\" height=\"230\" /></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>We do not use cookies unless strictly functional. We are trying our best to not allow third parties to track our visitors by cookies or by Java Script embeded code. It\'s hard job. We might lose traffic and SEO. We have used a Word Press template.  WP templates are mainly server side PHP scripts full of board cascading code built on code. We can\'t even see the actual code.&nbsp;When using the WP admin, the templates are loaded in the back. We wanted to let make you aware that this potential risk. Help us by spreading the word. If you see anything suspicious, lets us know.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We believe our visitors deserve protection and privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want your trust. In particular, we do not use Google analytics, avoiding to share data with external third parties.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":78} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-11.16.16-1024x415.png\" alt=\"\" class=\"wp-image-78\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>When links are posted, beware that they will take you to an external website that is hosted by a third-party provider not necessarily in your regional jurisdiction or that of DataRainbow. The company may collect, store and use information independent of DataRainbow including but not limited to IP address, browser details etc. DataRainbow has no control over the collection or use of this information. For more information on the linked sites Privacy Policy and the Lawful basis for this data collection, read their privacy notice/policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Most other web sites don\'t actually comply with the laws relating to data protection and privacy and as such it is impossible for us to guarantee that the sites we link to will not misuse your data. We hope regulators will enforce the law against these organisations. As such please always be mindful of clicking on links to third party web sites - we would recommend that you have various tools and plugins installed on your web browser to protect you such as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>AdBlock Plus</li><li>NoScript</li><li>Privacy Badger</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Make sure that third party cookies and pop-ups are disabled in your web browser settings. We will produce a video showing you how to do this in the near future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Privacy Notice','','inherit','closed','closed','','33-revision-v1','','','2020-08-26 16:52:27','2020-08-26 15:52:27','',33,'http://datarainbow.eu/?p=1003',0,'revision','',0),(1005,5,'2020-08-26 17:39:38','2020-08-26 16:39:38','<!-- wp:paragraph -->\n<p><strong>Why DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><br></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong><br></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group <a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":881} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.32.54.png\" alt=\"\" class=\"wp-image-881\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":880} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.29.42.png\" alt=\"\" class=\"wp-image-880\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":878} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Champion-Badge.png\" alt=\"\" class=\"wp-image-878\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Seen on Twitter</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":252} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-31-at-11.22.40.png\" alt=\"\" class=\"wp-image-252\" /></figure>\n<!-- /wp:image -->','About','','inherit','closed','closed','','31-revision-v1','','','2020-08-26 17:39:38','2020-08-26 16:39:38','',31,'http://datarainbow.eu/?p=1005',0,'revision','',0),(1006,5,'2020-08-26 17:43:02','2020-08-26 16:43:02','<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://privacylawblog.fieldfisher.com/2019/edpb-prepares-for-a-no-deal-brexit\">EDPB prepares for a \"no deal\" Brexit</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>\"What this means is that companies in the EU (including the EEA) that are currently freely sending their personal data to the UK will have to implement appropriate safeguards in accordance with article 46 before transferring any personal data to the UK. These appropriate safeguards include:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Standard Data Protection Clauses adopted by the European Commission of a DPA</em></li><li><em>Ad Hoc Data Protection Clauses adopted the EU based company (data exporter) and the UK based recipient of this data (data importer)</em></li><li><em>Binding Corporate Rules</em></li><li><em>Codes of Conduct</em></li><li><em>Certification Mechanism\"</em>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board Published its guidance :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information note on data transfers under the GDPR in the event of a no-deal Brexit  <a href=\"https://www.pearltrees.com/s/file/preview/192486822/edpb-2019-02-12-infonote-nodeal-brexit_en.pdf\">Adopted on 12 February 2019</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Information note on BCRs for companies which have ICO<br> as BCR Lead Supervisory Authority - <a href=\"https://www.pearltrees.com/s/file/preview/192486834/edpb-2019-02-12-infonote-bcrs-brexit_en.pdf\">Adopted on 12 February 2019&nbsp;</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>ICO guidance</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>To&nbsp;<em>help</em>&nbsp;organisations prepare for a&nbsp;<em>\'</em>no deal<em>\'</em>&nbsp;Brexit, the ICO has published a short guide for UK businesses:&nbsp;<em>\'</em><a href=\"https://ico.org.uk/media/2553958/leaving-the-eu-six-steps-to-take.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Six Steps to Take</a><em>\'</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Continue to comply</em></strong>&nbsp;with GDPR and follow ICO guidance.</li><li><strong><em>Transfers to the UK</em>:</strong>&nbsp;Review data flows and identify where your organisation receives data into the UK from the EEA to ensure sufficient safeguards are in place to allow the continued flow of personal data.</li><li><strong><em>Transfers from the UK</em>:</strong>&nbsp;Identify data flows to countries outside of the UK, as these will fall under new UK transfer and documentation provisions.</li><li><strong><em>European operations</em>:</strong>&nbsp;For organisations that operate across Europe, data flows, processing operations and group structures should be reviewed to fully understand the effect of Brexit on operations.</li><li><strong><em>Documentation:</em></strong>&nbsp;Identify privacy documentation in the event it needs to be updated when the UK leaves the EU.</li><li><strong><em>Organisational awareness:</em></strong>&nbsp;Ensure key people in the organisation are aware of these key issues and that plans are up to date.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong><a href=\"https://www.gov.uk/government/publications/data-protection-law-eu-exit/amendments-to-uk-data-protection-law-in-the-event-the-uk-leaves-the-eu-without-a-deal-on-29-march-2019\">UK Gov Guidance</a> : Amendments to UK data protection law in the event the UK leaves the EU without a deal on 29 March 2019</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Resources on<a href=\"http://www.pearltrees.com/privacyday/uk-brexit/id23426706\"> Brexit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\" target=\"_blank\">Google-Style GDPR Fines for Everyone? Bavarian DPA Conducts Website Cookie Practices Sweep, Announces Fines under Consideration</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted <strong>Privacy Hero 2018</strong>, is on Voice of America Business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. contact data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let the data flow, <a href=\"https://blogs.dlapiper.com/privacymatters/eu-japan-let-the-data-flow-free-flow-of-personal-data-between-eu-countries-and-japan-confirmed/\">adequacy decision between EU and Japan</a> adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Former European Data Protection Supervisor Peter Hustinx joins <a href=\"https://t.co/2LSgMjSG6b\">ICO </a>as non-executive director.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.pearltrees.com/privacyday/twitter/id23766377#item247781087\">Twitter</a></em> under investigation by the Irish Data Protection Commission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.computerweekly.com/news/252456335/Facebooks-objections-to-court-concerns-over-privacy-more-about-optics-than-facts\">Facebook</a></em>’s challenge to a High Court ruling that raises serious concerns about data transfers between Europe and the US is more about appearance than facts, lawyers for the Irish Data Protection Commission told Dublin\'s Supreme Court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Via EDRI&nbsp;: On 7 February, the European Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE) presented two new working documents analysing further the issue of cross-border access to data in criminal matters, also known as “e-evidence”.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Conditions for obtaining subscriber information in relation to dynamic versus static IP addresses: overview of relevant court decisions and developments <a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\">here</a> and<a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"> here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https:\\/\\/rm.coe.int\\/t-cy-2018-26-ip-addresses-v6\\/16808ea472\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>WARNING : Links to external website may contain cookies and tracking of visitors data. Do adjust your privacy setting in accordance.</p>\n<!-- /wp:paragraph -->','NEWS','','inherit','closed','closed','','65-revision-v1','','','2020-08-26 17:43:02','2020-08-26 16:43:02','',65,'http://datarainbow.eu/?p=1006',0,'revision','',0),(1008,5,'2020-08-26 17:47:18','2020-08-26 16:47:18','','image','','inherit','closed','closed','','image','','','2020-08-26 17:47:18','2020-08-26 16:47:18','',284,'/wp-content/uploads/sites/3/2020/08/image.png',0,'attachment','image/png',0),(1009,5,'2020-08-26 17:47:35','2020-08-26 16:47:35','<!-- wp:paragraph -->\n<p><strong><a href=\"https://blog.feroot.com/24-good-reasons-to-love-privacy\">Happy Valentine\'s Day !</a></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":285} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/02/Screenshot-2019-02-14-at-13.03.39.png\" alt=\"\" class=\"wp-image-285\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":286} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/02/Screenshot-2019-02-14-at-13.03.30.png\" alt=\"\" class=\"wp-image-286\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:gallery {\"ids\":[287,1008]} -->\n<ul class=\"wp-block-gallery columns-2 is-cropped\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2019/02/Screenshot-2019-02-14-at-13.04.58.png\" alt=\"\" data-id=\"287\" class=\"wp-image-287\" /></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/08/image.png\" alt=\"\" data-id=\"1008\" data-link=\"http://datarainbow.eu/?attachment_id=1008\" class=\"wp-image-1008\" /></figure></li></ul>\n<!-- /wp:gallery -->','Privacy Celebration','','inherit','closed','closed','','284-revision-v1','','','2020-08-26 17:47:35','2020-08-26 16:47:35','',284,'http://datarainbow.eu/?p=1009',0,'revision','',0),(1011,5,'2020-08-26 19:49:15','2020-08-26 18:49:15','<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/privacyday\">A curation of various resources </a> to give a whole picture of Privacy and Data Protection that goes far above the GDPR, from a global perspective. The Pearltrees are a work in progress with links, notes and editorials.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":264} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/02/Screenshot-2019-02-09-at-14.28.29.png\" alt=\"\" class=\"wp-image-264\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Additional curation by <a href=\"http://www.pearltrees.com/datarainbow\">Datarainbow to find here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WARNING</strong> : this is an external link  to a free App that collects personal data. Do adjust your privacy settings and clear your cookies history.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This link will take you to an external website that is hosted by a third-party provider not necessarily in your regional jurisdiction or that of DataRainbow. This company may collect, store and use information independent of DataRainbow including but not limited to IP address, browser details etc. DataRainbow has no control over the collection or use of this information. For more information on the linked sites Privacy Policy and the Legitimate Interest for this data collection, see <a href=\"http://www.pearltrees.com/info/privacy\">here</a>.\" </p>\n<!-- /wp:paragraph -->','Privacy Day Pearltrees','','inherit','closed','closed','','29-revision-v1','','','2020-08-26 19:49:15','2020-08-26 18:49:15','',29,'http://datarainbow.eu/?p=1011',0,'revision','',0),(1013,5,'2020-08-26 20:03:07','2020-08-26 19:03:07','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In “<a href=\"https://press.princeton.edu/titles/9436.html\">Delete : The Virtue of Forgetting in the Digital Age</a>”, <a href=\"https://www.oii.ox.ac.uk/people/viktor-ms/\">Viktor Mayer-Schonberger</a> from the <a href=\"https://cyber.harvard.edu/\">Berkman Klein Centre of Internet and Society</a>, exposes the permanent shadow that follows us online for ever. The issues of privacy and freedom that results and his suggested solution : auto-delete files or information expiry date.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Changing back the default setting from remembering to forgetting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The crumbs of information left behind, get aggregated and build a picture, sometimes distorted, that follows us.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the theory of conservation of energy, data does have a deceptively long lifespan.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nothing gets deleted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Viktor Mayer-Schonberger points out, the German Stasi genocide project would have taken a whole different apocalyptic dimension had Google storage and data indexing existed at the time.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He mentions the case of the Dutch Citizens register put in place in the 1930s. To ensure the administration of social securities, it included religious and ethnicity. Once the nazi had occupied the Netherland, they exploited the register to identify jews to be deported and sent to concentration camps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another major Privacy scholar, Professor Daniel Solove, has been actively raising awareness on privacy and the future of reputation online.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>His paper,&nbsp;<a href=\"http://ssrn.com/abstract=998565\" target=\"_blank\" rel=\"noreferrer noopener\">“I’ve Got Nothing to Hide,” and Other Misunderstandings of Privacy</a>,&nbsp;explains why privacy matters.&nbsp;He later expanded his ideas in the essay into a book:&nbsp;<a href=\"http://www.amazon.com/gp/product/0300172338\" target=\"_blank\" rel=\"noreferrer noopener\">Nothing to Hide: The False Tradeoff Between Privacy and Security</a>.&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you think The only people who should worry are those who are doing something immoral or illegal, you should read his essays and books. With the mass of omni-veillance data, the situation is not just Orwellian, but Kafkaesque.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a series of YouTube videos and conferences, Daniel Solove brings public attention to cases of online harassement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Dog Pooh girl is the story of an unlucky girl. She is with her dog in a suburban tube of South Korea. The dog poop on the train, she is on a hurry, she leaves the train refusing to clean up behind. In the old days, that would have been the end of it. Today, when face-to-face persuasion fails, there’s a fallback plan : anonymous Internet humiliation.&nbsp;The witness who recorded her with his smartphone, posted the shaming video online. Within days, her identity and her past were revealed. The video gets viral all around the world. Posters and all kinds of jokes were made. Media wrote about her.&nbsp;Even the US Washington Post wrote about her story.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>She eventually reached a fame she wished she did never achieved. For ever, the image will follow her. This girl will be called the Dog Pooh Girl.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another illustration, The sad story of the the Star Wars Kid. A young chubby boy in Canada. He&nbsp;posted a video of himself online in his rather unsuccessful attempt to imitate George Lucas, the famous movie star. His video was watched by tens of millions of internautes who commented, and widely mocked his gesture. He was teased by the whole world.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A childhood incident that will follow him forever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove questions the Future of Reputation in the digital age and how data can track you back.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He wrote : “<em>If the Empire in Star Wars Had Big Data, the Empire would have won. A search of records would have revealed where Luke Skywalker was living on Tatooine.&nbsp;A more efficient collection and aggregation of Jawa records would have located the droids immediately.&nbsp;Simple data analysis would have revealed that Ben Kenobi was really Obi Wan Kenobi. A search of birth records would have revealed that Princess Leia was Luke\'s sister. Had the Empire had anything like the NSA, it would have had all the data it needed, and it could have sweptup the droids and everyone else, and that would have been that.</em>&nbsp;“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So, Is more information stored any better?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is an information taken out of context.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is individuals freedom and autonomy when we can’t escape from our past?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During an interview with the Wall Street Journal, Google’s CEO, Eric Schmidt, suggested that young people should be entitled to change their identity once achieved 21 years of age to escape their youth mistakes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He adds : ”<em>I don\'t believe society understands what happens when everything is available, knowable and recorded by everyone all the time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>So, is taking a new identity a realistic option?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is one other place where users are encouraged to share their day to day stories, their feelings and their believes. Users profiles were exploited by Cambridge Analytica to manipulate electoral votes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More worrying, Facebook does not respect the multi layers of our personality by storing all in one place. No more free speech nor modular language between levels of relationships.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the past, people will write diaries. Today, it’s been replaced by online blogs or social media platforms where people reveal most intimates details of their life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And incidentally the live of their family, friends, co-workers, everyone, posted online for the eternity.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>50% of blogs are from children under&nbsp;the age of 18.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The generation Google, as Daniel Solove calls it , has its memories engaged for ever.&nbsp;A childhood that will follow them for ever, for the leisure of Google to bring back every piece of memories.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Forgetting is not forgiving. It’s a salutatory purge of our brain. it’s mostly random purge.</strong>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe have you heard of Neuralink, a revolutionary project funded by Elon Musk.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Elon Musk&nbsp;is the American multibillionaire CEO of Tesla electric cars, the inventor of the fabulous solar roof tiles. He even projects to colonise the Planet Mars.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The richest man in the world according to Forbes magazine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>His Neuralink project aims to reduce social inequalities by boosting cognitive capacities.&nbsp;A project to implant Computer interfaces in the brain of disadvantage populations, as he believes they lack intelligence. A theory supported by the French Dr Laurent Alexandre believing high IQ is key to success. A whole utopia of transhumanism.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Give them extra brain processing and you’ll resolve the issues of poverty!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Adding memory :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now, lets look at a little story told by Jean-Gabriel Ganascia :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A little girl, Adele, asks her grand mother Juliette :&nbsp;<em>Grand’ma, what does it mean a ‘recitation’&nbsp;</em>? The Grand’ma vaguely remembers that early Twenty-One century, people had to read and read again to memorise poetry or other texts. Adele lives in 2075. She has no idea of that.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Neuralink has resolved the memory issue.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, Elon Musk, has borrowed his idea from NEURALIFE in ‘<em>Tomorrow and Beyond</em>’, Science fiction book by Ian Bronx.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The little girl is curious to know if this learning by heart process was any painful. The grand’ma says : ‘<em>no, we just had to read and read again to memorise, not to forget.</em>&nbsp;‘&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The little girl has no idea what forget means.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jean-Gabriel Ganascia, who tells this science fiction story, is a professor of Computer Science and a French Philosopher. He is the President of the Ethics committee at the French Research Center, CNRS. His research is particularly focused on Ethics and Artificial Intelligence.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In France, patients are already treated by deep electronic simulations of the brain to treat the symptoms of Parkinson disease.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now, imagine having an astonishing memory to record and remember everything, including every dream, every single detail of your life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Well, near 80 people around the world today have&nbsp;naturally this biological capability.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Actually, they suffer, they suffer from Hypermnesia disorder. They permanently keep a perfect memory of their life. They virtually remember every minor event most people would forget within days.&nbsp;The memory for them is so vivid, they can feel the pain for ever once recorded. Every painful image they see remains engraved in their brain.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Imagine the nightmare they live.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Without forgetting, we are haunted by the past without the ability to forgive or decide in present</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If Neuralink project was to go ahead, it needed a delete button.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here is the big question : Who can decide to select and delete one’s memories ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Before Neuralink, we are the first generations to have big parts of our lives permanently, digitally recorded.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google aggregate and bring up in a click all crumbs of information to re-compose the puzzle of our life.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What the right to be forgotten can do?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The so called Right to be Forgotten created by the European Court of Justice is not deleting the information but only de-linking the content by the search engine Google.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under specific circumstances a right to delete has been introduced by the the recent European Regulation for the protection of personal data. But that is for a very small parcel of our sparse available information.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since its creation 20 years ago, Google has been collecting a mass of data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google knows more about each of us than we know ourself.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The new global&nbsp;Panoptican society of invisible surveillance is treat to human freedom and dignity.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remembering has long been human’s dream. However, forgetting is a biological capacity. Today there is a shift. From biological forgetting we have moved to digital remembering.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naturally, Memory is the exception, forgetting the default</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Digitally, Remembering has become the default, forgetting the exception.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Human health and wellness is based on the balance between memory and forgetfulness.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Leaves on trees take the colours of the autumn to fall. Gradually, they join the soil to enrich its nutrients. This putrefaction is what later allows the birth of new lives.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A transmutation the epigenetic is starting to see in human DNA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We need to forget to better remember.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Awareness gives the ability to balance the pros and cons. To be aware is not being scared.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the risk to post it online for the eternity ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How best to protect our privacy?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How to bring transparency and control for better privacy ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are the options of our future, the future of our children.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Which kind of society we want for them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To protect against unforeseen future, it’s better to store less than more.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let us remember to forget, to borrow VMS words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further reading :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Life Under Digits</a></li><li><a href=\"http://keeping%20an%20eye/\" target=\"_blank\" rel=\"noreferrer noopener\">Keeping an Eye</a></li><li><a href=\"https://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">Drones, Autonomous Cars Ethics and Regulation</a></li><li><a href=\"https://www.linkedin.com/pulse/challenges-artificial-intelligence-france-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">France Initiatives to Tackle the Challenges of Artificial Intelligence</a></li><li><a href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">Wearable Cameras</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Why Privacy Matters','The crumbs of information left behind, get aggregated and build a picture, sometimes distorted, that follows us. ','inherit','closed','closed','','14-revision-v1','','','2020-08-26 20:03:07','2020-08-26 19:03:07','',14,'http://datarainbow.eu/?p=1013',0,'revision','',0),(1018,5,'2020-08-29 01:48:05','2020-08-29 00:48:05','<!-- wp:paragraph -->\n<p>An all time easy advice</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An all time easy advice</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lets reflect on two decades of mass collection of data. Massive amount of data necessarily means inaccurate data. Data storage equals data risk. Data risk equal liabilities. Data breach notification needs a fast response within 72 hours. More sensitive the data stored, higher the liability. We are awaiting the class actions in the UK, Lloyd v Google, several others in the EU and the latest in the US against&nbsp;<a href=\"https://www.linkedin.com/pulse/french-court-said-facial-recognition-technology-tara/\" target=\"_blank\" rel=\"noreferrer noopener\">ClearviewAI</a>. Data breach causes harm and loss of control that call for compensation. Nearly everyday we hear the breaking news of a new data breach. It is no more IF but WHEN data breach occurs. It happpens to big organisations as well as small ones.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So in that context, why collecting unnecessary data?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I still hear stories of Data Controllers asking for ID card to respond to a Subject Access Request. Professional Associations, even lawyers, asking for ID card to process documents or key access. I just want to remind of one of the key principals of the GDPR that can keep away from many troubles : DATA MINIMISATION.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consider personal data as a hot potato.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do not collect if you don\'t necessarily need it. Do not keep it longer than necessary, Do not share it with third parties with whom you\'ll become co-controller and therefore liable (Think of all these third parties accessing your visitors data such as Google Analytics or Facebook); Purpose limitation means do not process the personal data for further purposes ; You ought to keep the data accurate, secure and no longer than necessary. Less data you collect and keep, better you are.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an ECJ Advocate General opinion on the validity of consent in the context of the provision of a copy of ID cards required from customers. Why should a telco company need to require to keep ID documents? read more&nbsp;<a href=\"https://datarainbow.eu/2020/03/04/consumer-contracts-and-the-validity-of-consent/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lets reflect on two decades of mass collection of data. Massive amount of data necessarily means inaccurate data. Data storage equals data risk. Data risk equal liabilities. Data breach notification needs a fast response within 72 hours. More sensitive the data stored, higher the liability. We are awaiting the class actions in the UK, Lloyd v Google, several others in the EU and the latest in the US against ClearviewAI. Data breach causes harm and loss of control that call for compensation. Nearly everyday we hear the breaking news of a new data breach. It is no more IF but WHEN data breach occurs. It happens to big organisations as well as small ones.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So in that context, why collecting unnecessary data?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I still hear stories of Data Controllers asking for ID card to respond to a Subject Access Request. Professional Associations, even lawyers, asking for ID card to process documents or key access. I just want to remind of one of the key principals of the GDPR that can keep away from many troubles : DATA MINIMISATION.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consider personal data as a hot potato.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do not collect if you don\'t necessarily need it. Do not keep it longer than necessary, Do not share it with third parties with whom you\'ll become co-controller and therefore liable (Think of all these third parties accessing your visitors data such as Google Analytics or Facebook); Purpose limitation means do not process the personal data for further purposes ; You ought to keep the data accurate, secure and no longer than necessary. Less data you collect and keep, better you are.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an ECJ Advocate General opinion on the validity of consent in the context of the provision of a copy of ID cards required from customers. Why should a telco company need to require to keep ID documents? read more here.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a Creative Commons Attribution 4.0 International License.</p>\n<!-- /wp:paragraph -->','Consider Personal Data as A Hot Potato','','inherit','closed','closed','','807-revision-v1','','','2020-08-29 01:48:05','2020-08-29 00:48:05','',807,'http://datarainbow.eu/?p=1018',0,'revision','',0),(1020,5,'2020-08-29 01:49:48','2020-08-29 00:49:48','<!-- wp:paragraph -->\n<p>An all time easy advice</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An all time easy advice</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lets reflect on two decades of mass collection of data. Massive amount of data necessarily means inaccurate data. Data storage equals data risk. Data risk equal liabilities. Data breach notification needs a fast response within 72 hours. More sensitive the data stored, higher the liability. We are awaiting the class actions in the UK, Lloyd v Google, several others in the EU and the latest in the US against&nbsp;<a href=\"https://www.linkedin.com/pulse/french-court-said-facial-recognition-technology-tara/\" target=\"_blank\" rel=\"noreferrer noopener\">ClearviewAI</a>. Data breach causes harm and loss of control that call for compensation. Nearly everyday we hear the breaking news of a new data breach. It is no more IF but WHEN data breach occurs. It happpens to big organisations as well as small ones.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So in that context, why collecting unnecessary data?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I still hear stories of Data Controllers asking for ID card to respond to a Subject Access Request. Professional Associations, even lawyers, asking for ID card to process documents or key access. I just want to remind of one of the key principals of the GDPR that can keep away from many troubles : DATA MINIMISATION.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consider personal data as a hot potato.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do not collect if you don\'t necessarily need it. Do not keep it longer than necessary, Do not share it with third parties with whom you\'ll become co-controller and therefore liable (Think of all these third parties accessing your visitors data such as Google Analytics or Facebook); Purpose limitation means do not process the personal data for further purposes ; You ought to keep the data accurate, secure and no longer than necessary. Less data you collect and keep, better you are.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an ECJ Advocate General opinion on the validity of consent in the context of the provision of a copy of ID cards required from customers. Why should a telco company need to require to keep ID documents? read more&nbsp;<a href=\"https://datarainbow.eu/2020/03/04/consumer-contracts-and-the-validity-of-consent/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Consider Personal Data as A Hot Potato','','inherit','closed','closed','','807-revision-v1','','','2020-08-29 01:49:48','2020-08-29 00:49:48','',807,'http://datarainbow.eu/?p=1020',0,'revision','',0),(1023,5,'2020-09-02 17:08:07','2020-09-02 16:08:07','','Screenshot 2020-09-02 at 17.01.04','','inherit','closed','closed','','screenshot-2020-09-02-at-17-01-04','','','2020-09-02 17:08:07','2020-09-02 16:08:07','',65,'/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-02-at-17.01.04.png',0,'attachment','image/png',0),(1024,5,'2020-09-02 17:08:19','2020-09-02 16:08:19','<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/posts/beaconai_globalstateofprivacy-privacy-dataprotection-activity-6706873062916198400-SDFJ\">Beacon AI</a> will host their Global State of Privacy virtual event with <a href=\"https://www.linkedin.com/company/altada-technology-solutions-limited/\">Altada Technology Solutions </a>on September 15th at 11am GMT. You can reserve your tickets now on Eventbrite <a href=\"https://bit.ly/34GwHvf\">https://bit.ly/34GwHvf</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Delighted to be asked to participate in this <a href=\"https://www.linkedin.com/company/beaconai/\">Beacon AI</a>\'s upcoming virtual event, Sharing the screen with some amazing fellow speakers including <a href=\"https://www.linkedin.com/in/ACoAAAEjZSMBPHCDNL0ZfbkbHBFk7NBEwjLsbi0\">Gordon Wade</a>, Áine Quirke, <a href=\"https://www.linkedin.com/in/ACoAAAqCsAcBtx0dA1Lw7VNmUBejjlgS7zW6sNA\">Gail Chalmin</a>, <a href=\"https://www.linkedin.com/in/ACoAAAGW1hEBKjAOVvS9pL8ollH0kw1TY1y3iJw\">Alexander Hanff</a>, <a href=\"https://www.linkedin.com/in/ACoAAA7DYaIB7VdfLfG7VcW5z1b0a5fHRYiUraU\">Niamh Parker</a>, <a href=\"https://www.linkedin.com/in/ACoAAACvVXEBcRlW49jJa3QuJdQfqLnC30uMTBg\">JT Lewis</a> and <a href=\"https://www.linkedin.com/in/ACoAAACOxggBCpqn1fqX0pEpAxapf-s7wsALdjk\">Stijn (Stan) Christiaens</a> on a host of the hottest topics in <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706936641153589248\">#dataprotection</a> right now.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I look forward to seeing you there! Thank you to our event supporters <a href=\"https://www.linkedin.com/company/corkbic/\">CorkBIC</a>, <a href=\"https://www.linkedin.com/company/mason-hayes-curran/\">Mason Hayes &amp; Curran LLP</a> and <a href=\"https://www.linkedin.com/in/ACoAAANQKyMBOTl9pq57vcedDiTn5LNa4VveruE\">Glandore Network</a><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=globalstateofprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706873062916198400\">#</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://privacylawblog.fieldfisher.com/2019/edpb-prepares-for-a-no-deal-brexit\">EDPB prepares for a \"no deal\" Brexit</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"What this means is that companies in the EU (including the EEA) that are currently freely sending their personal data to the UK will have to implement appropriate safeguards in accordance with article 46 before transferring any personal data to the UK. These appropriate safeguards include:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Standard Data Protection Clauses adopted by the European Commission of a DPA</em></li><li><em>Ad Hoc Data Protection Clauses adopted the EU based company (data exporter) and the UK based recipient of this data (data importer)</em></li><li><em>Binding Corporate Rules</em></li><li><em>Codes of Conduct</em></li><li><em>Certification Mechanism\"</em>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board Published its guidance :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information note on data transfers under the GDPR in the event of a no-deal Brexit  <a href=\"https://www.pearltrees.com/s/file/preview/192486822/edpb-2019-02-12-infonote-nodeal-brexit_en.pdf\">Adopted on 12 February 2019</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Information note on BCRs for companies which have ICO<br> as BCR Lead Supervisory Authority - <a href=\"https://www.pearltrees.com/s/file/preview/192486834/edpb-2019-02-12-infonote-bcrs-brexit_en.pdf\">Adopted on 12 February 2019&nbsp;</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>ICO guidance</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>To&nbsp;<em>help</em>&nbsp;organisations prepare for a&nbsp;<em>\'</em>no deal<em>\'</em>&nbsp;Brexit, the ICO has published a short guide for UK businesses:&nbsp;<em>\'</em><a href=\"https://ico.org.uk/media/2553958/leaving-the-eu-six-steps-to-take.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Six Steps to Take</a><em>\'</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Continue to comply</em></strong>&nbsp;with GDPR and follow ICO guidance.</li><li><strong><em>Transfers to the UK</em>:</strong>&nbsp;Review data flows and identify where your organisation receives data into the UK from the EEA to ensure sufficient safeguards are in place to allow the continued flow of personal data.</li><li><strong><em>Transfers from the UK</em>:</strong>&nbsp;Identify data flows to countries outside of the UK, as these will fall under new UK transfer and documentation provisions.</li><li><strong><em>European operations</em>:</strong>&nbsp;For organisations that operate across Europe, data flows, processing operations and group structures should be reviewed to fully understand the effect of Brexit on operations.</li><li><strong><em>Documentation:</em></strong>&nbsp;Identify privacy documentation in the event it needs to be updated when the UK leaves the EU.</li><li><strong><em>Organisational awareness:</em></strong>&nbsp;Ensure key people in the organisation are aware of these key issues and that plans are up to date.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong><a href=\"https://www.gov.uk/government/publications/data-protection-law-eu-exit/amendments-to-uk-data-protection-law-in-the-event-the-uk-leaves-the-eu-without-a-deal-on-29-march-2019\">UK Gov Guidance</a> : Amendments to UK data protection law in the event the UK leaves the EU without a deal on 29 March 2019</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Resources on<a href=\"http://www.pearltrees.com/privacyday/uk-brexit/id23426706\"> Brexit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\" target=\"_blank\">Google-Style GDPR Fines for Everyone? Bavarian DPA Conducts Website Cookie Practices Sweep, Announces Fines under Consideration</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted <strong>Privacy Hero 2018</strong>, is on Voice of America Business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. contact data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let the data flow, <a href=\"https://blogs.dlapiper.com/privacymatters/eu-japan-let-the-data-flow-free-flow-of-personal-data-between-eu-countries-and-japan-confirmed/\">adequacy decision between EU and Japan</a> adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Former European Data Protection Supervisor Peter Hustinx joins <a href=\"https://t.co/2LSgMjSG6b\">ICO </a>as non-executive director.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.pearltrees.com/privacyday/twitter/id23766377#item247781087\">Twitter</a></em> under investigation by the Irish Data Protection Commission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.computerweekly.com/news/252456335/Facebooks-objections-to-court-concerns-over-privacy-more-about-optics-than-facts\">Facebook</a></em>’s challenge to a High Court ruling that raises serious concerns about data transfers between Europe and the US is more about appearance than facts, lawyers for the Irish Data Protection Commission told Dublin\'s Supreme Court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Via EDRI&nbsp;: On 7 February, the European Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE) presented two new working documents analysing further the issue of cross-border access to data in criminal matters, also known as “e-evidence”.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Conditions for obtaining subscriber information in relation to dynamic versus static IP addresses: overview of relevant court decisions and developments <a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\">here</a> and<a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"> here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https:\\/\\/rm.coe.int\\/t-cy-2018-26-ip-addresses-v6\\/16808ea472\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>WARNING : Links to external website may contain cookies and tracking of visitors data. Do adjust your privacy setting in accordance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1023} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-02-at-17.01.04-1024x498.png\" alt=\"\" class=\"wp-image-1023\" /></figure>\n<!-- /wp:image -->','NEWS','','inherit','closed','closed','','65-revision-v1','','','2020-09-02 17:08:19','2020-09-02 16:08:19','',65,'http://datarainbow.eu/?p=1024',0,'revision','',0),(1025,5,'2020-09-02 17:09:29','2020-09-02 16:09:29','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>NEW IMPORTANT UPDATE 24th July 2020</strong> - <a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\">NOYB Next Steps for EU companies &amp; FAQs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>FISA 702+EO 12333 have no territorial limitation. They also apply to servers in the EU that are operated by a US \'electronic communication service provider\' or where certain operations are outsourced to a US provider. The location for hosting is therefore irrelevant.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Any non-EU/EEA provider had the duty to inform you about laws like <a href=\"https://twitter.com/hashtag/FISA?src=hashtag_click\">FISA</a> 702 and EO 12.333. If they have not done so, they are liable for all costs that result from cancelling the SCCs and transferring data back to the EU/EEA…</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> The <a href=\"https://twitter.com/hashtag/PrivacyShield?src=hashtag_click\">#PrivacyShield</a> Decision was an incorrect executive decision by the European Commission. In theory, damages claims can be brought against the EU under Article 340 TFEU.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>providers may have sufficiently limited the factual access (\'possession, custody or control\') from US entities, so that an EU/EEA server is factually beyond the reach of the US govt.” I wonder if such controls are possible without full separation </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations in the world this end of the week. At first read, the Privacy Shield is invalidated with immediate effect. Data export to the US cant be replaced by two other legal instruments which have been said valid in principle by the ECJ, specifically Standard Contractual Clauses and Binding Corporate Rules $Article 49 GDPR derogations). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In the absence of an adequacy decision, the controller or processor should t<strong>ake measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject</strong>. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, <strong>standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority</strong>. Those safeguards should ensure compliance with d<strong>ata protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation</strong>, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default.  </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs and BCRs are subject to a strict requirement to implement a case by case analysis and assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated - only not for the UK ICO !!!. Thousands of companies who relied on Privacy Shield will have to find another solution.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraph 103 of the ECJ decision states :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.</p><p><br>Paragraph 143 to add:</p><p>Return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite the Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA bilk data collection , and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her first reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to the US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option left, only IF they are adapted and re-evaluated with the DPAs supervision. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more actively their concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they are other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>Ask the lawyers exchanging data across the channel, will they ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce you liability. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access although at some point the data will need to be unencrypted and vulnerable. Using EU companies as processor, or or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called <a href=\"https://www.cnbc.com/2020/07/17/gaia-x-europes-answer-to-us-and-chinese-tech-giants-power.html\">Gaia-X </a>might be the winner in this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third party cookies such as Google Analytics or Facebook Modernizr are means of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/our-work-tools/our-documents/other/frequently-asked-questions-judgment-court-justice-european-union_en\">Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems - European Data Protection Board - European Data Protection Board</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://iapp.org/news/a/using-sccs-post-schrems-ii-guidance-from-dpas/?mkt_tok=eyJpIjoiWkRsbVl6a3pZakJpTkRKaiIsInQiOiJSSVBkRGVVdFdBTXRUdDAzQzN5NktITWRaVG9QVnQ3U2hpeTQ2K09UU3BpWlJlVzZucTZjODVhSFFuV0VKcG1PdVpKQTErSTdVV09DNFJIYlwvQzl0bWxLYVVhZUxMa29QVkR4SVJcL1R6TUJpWkFlTjd2V0pFVDlpTXRXYmQ0WEdBIn0%3D&amp;utm_content=135417219&amp;utm_medium=social&amp;utm_source=linkedin&amp;hss_channel=lcp-10094295\">Using SCCs post-\'Schrems II\': Guidance from DPAs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">Schrems and the future of EU-US data transfers (or lack thereof…)&nbsp;</a>this is a LONG article. An interesting US view. It has some good elements but still missing few important points. No mention of the lawful basis of processing and the obligation of transparency FB failed. Why should there be any doubt on Facebook’s basis of data transfer to the US while SCC or Privacy Shield should be clearly stated in their privacy notice. Also no reference to the Cambridge Analytica interference into élections and manipulation of public opinion. I think this was a wake up call to many on the sort of game FB was playing when collecting data and profiling. Facebook is one player in the game, they are other big ones, US corporations have somehow grow so big that they are nous out of control even for the US government. I suggest reading Professor Lawrence Lessig on the point of Lobbying and corruption of the US Congress. Are EU countries much better? Well, surely they don’t have the same power. Plus there is some sort of partnership between EU countries offering some sort of guarantee. The EU is based on free mouvement of people and goods. Therefore the directive 95 came to ensure the free flow of data within member states. The real terror created by the 9/11 tragedy is the rising level of state surveillance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>State surveillance is the real threat to freedom and individual human rights. All Western countries have taken oppressive measures. What US has done is again one level higher with clear segregation against the rights of foreign citizens. Yes, in the EU we do care about our fundamental rights as much as the US is focused on free speech, Unlike the free speech in the US, The right to privacy and data protection are not absolute and have to be balanced with other fundamental rights. The right to privacy and data protection are différent despite being interconnected. Europe is a patchwork of sovereign nations with various cultures and legal systems. \nI fully agree with the authors ‘there are deep cultural differences between EU and US and you definitely need someone on your side that actually speaks and thinks “European” on this one.’\nBoth EU and US need each other. Transatlantic trade is essential but not at the cost of EU citizens rights. We might have woken up a bit late. Not sure we can actually stop the GAFAM with not enough EU competitors. Better late than never? It’s time for the Commission to play it’s role and negotiate a fairer agreement. I don’t believe a code of conduct could be sufficient. It won’t be an easy game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems-II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-09-02 17:09:29','2020-09-02 16:09:29','',975,'http://datarainbow.eu/?p=1025',0,'revision','',0),(1027,5,'2020-09-09 17:24:48','2020-09-09 16:24:48','','EgDrrV6XsAk0Gtn1','','inherit','closed','closed','','egdrrv6xsak0gtn1','','','2020-09-09 17:24:48','2020-09-09 16:24:48','',0,'/wp-content/uploads/sites/3/2020/09/EgDrrV6XsAk0Gtn1.jpeg',0,'attachment','image/jpeg',0),(1029,5,'2020-09-09 17:32:43','2020-09-09 16:32:43','','EgD3c2tXkAAprLH2','','inherit','closed','closed','','egd3c2txkaaprlh2','','','2020-09-09 17:32:43','2020-09-09 16:32:43','',0,'/wp-content/uploads/sites/3/2020/09/EgD3c2tXkAAprLH2.png',0,'attachment','image/png',0),(1030,5,'2020-09-09 17:35:20','2020-09-09 16:35:20','','EgD45IoXoAAe7AJ4','','inherit','closed','closed','','egd45ioxoaae7aj4','','','2020-09-09 17:35:20','2020-09-09 16:35:20','',0,'/wp-content/uploads/sites/3/2020/09/EgD45IoXoAAe7AJ4.jpeg',0,'attachment','image/jpeg',0),(1031,5,'2020-09-09 17:36:13','2020-09-09 16:36:13','','EgD56H6XkAAmcJz5','','inherit','closed','closed','','egd56h6xkaamcjz5','','','2020-09-09 17:36:13','2020-09-09 16:36:13','',0,'/wp-content/uploads/sites/3/2020/09/EgD56H6XkAAmcJz5.jpeg',0,'attachment','image/jpeg',0),(1033,5,'2020-09-11 14:46:51','2020-09-11 13:46:51','<!-- wp:image {\"id\":1038} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-11-at-14.56.11.png\" alt=\"\" class=\"wp-image-1038\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Part of the data protection duties for any controller owning a website is to ensure the security of the electronic transmissions and the personal data of their visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One way of tracking visitors is by first party cookies or allowing third party cookies to access visitors data. As an illustration, many websites use Google Analytics, or a Facebook \'Like\' button, etc... These allow the parties to track users web browsing even outside the website itself, in order to fingerprint, track, profile ad target them. Our personal data have monetary values and are aggressively monetised. Ad Tech is a huge, wealthy industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since Privacy Shield invalidation by the European Court of Justice in the so-called Schrems-II decision, US corporations, especially the Electronic Communication Providers (ECP) have no legitimate basis to transfer data outside the EU/EEA. Therefore, any website owner using Google Analytics or other US ECP enabled to access their visitors\' data, are considered co-controller and as such liable for the unlawful data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A second security issue you can find on some websites is their lack of end to end encryption or E2EE allowing access to data during electronic transmissions. Google Chrome web browser has been labelling such websites of \'Not secure\' that you can spot at the top bar of your web browser. Other web browsers would omit to display the lock next to the URL as a sign the website is lacking security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Shamefully, this exact website we are using has been recently, every now and on, missing the SSL certificate for E2EE. This website is hosted by Godaddy for the last few months. Godaddy does not allow the use of the free letsencrypt certificate, they sell their own SSL certificate which sadly has shown to be un-reliable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, we want to reassure you, we do not collect any personal data. We do not place any first party cookies. We do not use any kind of analytics. We only use a Google font. We are constantly working to make this website as secure as compliant as possible. If you notice anything suspicious, do contact us at data@datarainbow.eu We are looking for web developers, with coding skills to build a website without any template or tracking Java Script or cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, our apologies if momentarily you see a \'Not Secure\' sign. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','End to End Encryption on Website','Part of the data protection duties for any controller owning a website is to ensure the security of the electronic transmissions and the personal data of their visitors and E2EE.','publish','closed','closed','','end-to-end-encryption-on-website','','','2020-09-11 14:58:07','2020-09-11 13:58:07','',0,'http://datarainbow.eu/?p=1033',0,'post','',0),(1034,5,'2020-09-11 14:44:27','2020-09-11 13:44:27','','Screenshot 2020-09-11 at 14.43.08','','inherit','closed','closed','','screenshot-2020-09-11-at-14-43-08','','','2020-09-11 14:44:27','2020-09-11 13:44:27','',1033,'/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-11-at-14.43.08.png',0,'attachment','image/png',0),(1035,5,'2020-09-11 14:46:51','2020-09-11 13:46:51','<!-- wp:paragraph -->\n<p>Part of the data protection duties for any controller owning a website is to ensure the security of the electronic transmissions and the personal data of their visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One way of tracking visitors is by first party cookies or allowing third party cookies to access visitors data. As an illustration, many websites use Google Analytics, or a Facebook \'Like\' button, etc... These allow the parties to track users web browsing even outside the website itself, in order to fingerprint, track, profile ad target them. Our personal data have monetary values and are aggressively monetised. Ad Tech is a huge, wealthy industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since Privacy Shield invalidation by the European Court of Justice in the so-called Schrems-II decision, US corporations, especially the Electronic Communication Providers (ECP) have no legitimate basis to transfer data outside the EU/EEA. Therefore, any website owner using Google Analytics or other US ECP enabled to access their visitors\' data, are considered co-controller and as such liable for the unlawful data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A second security issue you can find on some websites is their lack of end to end encryption or E2EE allowing access to data during electronic transmissions. Google Chrome web browser has been labelling such websites of \'Not secure\' that you can spot at the top bar of your web browser. Other web browsers would omit to display the lock next to the URL as a sign the website is lacking security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Shamefully, this exact website we are using has been recently, every now and on, missing the SSL certificate for E2EE. This website is hosted by Godaddy for the last few months. Godaddy does not allow the use of the free letsencrypt certificate, they sell their own SSL certificate which sadly has shown to be un-reliable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, we want to reassure you, we do not collect any personal data. We do not place any first party cookies. We do not use any kind of analytics. We only use a Google font. We are constantly working to make this website as secure as compliant as possible. If you notice anything suspicious, do contact us at data@datarainbow.eu We are looking for web developers, with coding skills to build a website without any template or tracking Java Script or cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, our apologies if momentarily you see a \'Not Secure\' sign. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','End to End Encryption on Website','','inherit','closed','closed','','1033-revision-v1','','','2020-09-11 14:46:51','2020-09-11 13:46:51','',1033,'https://datarainbow.eu/?p=1035',0,'revision','',0),(1037,5,'2020-09-11 14:57:51','2020-09-11 13:57:51','<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://datarainbow.eu/d80ca4d0-827a-4b0c-9ab6-54141bec050c\" alt=\"\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Part of the data protection duties for any controller owning a website is to ensure the security of the electronic transmissions and the personal data of their visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One way of tracking visitors is by first party cookies or allowing third party cookies to access visitors data. As an illustration, many websites use Google Analytics, or a Facebook \'Like\' button, etc... These allow the parties to track users web browsing even outside the website itself, in order to fingerprint, track, profile ad target them. Our personal data have monetary values and are aggressively monetised. Ad Tech is a huge, wealthy industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since Privacy Shield invalidation by the European Court of Justice in the so-called Schrems-II decision, US corporations, especially the Electronic Communication Providers (ECP) have no legitimate basis to transfer data outside the EU/EEA. Therefore, any website owner using Google Analytics or other US ECP enabled to access their visitors\' data, are considered co-controller and as such liable for the unlawful data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A second security issue you can find on some websites is their lack of end to end encryption or E2EE allowing access to data during electronic transmissions. Google Chrome web browser has been labelling such websites of \'Not secure\' that you can spot at the top bar of your web browser. Other web browsers would omit to display the lock next to the URL as a sign the website is lacking security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Shamefully, this exact website we are using has been recently, every now and on, missing the SSL certificate for E2EE. This website is hosted by Godaddy for the last few months. Godaddy does not allow the use of the free letsencrypt certificate, they sell their own SSL certificate which sadly has shown to be un-reliable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, we want to reassure you, we do not collect any personal data. We do not place any first party cookies. We do not use any kind of analytics. We only use a Google font. We are constantly working to make this website as secure as compliant as possible. If you notice anything suspicious, do contact us at data@datarainbow.eu We are looking for web developers, with coding skills to build a website without any template or tracking Java Script or cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, our apologies if momentarily you see a \'Not Secure\' sign. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','End to End Encryption on Website','Part of the data protection duties for any controller owning a website is to ensure the security of the electronic transmissions and the personal data of their visitors and E2EE.','inherit','closed','closed','','1033-revision-v1','','','2020-09-11 14:57:51','2020-09-11 13:57:51','',1033,'https://datarainbow.eu/?p=1037',0,'revision','',0),(1038,5,'2020-09-11 14:57:52','2020-09-11 13:57:52','','Screenshot 2020-09-11 at 14.56.11','','inherit','closed','closed','','screenshot-2020-09-11-at-14-56-11','','','2020-09-11 14:57:52','2020-09-11 13:57:52','',1033,'/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-11-at-14.56.11.png',0,'attachment','image/png',0),(1040,5,'2020-09-11 14:58:06','2020-09-11 13:58:06','<!-- wp:image {\"id\":1038} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-11-at-14.56.11.png\" alt=\"\" class=\"wp-image-1038\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Part of the data protection duties for any controller owning a website is to ensure the security of the electronic transmissions and the personal data of their visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One way of tracking visitors is by first party cookies or allowing third party cookies to access visitors data. As an illustration, many websites use Google Analytics, or a Facebook \'Like\' button, etc... These allow the parties to track users web browsing even outside the website itself, in order to fingerprint, track, profile ad target them. Our personal data have monetary values and are aggressively monetised. Ad Tech is a huge, wealthy industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since Privacy Shield invalidation by the European Court of Justice in the so-called Schrems-II decision, US corporations, especially the Electronic Communication Providers (ECP) have no legitimate basis to transfer data outside the EU/EEA. Therefore, any website owner using Google Analytics or other US ECP enabled to access their visitors\' data, are considered co-controller and as such liable for the unlawful data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A second security issue you can find on some websites is their lack of end to end encryption or E2EE allowing access to data during electronic transmissions. Google Chrome web browser has been labelling such websites of \'Not secure\' that you can spot at the top bar of your web browser. Other web browsers would omit to display the lock next to the URL as a sign the website is lacking security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Shamefully, this exact website we are using has been recently, every now and on, missing the SSL certificate for E2EE. This website is hosted by Godaddy for the last few months. Godaddy does not allow the use of the free letsencrypt certificate, they sell their own SSL certificate which sadly has shown to be un-reliable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, we want to reassure you, we do not collect any personal data. We do not place any first party cookies. We do not use any kind of analytics. We only use a Google font. We are constantly working to make this website as secure as compliant as possible. If you notice anything suspicious, do contact us at data@datarainbow.eu We are looking for web developers, with coding skills to build a website without any template or tracking Java Script or cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, our apologies if momentarily you see a \'Not Secure\' sign. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','End to End Encryption on Website','Part of the data protection duties for any controller owning a website is to ensure the security of the electronic transmissions and the personal data of their visitors and E2EE.','inherit','closed','closed','','1033-revision-v1','','','2020-09-11 14:58:06','2020-09-11 13:58:06','',1033,'https://datarainbow.eu/?p=1040',0,'revision','',0),(1045,5,'2020-09-22 12:31:27','0000-00-00 00:00:00','<!-- wp:paragraph -->\n<p><a href=\"https://Datarainbow.uk/drive/d/f/577550517591388837\">https://Datarainbow.uk/drive/d/f/577550517591388837</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://Datarainbow.uk/drive/d/f/577550517591388837\">https://Datarainbow.uk/drive/d/f/577550517591388837</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://Datarainbow.uk/drive/d/f/577550517591388837\" alt=\"\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','','','draft','closed','closed','','','','','2020-09-22 12:31:27','2020-09-22 11:31:27','',0,'http://datarainbow.eu/?p=1045',0,'post','',0),(1046,5,'2020-09-22 12:20:07','2020-09-22 11:20:07','{{unknown}}','','','publish','closed','closed','','f0a63581186a0e68ee3f5ce6150f3e65','','','2020-09-22 12:20:07','2020-09-22 11:20:07','',0,'https://datarainbow.eu/?p=1046',0,'oembed_cache','',0),(1047,5,'2020-09-24 15:35:11','0000-00-00 00:00:00','<!-- wp:file /-->','','','draft','closed','closed','','','','','2020-09-24 15:35:11','2020-09-24 14:35:11','',0,'http://datarainbow.eu/?p=1047',0,'post','',0),(1049,5,'2020-10-23 01:05:08','2020-10-23 00:05:08','<!-- wp:heading -->\n<h2>Online Platforms and Popular Technologies 2020</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>9:15 AM PDT</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3><a href=\"https://www.pli.edu/programs/online-platforms\">E.U. Developments in Platform Regulation</a></h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Hear Copyright Directive implementation status and e-Commerce directive developments</li><li>Privacy: get the latest GDPR developments</li><li>Discover Germany’s NetzDG and online speech regulation</li><li>Understand the implications of Brexit on platform regulation and legacy of EU rules</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>(IAPP Privacy credit for Privacy Professionals)</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><strong>Remy Chavannes, Daphne Keller, Graham Smith, Tara Taubman-Bassirian</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What You Will Learn</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Attendees will hear from leading legal and policy experts and thinkers including experienced in-house counsel. Those who attend will:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Learn about the geopolitical and industry rivalries and debates about platforms and popular technologies</li><li>Hear about the implications of Brexit for platform regulations</li><li>Understand how the pandemic has affected, and will profoundly affect, issues relating to privacy, surveillance, AI and algorithms, and other topics</li><li>Gain insight into the politicization of social media platforms and communication technologies</li><li>Find connections among seemingly disparate topics of hate speech, copyright, and “fake news” through the lens of “content moderation”</li><li>Benefit from perspectives of seasoned in-house counsel, advisors, and litigators</li></ul>\n<!-- /wp:list -->','PLI - Legal and Regulatory Responses to Technology Challenges','','publish','closed','closed','','pli-online-platforms-and-popular-technologies-2020-legal-and-regulatory-responses-to-technology-challenges','','','2020-10-23 01:26:19','2020-10-23 00:26:19','',45,'http://datarainbow.eu/?page_id=1049',0,'page','',0),(1050,5,'2020-10-23 01:04:49','2020-10-23 00:04:49','','Screenshot 2020-10-23 at 01.04.17','','inherit','closed','closed','','screenshot-2020-10-23-at-01-04-17','','','2020-10-23 01:04:49','2020-10-23 00:04:49','',1049,'/wp-content/uploads/sites/3/2020/10/Screenshot-2020-10-23-at-01.04.17.png',0,'attachment','image/png',0),(1051,5,'2020-10-23 01:05:08','2020-10-23 00:05:08','<!-- wp:heading {\"level\":5} -->\n<h5>9:15 AM PDT</h5>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3><a href=\"https://www.pli.edu/programs/online-platforms\">E.U. Developments in Platform Regulation</a></h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Hear Copyright Directive implementation status and e-Commerce directive developments</li><li>Privacy: get the latest GDPR developments</li><li>Discover Germany’s NetzDG and online speech regulation</li><li>Understand the implications of Brexit on platform regulation and legacy of EU rules</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>(IAPP Privacy credit for Privacy Professionals)</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><strong>Remy Chavannes, Daphne Keller, Graham Smith, Tara Taubman-Bassirian</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What You Will Learn</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Attendees will hear from leading legal and policy experts and thinkers including experienced in-house counsel. Those who attend will:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Learn about the geopolitical and industry rivalries and debates about platforms and popular technologies</li><li>Hear about the implications of Brexit for platform regulations</li><li>Understand how the pandemic has affected, and will profoundly affect, issues relating to privacy, surveillance, AI and algorithms, and other topics</li><li>Gain insight into the politicization of social media platforms and communication technologies</li><li>Find connections among seemingly disparate topics of hate speech, copyright, and “fake news” through the lens of “content moderation”</li><li>Benefit from perspectives of seasoned in-house counsel, advisors, and litigators</li></ul>\n<!-- /wp:list -->','PLI - Online Platforms and Popular Technologies 2020: Legal and Regulatory Responses to Technology Challenges','','inherit','closed','closed','','1049-revision-v1','','','2020-10-23 01:05:08','2020-10-23 00:05:08','',1049,'https://datarainbow.eu/?p=1051',0,'revision','',0),(1052,5,'2020-10-23 01:08:22','2020-10-23 00:08:22','','PLI – Online Platforms and Popular Technologies 2020: Legal and Regulatory Responses to Technology Challenges','','publish','closed','closed','','pli-online-platforms-and-popular-technologies-2020-legal-and-regulatory-responses-to-technology-challenges','','','2020-10-25 23:03:34','2020-10-25 23:03:34','',45,'http://datarainbow.eu/?p=1052',3,'nav_menu_item','',0),(1053,5,'2020-10-23 01:15:35','2020-10-23 00:15:35','<!-- wp:paragraph -->\n<p><a href=\"https://www.altada.com/\">Altada</a>&nbsp;Technology Solutions and Beacon AI will host their virtual event, ‘The Global State of Privacy,’ on September 15th at 11 am GMT, supported by partners Cork BIC, Mason Hayes &amp; Curran, and Glandore.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The event will host a keynote on ‘Data Intelligence in a Changing World’ with<a href=\"https://www.linkedin.com/in/stijnchristiaens/?lipi=urn%3Ali%3Apage%3Ad_flagship3_search_srp_top%3Bgv0rWw63TgSq9kqVti4%2FTQ%3D%3D&amp;licu=urn%3Ali%3Acontrol%3Ad_flagship3_search_srp_top-search_srp_result&amp;lici=TL8sStFyT2uu3sNTG5BGLw%3D%3D\">&nbsp;Stijn Christiaens</a>, co-founder and CTO at Collibra. Christiaens says, “Our world is being dragged into its new normal, pushing digital on the fast track. As organizations increasingly reap data’s rewards, and algorithms affect our education, our careers, our health, we are starting to realize that data is getting personal. It is time to make our organization’s data intelligent.” We will also have two panels focusing on the global state of privacy and CCPA legislation respectively. Both panels will feature global industry leaders in privacy and data protection. The event will have an international audience being broadcast virtually.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":1} -->\n<h1><br></h1>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Featured speakers are Gordon Wade, Data Protection Officer &amp; Legal Counsel at Hostelworld Group; Alexander Hanff, CEO &amp; Privacy Evangelist at Think Privacy; Tara Taubman Bassirian of Data Rainbow who was voted Privacy Hero in 2018; Allan Beechinor, CEO &amp; co-founder of Altada Technology Solutions; Paul Doyle, Partner at Beta Digital; Rui Freitas Serrano, Data Protection Officer; Gail Chalmin, Data Protection Consultant; Niamh Parker, CEO &amp; co-founder of Beacon AI and a Áine Quirke, Privacy and Data Security Associate at Mason Hayes &amp; Curran. The event will be moderated by JT Lewis, Strategy and Growth Officer at Altada.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Read More:</strong>&nbsp;<a href=\"https://itsecuritywire.com/featured/cyberattack-how-threat-actors-are-targeting-enterprises-amid-covid-19/\" target=\"_blank\" rel=\"noreferrer noopener\">Cyberattack – How Threat Actors are Targeting Enterprises&nbsp;amid COVID-19</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Altada Technology Solutions and Beacon AI to host their ‘Global State of Privacy’','','publish','closed','closed','','1053-2','','','2020-10-23 01:16:57','2020-10-23 00:16:57','',45,'http://datarainbow.eu/?page_id=1053',2,'page','',0),(1054,5,'2020-10-23 01:14:55','2020-10-23 00:14:55','','Screenshot 2020-10-23 at 01.14.24','','inherit','closed','closed','','screenshot-2020-10-23-at-01-14-24','','','2020-10-23 01:14:55','2020-10-23 00:14:55','',1053,'/wp-content/uploads/sites/3/2020/10/Screenshot-2020-10-23-at-01.14.24.png',0,'attachment','image/png',0),(1055,5,'2020-10-23 01:15:35','2020-10-23 00:15:35','<!-- wp:heading {\"level\":1} -->\n<h1>Altada Technology Solutions and Beacon AI to host their ‘Global State of Privacy’</h1>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.altada.com/\">Altada</a>&nbsp;Technology Solutions and Beacon AI will host their virtual event, ‘The Global State of Privacy,’ on September 15th at 11 am GMT, supported by partners Cork BIC, Mason Hayes &amp; Curran, and Glandore.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The event will host a keynote on ‘Data Intelligence in a Changing World’ with<a href=\"https://www.linkedin.com/in/stijnchristiaens/?lipi=urn%3Ali%3Apage%3Ad_flagship3_search_srp_top%3Bgv0rWw63TgSq9kqVti4%2FTQ%3D%3D&amp;licu=urn%3Ali%3Acontrol%3Ad_flagship3_search_srp_top-search_srp_result&amp;lici=TL8sStFyT2uu3sNTG5BGLw%3D%3D\">&nbsp;Stijn Christiaens</a>, co-founder and CTO at Collibra. Christiaens says, “Our world is being dragged into its new normal, pushing digital on the fast track. As organizations increasingly reap data’s rewards, and algorithms affect our education, our careers, our health, we are starting to realize that data is getting personal. It is time to make our organization’s data intelligent.” We will also have two panels focusing on the global state of privacy and CCPA legislation respectively. Both panels will feature global industry leaders in privacy and data protection. The event will have an international audience being broadcast virtually.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Featured speakers are Gordon Wade, Data Protection Officer &amp; Legal Counsel at Hostelworld Group; Alexander Hanff, CEO &amp; Privacy Evangelist at Think Privacy; Tara Taubman Bassirian of Data Rainbow who was voted Privacy Hero in 2018; Allan Beechinor, CEO &amp; co-founder of Altada Technology Solutions; Paul Doyle, Partner at Beta Digital; Rui Freitas Serrano, Data Protection Officer; Gail Chalmin, Data Protection Consultant; Niamh Parker, CEO &amp; co-founder of Beacon AI and a Áine Quirke, Privacy and Data Security Associate at Mason Hayes &amp; Curran. The event will be moderated by JT Lewis, Strategy and Growth Officer at Altada.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Read More:</strong>&nbsp;<a href=\"https://itsecuritywire.com/featured/cyberattack-how-threat-actors-are-targeting-enterprises-amid-covid-19/\" target=\"_blank\" rel=\"noreferrer noopener\">Cyberattack – How Threat Actors are Targeting Enterprises&nbsp;amid COVID-19</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','','','inherit','closed','closed','','1053-revision-v1','','','2020-10-23 01:15:35','2020-10-23 00:15:35','',1053,'https://datarainbow.eu/?p=1055',0,'revision','',0),(1056,5,'2020-10-23 01:16:57','2020-10-23 00:16:57','<!-- wp:paragraph -->\n<p><a href=\"https://www.altada.com/\">Altada</a>&nbsp;Technology Solutions and Beacon AI will host their virtual event, ‘The Global State of Privacy,’ on September 15th at 11 am GMT, supported by partners Cork BIC, Mason Hayes &amp; Curran, and Glandore.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The event will host a keynote on ‘Data Intelligence in a Changing World’ with<a href=\"https://www.linkedin.com/in/stijnchristiaens/?lipi=urn%3Ali%3Apage%3Ad_flagship3_search_srp_top%3Bgv0rWw63TgSq9kqVti4%2FTQ%3D%3D&amp;licu=urn%3Ali%3Acontrol%3Ad_flagship3_search_srp_top-search_srp_result&amp;lici=TL8sStFyT2uu3sNTG5BGLw%3D%3D\">&nbsp;Stijn Christiaens</a>, co-founder and CTO at Collibra. Christiaens says, “Our world is being dragged into its new normal, pushing digital on the fast track. As organizations increasingly reap data’s rewards, and algorithms affect our education, our careers, our health, we are starting to realize that data is getting personal. It is time to make our organization’s data intelligent.” We will also have two panels focusing on the global state of privacy and CCPA legislation respectively. Both panels will feature global industry leaders in privacy and data protection. The event will have an international audience being broadcast virtually.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":1} -->\n<h1><br></h1>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Featured speakers are Gordon Wade, Data Protection Officer &amp; Legal Counsel at Hostelworld Group; Alexander Hanff, CEO &amp; Privacy Evangelist at Think Privacy; Tara Taubman Bassirian of Data Rainbow who was voted Privacy Hero in 2018; Allan Beechinor, CEO &amp; co-founder of Altada Technology Solutions; Paul Doyle, Partner at Beta Digital; Rui Freitas Serrano, Data Protection Officer; Gail Chalmin, Data Protection Consultant; Niamh Parker, CEO &amp; co-founder of Beacon AI and a Áine Quirke, Privacy and Data Security Associate at Mason Hayes &amp; Curran. The event will be moderated by JT Lewis, Strategy and Growth Officer at Altada.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Read More:</strong>&nbsp;<a href=\"https://itsecuritywire.com/featured/cyberattack-how-threat-actors-are-targeting-enterprises-amid-covid-19/\" target=\"_blank\" rel=\"noreferrer noopener\">Cyberattack – How Threat Actors are Targeting Enterprises&nbsp;amid COVID-19</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Altada Technology Solutions and Beacon AI to host their ‘Global State of Privacy’','','inherit','closed','closed','','1053-revision-v1','','','2020-10-23 01:16:57','2020-10-23 00:16:57','',1053,'https://datarainbow.eu/?p=1056',0,'revision','',0),(1057,5,'2020-10-23 01:20:36','2020-10-23 00:20:36',' ','','','publish','closed','closed','','1057','','','2020-10-25 23:03:34','2020-10-25 23:03:34','',45,'http://datarainbow.eu/?p=1057',4,'nav_menu_item','',0),(1058,5,'2020-10-23 01:22:49','2020-10-23 00:22:49','<!-- wp:core-embed/wordpress {\"url\":\"https:\\/\\/www.vpnreports.com\\/interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk\\/\",\"type\":\"wp-embed\",\"providerNameSlug\":\"vpn-reports\",\"className\":\"\"} -->\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-vpn-reports\"><div class=\"wp-block-embed__wrapper\">\nhttps://www.vpnreports.com/interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk/\n</div></figure>\n<!-- /wp:core-embed/wordpress -->\n\n<!-- wp:paragraph -->\n<p>Today we’re interviewing Tara Taubman-Bassirian, who specialized in Information and Internet law in the UK. She’s been following the data Protection Regulation since the reform of the Directive. And obviously, she has a lot of useful information to share. Here’s what Tara had to say…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Can you shortly introduce yourself?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I am a French lawyer, previously a corporate lawyer in France before I specialized in Information and Internet law in the UK. I was recently voted Privacy Hero by my pears.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been following the Data Protection Regulation since the reform of the Directive. My company&nbsp;<a href=\"https://datarainbow.eu/\" target=\"_blank\" rel=\"noreferrer noopener\">Data Rainbow</a>&nbsp;helps businesses and private users remain compliant with the regulation. I am also a public speaker and writer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What do you see as the main challenges for our privacy today?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>The challenges of privacy are the price we are paying with the development of digitalization and global access to data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What can we as individuals do about it?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Education and keeping aware of the greatness and dangers of the cyberworld are key. I like to say that data breach, cybersecurity or ransomware incidents are not anymore IF but WHEN. And when it happens, we need to be prepared. It starts with data minimization. It is our duty to secure data and protect ourselves when surfing online as much as it is for major companies to secure data storage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Can VPNs help? Do you use one?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I use ExpressVPN that several techy friends and colleagues have advised me. I am hoping it helps to protect my identity online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What do you do to protect your personal information?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I start by minimization as I mentioned. Every now and then, I check what I have been collecting and delete the data once it is not necessary. I archive my files on external hard drives, with no internet access. I regularly update my applications and computers, and I use strong passwords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, I don’t leave my paper files unattended when I leave; I use a password on my laptop which I don’t leave unattended when I’m not around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Do you have some other advice for our readers so they could, at least partially, regain their privacy?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I use fake names on social media. I use Twitter and Facebook as these are part of my professional life. I intentionally post fake news about myself trying to blur the reality of my persona. I believe if more users did so, Facebook algorithms would become totally useless. I don’t give up my real name or date of birth when it is not needed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I don’t recommend two-factor identification as I don’t trust these companies to share my phone with them. I turn off my geolocation unless needed; same with Bluetooth. Never use public Wifi.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I share my security knowledge and news and regularly read on these subjects to keep up to date.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','VPN Reports','','publish','closed','closed','','interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk','','','2020-10-23 01:24:14','2020-10-23 00:24:14','',739,'http://datarainbow.eu/?page_id=1058',0,'page','',0),(1059,5,'2020-10-23 01:22:49','2020-10-23 00:22:49','<!-- wp:core-embed/wordpress {\"url\":\"https:\\/\\/www.vpnreports.com\\/interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk\\/\",\"type\":\"wp-embed\",\"providerNameSlug\":\"vpn-reports\",\"className\":\"\"} -->\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-vpn-reports\"><div class=\"wp-block-embed__wrapper\">\nhttps://www.vpnreports.com/interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk/\n</div></figure>\n<!-- /wp:core-embed/wordpress -->\n\n<!-- wp:paragraph -->\n<p>Today we’re interviewing Tara Taubman-Bassirian, who specialized in Information and Internet law in the UK. She’s been following the data Protection Regulation since the reform of the Directive. And obviously, she has a lot of useful information to share. Here’s what Tara had to say…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Can you shortly introduce yourself?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I am a French lawyer, previously a corporate lawyer in France before I specialized in Information and Internet law in the UK. I was recently voted Privacy Hero by my pears.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been following the Data Protection Regulation since the reform of the Directive. My company&nbsp;<a href=\"https://datarainbow.eu/\" target=\"_blank\" rel=\"noreferrer noopener\">Data Rainbow</a>&nbsp;helps businesses and private users remain compliant with the regulation. I am also a public speaker and writer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What do you see as the main challenges for our privacy today?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>The challenges of privacy are the price we are paying with the development of digitalization and global access to data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What can we as individuals do about it?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Education and keeping aware of the greatness and dangers of the cyberworld are key. I like to say that data breach, cybersecurity or ransomware incidents are not anymore IF but WHEN. And when it happens, we need to be prepared. It starts with data minimization. It is our duty to secure data and protect ourselves when surfing online as much as it is for major companies to secure data storage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Can VPNs help? Do you use one?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I use ExpressVPN that several techy friends and colleagues have advised me. I am hoping it helps to protect my identity online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What do you do to protect your personal information?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I start by minimization as I mentioned. Every now and then, I check what I have been collecting and delete the data once it is not necessary. I archive my files on external hard drives, with no internet access. I regularly update my applications and computers, and I use strong passwords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, I don’t leave my paper files unattended when I leave; I use a password on my laptop which I don’t leave unattended when I’m not around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Do you have some other advice for our readers so they could, at least partially, regain their privacy?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I use fake names on social media. I use Twitter and Facebook as these are part of my professional life. I intentionally post fake news about myself trying to blur the reality of my persona. I believe if more users did so, Facebook algorithms would become totally useless. I don’t give up my real name or date of birth when it is not needed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I don’t recommend two-factor identification as I don’t trust these companies to share my phone with them. I turn off my geolocation unless needed; same with Bluetooth. Never use public Wifi.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I share my security knowledge and news and regularly read on these subjects to keep up to date.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Interview with Tara Taubman-Bassirian, Information and Internet Specialist in the UK','','inherit','closed','closed','','1058-revision-v1','','','2020-10-23 01:22:49','2020-10-23 00:22:49','',1058,'https://datarainbow.eu/?p=1059',0,'revision','',0),(1060,5,'2020-10-23 01:23:53','2020-10-23 00:23:53','<!-- wp:core-embed/wordpress {\"url\":\"https:\\/\\/www.vpnreports.com\\/interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk\\/\",\"type\":\"wp-embed\",\"providerNameSlug\":\"vpn-reports\",\"className\":\"\"} -->\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-vpn-reports\"><div class=\"wp-block-embed__wrapper\">\nhttps://www.vpnreports.com/interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk/\n</div></figure>\n<!-- /wp:core-embed/wordpress -->\n\n<!-- wp:paragraph -->\n<p>Today we’re interviewing Tara Taubman-Bassirian, who specialized in Information and Internet law in the UK. She’s been following the data Protection Regulation since the reform of the Directive. And obviously, she has a lot of useful information to share. Here’s what Tara had to say…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Can you shortly introduce yourself?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I am a French lawyer, previously a corporate lawyer in France before I specialized in Information and Internet law in the UK. I was recently voted Privacy Hero by my pears.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been following the Data Protection Regulation since the reform of the Directive. My company&nbsp;<a href=\"https://datarainbow.eu/\" target=\"_blank\" rel=\"noreferrer noopener\">Data Rainbow</a>&nbsp;helps businesses and private users remain compliant with the regulation. I am also a public speaker and writer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What do you see as the main challenges for our privacy today?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>The challenges of privacy are the price we are paying with the development of digitalization and global access to data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What can we as individuals do about it?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Education and keeping aware of the greatness and dangers of the cyberworld are key. I like to say that data breach, cybersecurity or ransomware incidents are not anymore IF but WHEN. And when it happens, we need to be prepared. It starts with data minimization. It is our duty to secure data and protect ourselves when surfing online as much as it is for major companies to secure data storage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Can VPNs help? Do you use one?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I use ExpressVPN that several techy friends and colleagues have advised me. I am hoping it helps to protect my identity online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What do you do to protect your personal information?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I start by minimization as I mentioned. Every now and then, I check what I have been collecting and delete the data once it is not necessary. I archive my files on external hard drives, with no internet access. I regularly update my applications and computers, and I use strong passwords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, I don’t leave my paper files unattended when I leave; I use a password on my laptop which I don’t leave unattended when I’m not around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Do you have some other advice for our readers so they could, at least partially, regain their privacy?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I use fake names on social media. I use Twitter and Facebook as these are part of my professional life. I intentionally post fake news about myself trying to blur the reality of my persona. I believe if more users did so, Facebook algorithms would become totally useless. I don’t give up my real name or date of birth when it is not needed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I don’t recommend two-factor identification as I don’t trust these companies to share my phone with them. I turn off my geolocation unless needed; same with Bluetooth. Never use public Wifi.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I share my security knowledge and news and regularly read on these subjects to keep up to date.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','IVPN Reports','','inherit','closed','closed','','1058-revision-v1','','','2020-10-23 01:23:53','2020-10-23 00:23:53','',1058,'https://datarainbow.eu/?p=1060',0,'revision','',0),(1061,5,'2020-10-23 01:24:13','2020-10-23 00:24:13','<!-- wp:core-embed/wordpress {\"url\":\"https:\\/\\/www.vpnreports.com\\/interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk\\/\",\"type\":\"wp-embed\",\"providerNameSlug\":\"vpn-reports\",\"className\":\"\"} -->\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-vpn-reports\"><div class=\"wp-block-embed__wrapper\">\nhttps://www.vpnreports.com/interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk/\n</div></figure>\n<!-- /wp:core-embed/wordpress -->\n\n<!-- wp:paragraph -->\n<p>Today we’re interviewing Tara Taubman-Bassirian, who specialized in Information and Internet law in the UK. She’s been following the data Protection Regulation since the reform of the Directive. And obviously, she has a lot of useful information to share. Here’s what Tara had to say…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Can you shortly introduce yourself?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I am a French lawyer, previously a corporate lawyer in France before I specialized in Information and Internet law in the UK. I was recently voted Privacy Hero by my pears.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been following the Data Protection Regulation since the reform of the Directive. My company&nbsp;<a href=\"https://datarainbow.eu/\" target=\"_blank\" rel=\"noreferrer noopener\">Data Rainbow</a>&nbsp;helps businesses and private users remain compliant with the regulation. I am also a public speaker and writer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What do you see as the main challenges for our privacy today?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>The challenges of privacy are the price we are paying with the development of digitalization and global access to data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What can we as individuals do about it?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Education and keeping aware of the greatness and dangers of the cyberworld are key. I like to say that data breach, cybersecurity or ransomware incidents are not anymore IF but WHEN. And when it happens, we need to be prepared. It starts with data minimization. It is our duty to secure data and protect ourselves when surfing online as much as it is for major companies to secure data storage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Can VPNs help? Do you use one?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I use ExpressVPN that several techy friends and colleagues have advised me. I am hoping it helps to protect my identity online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>What do you do to protect your personal information?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I start by minimization as I mentioned. Every now and then, I check what I have been collecting and delete the data once it is not necessary. I archive my files on external hard drives, with no internet access. I regularly update my applications and computers, and I use strong passwords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also, I don’t leave my paper files unattended when I leave; I use a password on my laptop which I don’t leave unattended when I’m not around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Do you have some other advice for our readers so they could, at least partially, regain their privacy?</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I use fake names on social media. I use Twitter and Facebook as these are part of my professional life. I intentionally post fake news about myself trying to blur the reality of my persona. I believe if more users did so, Facebook algorithms would become totally useless. I don’t give up my real name or date of birth when it is not needed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I don’t recommend two-factor identification as I don’t trust these companies to share my phone with them. I turn off my geolocation unless needed; same with Bluetooth. Never use public Wifi.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I share my security knowledge and news and regularly read on these subjects to keep up to date.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','VPN Reports','','inherit','closed','closed','','1058-revision-v1','','','2020-10-23 01:24:13','2020-10-23 00:24:13','',1058,'https://datarainbow.eu/?p=1061',0,'revision','',0),(1062,5,'2020-10-23 01:24:54','2020-10-23 00:24:54',' ','','','publish','closed','closed','','1062','','','2020-10-25 23:03:34','2020-10-25 23:03:34','',739,'http://datarainbow.eu/?p=1062',21,'nav_menu_item','',0),(1064,5,'2020-10-23 01:26:12','2020-10-23 00:26:12','<!-- wp:heading -->\n<h2>Online Platforms and Popular Technologies 2020</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>9:15 AM PDT</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3><a href=\"https://www.pli.edu/programs/online-platforms\">E.U. Developments in Platform Regulation</a></h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Hear Copyright Directive implementation status and e-Commerce directive developments</li><li>Privacy: get the latest GDPR developments</li><li>Discover Germany’s NetzDG and online speech regulation</li><li>Understand the implications of Brexit on platform regulation and legacy of EU rules</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>(IAPP Privacy credit for Privacy Professionals)</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><strong>Remy Chavannes, Daphne Keller, Graham Smith, Tara Taubman-Bassirian</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What You Will Learn</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Attendees will hear from leading legal and policy experts and thinkers including experienced in-house counsel. Those who attend will:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Learn about the geopolitical and industry rivalries and debates about platforms and popular technologies</li><li>Hear about the implications of Brexit for platform regulations</li><li>Understand how the pandemic has affected, and will profoundly affect, issues relating to privacy, surveillance, AI and algorithms, and other topics</li><li>Gain insight into the politicization of social media platforms and communication technologies</li><li>Find connections among seemingly disparate topics of hate speech, copyright, and “fake news” through the lens of “content moderation”</li><li>Benefit from perspectives of seasoned in-house counsel, advisors, and litigators</li></ul>\n<!-- /wp:list -->','PLI - Legal and Regulatory Responses to Technology Challenges','','inherit','closed','closed','','1049-revision-v1','','','2020-10-23 01:26:12','2020-10-23 00:26:12','',1049,'https://datarainbow.eu/?p=1064',0,'revision','',0),(1065,5,'2020-10-25 23:02:27','2020-10-25 23:02:27','<!-- wp:paragraph -->\n<p>In what is today the biggest fine under the GDPR, the French Data Protection Authority CNIL investigated Google Android transparency in Data processing. The investigation was consecutive to two class actions filed on the 25th of May 2018. One by the Austrian NGO Non Of Your Business (NOYB), another by the French La Quadrature du Net (LQDN). The complained have been partly answered as limited to the mobile Android Operating System. Still remain Youtube, Gmail and Google Search. This decision worth a close look up.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its complaint, NOYB stated in particular that users of Android mobile devices are required to accept Google\'s privacy policy and general terms and conditions of service and that, failing such acceptance, they could not use their terminal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The association LQDN complained that, regardless of the terminal used, Google does not have valid legal bases to implement the processing of personal data for purposes of behaviour analysis and advertising targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>First  of all, the CNIL has shown high celerity to deal with the complaints.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>On 1st June 2018, the CNIL submitted the complaints to its European counterparts via the European information exchange system with a view to the designation of a possible lead authority in accordance with the provisions of Article 56 of the GDPR.</li><li>20 September 2018 : Decision to investigate the Android\'s data procession is taken; </li><li>on 21 September, an online test was carried out  to verify the compliance of any processing relating to the use of the operating system Android for mobile equipment, including the creation of a Google account.</li><li>24 and 25th September, the report was notified to GOOGLE LLC companies.&nbsp;and Google France SARL</li><li>28 September 28,  the two companies also received the aforementioned complaints by courier of the CNIL</li><li>2nd Octobre, Mr. François PELLEGRINI was appointed as rapporteur according to the article 47 French Data Protection law of January 6, 1978</li><li>22nd October, the reporter notified Google LLC&nbsp;and Google France a report detailing shortcomings relating to sections 6, 12 and 13 of the GDPR. The report suggested&nbsp;a fine of 50 million euros to be made public.&nbsp;</li><li>7 November 2018, Google requested a hearing from the rapporteur, </li><li>13 November the request was rejected .</li><li> On the same date, the company also made a request for closed doors and postponement of the meeting, </li><li>15 November the request was rejected.</li><li>22nd November, Google filed a written comments on the report.&nbsp;</li><li>7th December, the rapporteur replied to these observations.</li><li>11th December, Google, which had fifteen days from receipt of the rapporteur\'s to reply, requested to postpone the meeting and extend the deadline to produce new observations.&nbsp; </li><li>13th December , the request was accepted to postpone for two weeks - until January 7 - the deadline for filing these observations and to postpone the meeting to January 15, 2019.</li><li>4th January, Google filed new observations in response to those of the rapporteur.</li><li>All observations were reiterated orally during the meeting of 15 January 2019.</li><li>21st January the decision was made public.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On the decision itself, Google argued the French CNIL should not be the competent Data Protection Authority.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on Article 55 (1) of the GDPR states: Each supervisory authority shall be competent to exercise the tasks and powers vested in it in accordance with this Regulation in the territory of the Member State to which it belongs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 56 (1) of the GDPR provides: Without prejudice to Article 55, the supervisory authority of the principal place of business or of the sole place of business of the controller or processor shall have jurisdiction to act as lead supervisory authority for cross-border processing by that controller or processor, in accordance with the procedure laid down in Article 60.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued that the CNIL could not be competent to conduct this procedure and that it should have transmitted the complaints received to the Irish Data Protection Commission (DPC) the lead authority to deal with these cross-border complaints in accordance with Art 60 GDPR.&nbsp;Google Ireland Limited being its main establishment in the EU for some of the its cross-border processing, including those objects of the complaints.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, initial discussions turned around the competent authority as defined by the main establishment of the company. Google arguing Ireland to be its main establishment, the CNIL responding the main Administrative establishment is not the criteria. Based on Article 4 (16) of the RGPD&nbsp;and Recital 36 GDPR, the main establishment to consider should be based on objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing trough stable arrangements. The CNIL added that the determination should be analysed in concreto, according to objective criteria. The main establishment could therefore not necessarily correspond to the main designated administrative establishment.  The CNIL based its position on the WP article 29 guidance WP244 of 5th April 2017 \"<em>the central administration is the place where the decisions are made on the purposes and means of processing.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciding otherwise would result on forum shopping, says the CNIL. Google Ireland had no decisional power. Google Ireland Limited is not mentioned in the Company\'s Privacy Policy dated May 25, 2018 as the entity where the main decisions about the purposes and means of the processing are made. covered by the privacy policy presented to the user when creating his account, during the configuration of his mobile phone on Android. In fact Google had not either named any DPO in Ireland who would be in charge of the processing of personal data that it could implement in the European Union.&nbsp;It further notes that the Android operating system is developed solely by Google LLC.. Additionally, the company itself had indicated, by mail dated December 3, 2018 addressed to the DPC, that the transfer of responsibility of Google LLC.&nbsp;to Google Ireland Limited on certain processing of personal data concerning European citizens would be finalized on 31 January 2019. It later specified to update its confidentiality rules which will come into effect on 22 January 2019. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google\'s argument that a reorganisation both operational and organizational was underway to make the company Google Ireland Limited the controller for certain processing of personal data concerning European nationals, was in my view a mistake only proving that at the time of the compliant Google Ireland had no decisional power.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also considers that the definition of principal place of business should be distinguished from that of controller. Arguing that if the European legislator had intended that the concept of principal place of business should be interpreted as the place where decisions concerning \'would have expressly indicated simply ignored the text of the Recital 36.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a principal establishment allowing the identification of a lead authority, the one stop shop did not apply, and the CNIL was competent to initiate this procedure and to exercise all of its powers under Article 58 of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very interesting analysis to determine the main establishment and the lead authority based on objective criteria and not a subjective decision favouring forum shopping. The decision dismisses the application of the GDPR’s one-stop-shop by holding that Google Ireland Limited is not Google’s main establishment in the EU. A rather strict interpretation of the concept of “main establishment”. With no main establishment in the EU, Google LLC could potentially be subject to enforcement by any supervisory authority in the EU where Google has an establishment, including France.&nbsp; </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Once the CNIL confirmed its competence, it goes into a detailed analysis of the transparency requirement and legitimate basis of processing. here after, a free translation is offered:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- On the Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued on the validity of the complaints. &nbsp;The CNIL responded that the question of the admissibility of the complaints could not affect the legality of the proceedings, as it could self-refer itself based on the findings made by its services.&nbsp;The CNIL had therefore a mission to supervise the application of the regulation and to ensure compliance with it and that it has, for this purpose, the power to carry out investigations, in accordance with Arti 57 1. a) and h) of the RGPD. In fact, the two associations had been mandated to represent the complaints under article 80 of the RGPD.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The second argument claiming that the proceedings breached its right to a fair trial according to Art 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms that the rapport to his observations were addressed in French, sounded rather difficult to succeed. The CNIL responded to that any notification of a penalty report had to be in French based on a legal obligation laid down in Article 111-1 of the Code of relations between the public and the administration which provides that use of the French language is prescribed in the exchanges between the public and the administration, in accordance with the provisions of the law n ° 94-665 of August 4, 1994 relating to the use of the French language. Google has an establishment on the French territory with several hundred employees. Google had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations within the deadline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of these elements, the Restricted Training considers that the company had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations in the the deadline fixed for it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This point explains why it is important that the Organisations\' representative speak the language of the DPA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the refusal to extend the time limit he was opposed to produce his first observations and limited the time available to prepare his defence.&nbsp;It also considers that the adjournment of the meeting as well as the additional time it was finally granted to produce its second observations were still not sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>3.Over the scope of investigations</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued first of all that the rapporteur has confused the Android operating system and the Google account when they are separate services that implement different treatment activities. Then argued that the scope of control chosen by the CNIL - namely the creation of a Google account when setting up a new device using the Android operating system - is limited in that it only represents a case figure affecting 7% of users. Finally, it indicated that the findings were made on an older version of the Android operating system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL did not disputed the existence of separate services, respectively related to the Android operating system and the Google Account, implementing different processing activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It observed, however, that the facts covered by the investigations corresponded to the scenario chosen to carry out the on-line check, namely the journey of a user and the documents to which he could have accessed during the initial configuration of his mobile equipment using the Android operating system.&nbsp;This path included the creation of an account.&nbsp;These facts therefore related to the treatments covered by the privacy policy presented to the user when creating an account during the setting up of their mobile phone on Android.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Then, adding that if it was true that the user actually had the choice to create an account and has the opportunity to use some of the services without having to create an account, however, when setting up an Android device, the ability to create a Google account or connect to an existing account naturally appeared at the beginning of the setting process, without specific action of the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, under Article 11.I.2 of the Data Protection Act, the CNIL has a broad discretion as to the scope of the controls it may undertake.&nbsp;A specific control scenario, such as that used in this case, may make it possible to make findings reflecting a more comprehensive privacy policy. The scope of the processing of personal data that is performed&nbsp;is therefore is irrelevant so is the version of the Android operating system since it appears from the documents provided by Google that the user\'s journey is similar in the newer version .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>4.On breach of transparency and information obligations</strong><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google infringed the GDPR for three main reasons: (1)&nbsp;<strong>lack of transparency&nbsp;</strong>(art. 5 GDPR); (2)&nbsp;<strong>insufficient information&nbsp;</strong>(art. 12 and 13 GDPR); and (3)&nbsp;<strong>invalid consent collection or lawfulness basis&nbsp;</strong>(art. 7 GDPR). The CNIL found the information Google provides when creating an account is not clearly accessible and therefore consent is not \'informed\' and explicitly obtained. Criticising pre-ticked boxes explicitly prohibited by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <strong>obligations of transparency</strong> resulted on Article 12 (1) GDPR that provides: \"<em>1.The controller shall take appropriate measures to provide any information referred to in&nbsp;</em><a href=\"http://www.privacy-regulation.eu/en/article-13-information-to-be-provided-where-personal-data-are-collected-from-the-data-subject-GDPR.htm\"><em>Articles 13</em></a><em>&nbsp;and 14 and any communication under&nbsp;</em><a href=\"http://www.privacy-regulation.eu/en/article-15-right-of-access-by-the-data-subject-GDPR.htm\"><em>Articles 15</em></a><em>&nbsp;to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 13 (1) provides that:  <em>\"1.&nbsp;Where personal data relating to a data subject are collected from the data subject, the&nbsp;controller&nbsp;shall, at the time when personal data are obtained, provide the data subject with all of the following information:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a)&nbsp;&nbsp;&nbsp; the identity and the contact details of the&nbsp;controller&nbsp;and, where applicable, of the&nbsp;controller\'s&nbsp;representative;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(b)&nbsp;&nbsp;&nbsp; the contact details of the data protection officer, where applicable;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(c)&nbsp;&nbsp;&nbsp; the purposes of the&nbsp;processing&nbsp;for which the personal data are intended as well as the legal basis for the&nbsp;processing;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(d)&nbsp;&nbsp;&nbsp; where the&nbsp;processing&nbsp;is based on point (f) of Article 6(1), the legitimate interests pursued by the&nbsp;controller&nbsp;or by a&nbsp;third party;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(e)&nbsp;&nbsp;&nbsp; the&nbsp;recipients or categories of&nbsp;recipients of the personal data, if any;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(f)&nbsp;&nbsp;&nbsp; where applicable, the fact that the&nbsp;controller&nbsp;intends to transfer personal data to a third country or&nbsp;international organisation&nbsp;and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article&nbsp;46 or 47, or the second subparagraph of Article&nbsp;49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google firstly considered that the Confidentiality rules and conditions of use, accessible when creating an account, constitutes first-level information in accordance with the EDPS Guidelines on Transparency within the meaning of the EU Regulation 2016 / 679 (WP260) of 25 May 2018. It states that the document provides a good overview of the treatments implemented and that the mention of the legal basis of these treatments does not have to be included in this first level information.&nbsp;Information about how long the data is kept is in the section Exporting and Deleting the Information in the Privacy Policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google goes on to argue that the information of individuals must, in the light of sections 12 and 13 of the Regulations, be assessed on a global basis.&nbsp;In this regard, it states that the information it issues is also used, in addition to the documents entitled Confidentiality Rules and Conditions of Use, Privacy Policy and Terms of Use, through several other terms and conditions.&nbsp;Additional information messages may appear when creating an account under each of the privacy settings.&nbsp;In addition, an e-mail is sent to the user when an account is created, stating that: it can change the privacy and security settings of the Google account at any time,&nbsp;create reminders to check the privacy or security settings.&nbsp;This e-mail  contains clickable links to various setting tools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These other control tools, which are made available to the user after the creation of his account from the management interface of his account include for example a tool called check-up confidentiality that allows users to choose privacy settings that suit them, including custom ads, location history, web-based activity, and apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google also puts forward a Dashboard tool that allows users to have an overview of the use they make of the services offered by Google such as Gmail or Youtube.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, Google reminds that when a user clicks Create Account without having disabled custom ad settings, an account creation confirmation pop-up appears to remind that the account is set to include customisation features.&nbsp;The company indicates that the user journey is thus configured to slow down the progression of users who would not have spontaneously made the choice of more privacy-friendly settings.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL takes note of the progress made in recent years by the company in its policy of informing users, in the sense of greater transparency and greater control over their data expected by them.&nbsp;For the reasons that follow, however, it considers that the requirements of the GDPR, the implementation of which must be assessed in the light of the concrete scope of the processing of personal data in question, are not respected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Firstly, the CNIL recalls that pursuant to the provisions of Art 12 of the Regulation, information must be provided in an <strong>easily accessible way</strong>.&nbsp;This accessibility requirement is informed by the <strong>transparency guidelines</strong>, in which the EDPS considered that a key aspect of the transparency principle highlighted in these provisions is that the data subject should be able to advance what the scope and consequences of the processing encompass so as not to be caught off guard at a later stage as to how its personal data were used.&nbsp;[...] In particular, with regard to complex, technical or non-planned data processing,&nbsp;G29\'s position is that [...] controllers should <strong>separately and clearly define the main consequences of treatment</strong>: in other words, what will actually be the effect of the specific treatment described in a statement or opinion on the protection of the privacy for the data subject.&nbsp;The CNIL also recalls that the <strong>accessibility requirement </strong>of Article 12 is based in part on the ergonomic choices made by the controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this case, the CNIL found that the general architecture of the information chosen by the Corporation does not meet the requirements of the Regulations.&nbsp;The information that must be disclosed to individuals pursuant to section 13 is <strong>excessively scattered in several documents</strong>: Privacy Policy and Terms of Use, displayed during the creation of the account, then Terms of Use and Rules of confidentiality which are accessible in a second time by means of clickable links appearing on the first document.&nbsp;These different documents include buttons and links that must be activated to learn additional information.&nbsp;Such an ergonomic choice leads to a fragmentation of information thus forcing the user to multiply the clicks necessary to access the different documents.&nbsp;The user must then carefully consult a large amount of information before he or she can identify the relevant paragraph (s).&nbsp;However, the work provided by the user does not stop there since it will still have to cross-check and compare the collected information in order to understand which data are collected according to the various settings that he may have chosen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL noted that, given this architecture, some information is difficult to find. For example, with regard to targeted advertising, to know the information that is collected, a user must perform many actions and combine several documentary resources.&nbsp;As a first step, you should read the General Privacy Policy and Terms of Service, then click the More Options button and then the Read more link to display the Customise Ads page.&nbsp;He will thus have access to a first description of the treatment relating to the personalisation of the advertisement which proves to be incomplete.&nbsp;To complete the information relating to the data processed for this purpose,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Similarly, in terms of <strong>geolocation data processing</strong>, the CNIL noted that the same course devoid of any intuitive character is required from the user with regard to information relating to geolocation data.&nbsp;The user will have to complete the following steps: Review the Privacy Policy and Terms of Service, click More Options, and then click the Learn more link to view the Location History page and view the displayed text. However, as this text is only a short description of the processing, the user will need to go to the Privacy Policy document and access the Information about your location to access the rest of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the two cases described, <strong>five actions are necessary for the user to access the information</strong> relating to the targeted advertisements and s<strong>ix for the geolocation</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL stated that if the user wished to have <strong>information on the retention periods</strong> of his personal data, he must first consult the Privacy Policy found in the main document and then go to the section titled Export and delete the information and finally click on the hyperlink click here contained in a general paragraph on storage times.&nbsp;It is therefore only after four clicks that the user accesses this information.&nbsp;The Restricted Training further notes that the title chosen by the company for Exporting and Deleting Your Information does not easily allow the user to understand that this is a topic to access information about retention periods .&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As a result of all these factors, there is an <strong>overall lack of accessibility</strong> of the information provided by the company in the context of the processing in question.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, the CNIL considered that the<strong> clear and comprehensible nature of the information provided</strong>, as required by Article 12 of the GDPR, <strong>must be assessed taking into account the nature of each treatment</strong> in question and its <strong>concrete impact on the persons concerned</strong>. concerned.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Beforehand, the CNIL considered it was essential to emphasise that the <strong>data processing</strong> implemented by the controller was <strong>particularly massive and intrusive</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data Google collects <strong>comes from a wide variety of sources</strong>.&nbsp;This data is collected both from the use of the phone, the use of the company services, such as the Gmail email service or the Youtube video platform, but also from the data generated by the user activity when they visit third-party sites that use <strong>Google services, including Google Analytics cookies placed on these sites.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As such, the Privacy Policy reveals that <strong>at least twenty services</strong> offered by the company are likely to be involved in the processing, which may concern data such as web browsing history, history from applications, data stored locally on the equipment (such as address books), geolocation of equipment, etc.&nbsp;Therefore, <strong>a lot of data is processed as part of these services via or in connection with the Android operating system</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The record shows that, in addition to data from external sources, the company treats <strong>at least three categories of data</strong>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>data produced by the user</strong> (for example, their name, password, phone number, email address, payment method, content created, imported or received, such as writings, photos or videos );  </li><li><strong>data generated by its activities</strong> (for example, IP address, unique user credentials, mobile network data, data related to wireless networks and Bluetooth devices, timestamp of actions performed, data geolocation, the technical data of the devices used including data relating to the sensors (accelerometer, etc.), the videos viewed, the searches made, the browsing history, the purchases, the applications used, etc .;</li><li><strong>Derived or inferred data from data provided by the user or his activities</strong>.&nbsp;In this category, the Privacy Policy lists a number of purposes that can only be accomplished by generating data from the other two categories of data.&nbsp;Thus, the customisation of the ads that the company realises requires to infer the interests of users from their activity in order to offer them to advertisers.&nbsp;In the same way, the purposes of providing content, research and personalised recommendations require inferring new information from those declared, produced or generated by the activity of the user.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Moreover, if the very large number of processed data can characterise alone the massive and intrusive nature of the treatments performed, the very nature of some of the data described, such as geolocation data or content consulted, reinforces this finding.&nbsp;Considered in isolation, the <strong>collection of each of these data is likely to reveal with a high degree of precision many of the most intimate aspects of people\'s lives, including their lifestyle, their tastes, their contacts, their opinions or their trips</strong>.&nbsp;The result of the combination of these data greatly reinforces the <strong>massive and intrusive nature of the processing</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consequently, it is in the light of the particular characteristics of these processing of personal data which have just been recalled that the characters are clear and understandable, within the meaning of Art 12 of the GDPR, of the information provided for in Art 13 of the Regulations, must be appreciated.&nbsp;The CNIL considered that these requirements were not respected in this case.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Specifically, the CNIL noted that the information provided by Google did not allow the users to understand sufficiently the particular consequences of the processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the purposes announced in the various documents are described as follows: offer personalised services in terms of content and advertisements, ensure the safety of products and services, provide and develop services, etc.&nbsp;.&nbsp;They are too generic in terms of the scope of the treatments implemented and their consequences.&nbsp;This is also the case when users are told too loosely: <em>The information we collect is used to improve the services offered to all our users.&nbsp;[...] The information we collect and how we use it depends on how you use our services and how you manage your privacy settings.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL noted that the description of the aims pursued did not allow users to measure the extent of the treatments and the degree of intrusion into their private lives that they are likely to take away.&nbsp;It considered, in particular, that such information is not provided in a clear manner, nor at the first level of information provided to users through, in this case, the document entitled Confidentiality rules and conditions of use nor in the other levels of information proposed by the company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL further noted that the description of the data collected, which could be of such a nature as to clarify the scope of these purposes and to prevent the user from being subsequently caught off guard as to the way in which his data were used and combined, is particularly imprecise and incomplete, both in the analysis of the first level of information and that of the other documents provided.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example, the Privacy Policy and Terms of Use document and the Privacy Policy document specify: <em>This may be more complex (...) information, such as the ads you find most useful, the people you care about. interest most on the web or YouTube videos that are likely to interest you.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of the foregoing, the CNIL believed that the user is not able, especially by being aware of the first level of information presented to him in the Privacy Policy and Terms of Use, to measure the scope of the main treatments on his private life.&nbsp;While it noted that exhaustive information, from the first level, would be counterproductive and does not respect the requirement of transparency, it considers that it should contain terms that would objectify the number and scope of implemented.&nbsp;It further considered that it would be possible, by other types of presentation methods adapted to data combining services,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The finding of lack of clarity and comprehensibility must also be made with regard to the mention of the legal basis of targeted advertising .&nbsp;In fact, the company first states in the Privacy Policy: <em>We ask you for permission to process your information for specific purposes, and you are free to revoke your consent at any time.&nbsp;For example, we ask you for permission to provide personalised services, such as ads.&nbsp;The legal basis chosen here therefore appears to be consent.&nbsp;</em>However, the company further adds it relies on the legitimate interest,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL stressed that if Google had indicated before that the only legal basis for the processing of the targeted advertisement was consent, the investigation shows that this clarification is not brought to the attention of the users.&nbsp;The formulations recalled above did not allow the latter to clearly measure the distinction between properly targeted advertising, based on the combination of multiple user data, which is based on the company\'s consent statement , other forms of targeting using for example the context of navigation, based on the legitimate interest.&nbsp;The CNIL stressed the particular importance of the need for clarity in these processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With respect to information on the retention period, the CNIL noted that the How are Google\'s collected information page is maintained has four categories: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information retained until the user deleted it;</li><li>Information with a timeout;</li><li>Information retained until user\'s Google Account is deleted;</li><li>Information kept for long periods of time for specific reasons.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>It noted, however, that as regards to the latter category, only very general explanations of the purpose of this retention are provided and no precise duration or the criteria used to determine that duration are indicated.&nbsp;This information is among those that must be issued to users pursuant to Article 13 (2) (a) of the Regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, if the company claims that multiple information tools are made available to users concomitantly and after the creation of their account, the restricted training notes that these methods do not make it possible to reach the requirements of transparency and transparency. information from articles 12 and 13 of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, the CNIL noted that the tools to which the company refers do contribute, to a certain extent, to the goal of transparency throughout the life of the account and the use of Google\'s services.&nbsp;However, it considered that they do not participate sufficiently in the information provided for in Article 13, which must be provided at the time data are obtained.&nbsp;As mentioned in the EDPS Transparency Guidelines, Article 13 specifies the information to be provided to data subjects from the start of the processing cycle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If any data other than those strictly necessary to create the account, are collected throughout the life of the account, such as browsing history or purchases, the time of its creation marks the entry of the user in the ecosystem of Google services, whose particularly massive and intrusive nature of processing has been recalled previously.&nbsp;This step marks the beginning of a multitude of treatment operations: collection, combination, analysis, etc.&nbsp;Therefore, since the process of creating the account is essential in the understanding of treatments and their impact and where the proposed user journey itself invites the person concerned to focus his attention at this stage, the information provided for in Rule 13 of the Rules of Procedure at that time must.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, both the pop-up window appearing at the time of the creation of the account and the electronic message sent as soon as the account is created contain only a summary or very specific information on the processing implemented and can not allow to consier the prior information as sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the text of the pop-up window indicates <em>This Google Account is configured to include customisation features (such as recommendations and custom ads) that are based on the information stored in your account.&nbsp;The e-mail indicates the main features of the Google Account and the existence of control tools.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With regard to the confidentiality check-up tool, this essentially allows the user to set up the collected information such as browsing history or visited places.&nbsp;Finally, the Dashboard consists of an information panel for each Google service overview of the use of the account holder.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nevertheless, these confidentiality check-up and Dashboard tools can only be used, just like the e-mail mentioned above, after the account creation step, which is nevertheless essential for informing users as well as it has been said.&nbsp;In addition, although their existence and interest are brought to the attention of users, they imply an active and initiative of these.&nbsp;For these reasons, these tools do not allow to consider that sufficient information is provided for the application of Article 13 of the Regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the light of all these elements, the CNIL committee considers that a breach of the transparency and information obligations as provided for in Articles 12 and 13 of the Regulation is characterised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>5. Failure to provide a legal basis for the processing implemented</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6 of the RGPD states that: 1.&nbsp;&nbsp;&nbsp;Processing&nbsp;shall be lawful only if and to the extent that at least one of the following applies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(a)&nbsp;&nbsp;&nbsp; the data subject has given consent to the&nbsp;processing&nbsp;of his or her personal data for one or more specific purposes;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(b)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(c)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for compliance with a legal obligation to which the&nbsp;controller&nbsp;is subject;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(d)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary in order to protect the vital interests of the data subject or of another natural person;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(e)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the&nbsp;controller;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(f)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for the purposes of the legitimate interests pursued by the&nbsp;controller&nbsp;or by a&nbsp;third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>the processing is necessary to safeguard the vital interests of the data subject or of another natural person;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google was criticised for failing to validly collect the consent of individuals for targeted advertising.&nbsp;It was also considered that the company could not claim a legitimate interest for these processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In defence, Google specified that it relied solely on the consent for the targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 4 (11) of the above-mentioned Regulations specifies what consent means: <em>any freely given, specific, informed and unambiguous indication of the data subject\'s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 7 of the same Regulation provides the conditions that apply to it:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>1.&nbsp;&nbsp;&nbsp;Where&nbsp;processing&nbsp;is based on consent, the&nbsp;controller&nbsp;shall be able to demonstrate that the data subject has consented to&nbsp;processing&nbsp;of his or her personal data.</em></li><li><em>2.&nbsp;&nbsp;&nbsp;If the data subject\'s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.</em></li><li><em>3.&nbsp;&nbsp;&nbsp;The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of&nbsp;processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.</em></li><li><em>4.&nbsp;&nbsp;&nbsp;When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia , the performance of a contract, including the provision of a service, is conditional on consent to the&nbsp;processing&nbsp;of personal data that is not necessary for the performance of that contract.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Firstly, Google said that the users\' consent is informed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It believes that simple and clear information is presented to the user when creating an account and allow him to know how the company uses the data for customisation purposes.&nbsp;In particular, the Company refers to the summary entitled Privacy Policy and Terms of Use, the sections dedicated to the targeted advertisements contained in the Privacy Policy and the additional information message entitled Targeted Advertising in the Menu Options account creation setting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, Google claimed that the user\'s consent is specific and unambiguous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In particular, it stated that when setting up the account, the user has the option of making a choice regarding the display of targeted advertising .&nbsp;It considers that this possibility enables to express its consent to the use of its data independently of the other choices it may express with regard to the other purposes relating to the processing associated with the Google Account (eg YouTube search history).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also considered that the procedures for obtaining consent for the purposes of targeted advertisements it sets up are in line with the recommendations of the CNIL of December 5, 2013 regarding cookies.&nbsp;In particular, it specifies that short information is available on the targeted ads followed by an \"I accept\" button (the Privacy Policy and the Terms of Use), preceded by a \"more options\" button that gives users the ability to disable multiple processing operations, including for targeted ad purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also argued that the solution presented in the public notice of the president of the CNIL No. MED-2018-023 of November 29, 2018 allows the user to consent to all ends via a button accept all.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lastly, it considered that explicit consent for the processing of data for the purposes of targeted advertising, within the meaning of Art 9 (2) (a) of the GDPR, could not be required in the absence of sensitive data.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Regarding the informed consent&nbsp;and&nbsp;the&nbsp;spread&nbsp;of&nbsp;information</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the first place, the CNIL specified that this informed character must be examined in the light of the preceding developments concerning the lack of transparency and information of the users during the setting up of their account.&nbsp;It considered that the deficiencies previously identified necessarily have an impact on the information delivered to the users to ensure the informed nature of the consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL indicated that the EDPS Guideline of 10 April 2018 on Consent within the meaning of Regulation 2016/679 (WP250) states that the controller must ensure that consent is provided on the basis of information that enables the people concerned to easily identify who is responsible for the data and to understand what they are agreeing to.&nbsp;[It] must clearly describe the purpose of the data processing for which consent is sought.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These guidelines also state that: In order for consent to be informed, it is necessary to inform the person concerned of certain crucial elements in making a choice.&nbsp;[..] At least the following information is required in order to obtain valid consent: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the identity of the controller,</em></li><li><em>the purpose of each processing operation for which consent is sought,</em></li><li><em>the (types of) data collected and used,</em></li><li><em>the existence of the right to withdraw consent,</em></li><li><em>information on the use of data for automated decision-making [..] and</em></li><li><em>information on the possible risks associated with the transmission of data due to the lack of a decision on adequacy and appropriate safeguards [...].</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>As it was able to identify under the breach of the transparency and information requirements, the CNIL considered that the information on targeted advertising is excessively disseminated in separate documents and is not, as such, easily accessible.&nbsp;In this respect, the CNIL refered to the preceding developments on the multiple actions that must be performed by a user who wishes to be made aware of available on the processing related to the targeted advertisement.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In addition, the CNIL also noted under the breach of transparency obligations, the information provided was not sufficiently clear and understandable in that it was difficult for a user to have a global understanding of the can do the object and their scope.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As an illustration, the information in the targeted Ad section, accessible from the Privacy Policy and Terms and Conditions document through the More Options button, contains the following: Google can show you ads based on your activity in Google services (for example, in the search or on YouTube, as well as on Google\'s websites and partner applications).&nbsp;The CNIL noted that it is not possible to read, for example through clickable links, the services, sites and Google application to which the company refers.&nbsp;Therefore, the user was not able to understand the targeted advertising they are subject to, as well as their scope,&nbsp;even though these treatments nevertheless imply a plurality of services (for example: Google search, YouTube, Google home, Google maps, Playstore, Google photo, Google play, Google analytics, Google translation, Play books) and the processing of a large amount of data personal character.&nbsp;Users are not able to have a proper perception of the nature and volume of data that is collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of these elements, the CNIL committee considered that the users\' consent for targeted advertising was not sufficiently informed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>With regard to the specific and unequivocal nature of the consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 32 of the Regulation provides that: <em>Consent must be given by a clear positive act by which the data subject expresses in a free, specific, informed and unambiguous manner his agreement to the processing of his personal data [...].&nbsp;There can therefore be no consent in the event of silence, boxes checked by default or inactivity.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 of the GDPR states that: <em>Consent is presumed not to have been freely given if separate consent can not be given to different personal data processing operations, although this is appropriate in the present case.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The above EDPS guidance on consent states that: <em>In order to comply with the specific nature of consent, the controller must ensure: [...] (ii) the detailed nature of consent requests [...] This means that data controller who seeks consent for various specific purposes should provide separate consent for each purpose so that users can give specific consent for specific purposes.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this case, the CNIL noted that when the user creates an account, he has the possibility to modify some of the parameters associated with the account.&nbsp;To access these settings, the user must click the more options button, present before the Create Account button.&nbsp;the CNIL also noted that the personalisation settings of the account, which contain the choice for the display of personalised ads, are pre-checked by default, which means, unless otherwise indicated, the agreement of the user to processing of its data for the purposes mentioned (eg YouTube search history, display of personalised ads etc.).&nbsp;The user has the option to uncheck these parameters if he does not want these treatments to be implemented.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL observed that, at the time of the creation of the account, if the user does not click on the button more options to set his account, he must check the boxes <em>I accept the terms of use of Google and I agree that my information will be used as described above and detailed in the Privacy Policy</em>.&nbsp;Subsequently, he must press the <em>Create Account</em> button.&nbsp;A pop-up window appears, titled Simple confirmation that contains the following text This Google Account is set up to include customisation features (such as recommendations and custom ads), which are based on information stored in your account.&nbsp;To change your personalisation settings and the information stored in your account,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If it does not click <em>More Options</em>, the user must select the <em>Confirm</em> button to complete the account creation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of the foregoing, the CNIL noted that if the user has the possibility to modify the configuration of the parameters of his account prior to its creation, a positive action on his part is necessary to access the possibilities of setting up the account.&nbsp;Thus, the user can completely create his account, and accept the related processing, including targeted advertising, without clicking <em>More options</em>.&nbsp;Therefore, the user\'s consent is not, in this case, validly collected to the extent that it is not given through a positive act by which the person consents specifically and distinctly to the processing of its data for purposes of targeted advertising compared to other purposes of treatment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL also considered that the actions by which the user proceeds to the creation of his account - by ticking the boxes I accept the conditions of use of Google and I accept that my information is used as described below above and detailed in the privacy rules, and then selecting Create Account - can not be considered as the expression of a valid consent.&nbsp;The specific nature of the consent is not respected because the user, by these actions, accepts all the processing of personal data implemented by the company, including those of targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In addition, the CNIL noted that multiple technology processes are used by the company to combine and analyse data from different external services, applications or sources.&nbsp;They undeniably have a multiplying effect on the precise knowledge society has of its users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As a result, the restricted formation believes that the company has operations of combinations with almost unlimited potential allowing a massive and intrusive treatment of the data of the users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Given the scope of the data processing - in particular that of targeted advertising - and the number of people concerned, the CNIL underlined that the deficiencies previously retained are of a particular gravity.&nbsp;A lack of transparency regarding these wide-scope processing, as well as a lack of valid user consent to targeted advertising, constitute substantial infringements of the protection of their privacy and are contrary to legitimate aspirations of people who want to keep control of their data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this respect, strengthening the rights of individuals is one of the main thrusts of the Regulation.&nbsp;The European legislator recalls that The rapid evolution of technologies and globalization have created new challenges for the protection of personal data.&nbsp;The extent of collection and sharing of personal data has increased significantly.&nbsp;Technologies allow both private and public authorities to use personal data as never before in their business (...) Technologies have transformed both the economy and social relations (recital 6) .&nbsp;It stresses that these developments require a strong data protection framework (...) with rigorous enforcement of the rules, it is important to create the confidence that will enable the digital economy to develop in the internal market as a whole.&nbsp;Individuals should have control over their personal data.&nbsp;(recital 7).&nbsp;The European legislator regrets, finally, that Directive 95/46 / EC has not made it possible to avoid the widespread public perception that significant risks to the protection of individuals still exist, in particular as regards the online environment.&nbsp;(recital 9).&nbsp;whereas Directive 95/46 / EC has not prevented the widespread public perception that significant risks to the protection of individuals still exist, in particular with regard to the online environment.&nbsp;(recital 9).&nbsp;whereas Directive 95/46 / EC has not prevented the widespread public perception that significant risks to the protection of individuals still exist, in particular with regard to the online environment.&nbsp;(recital 9).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL thus considered, in view of the scale of the processing carried out and the compelling need for the users to keep control of their data, that they must be put in a position to be sufficiently informed of the scope of the data implemented and to validly consent to it, unless to deprive of basic confidence in the digital ecosystem.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, the CNIL emphasised that shortcomings need to be put into perspective with regard to the company\'s business model, in particular the place of the users\' data processing for advertising purposes via the Android operating system.&nbsp;In view of the benefits it takes from these processing, Google must pay particular attention to its responsibility under the GDPR in their implementation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It follows from all the foregoing and the criteria which have been duly taken into account by the Committee, in view of the maximum amount incurred on the basis of 4% of the turnover indicated in point 2 of this Decision, that a financial penalty is justified up to 50 million euros, as well as a supplementary publicising sanction for the same reasons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Account is also taken of the company\'s prominent place in the market for operating systems, the seriousness of the deficiencies and the interest this decision represents in informing the public in determining the duration of its publication.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>FOR THESE REASONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The restricted formation of the CNIL, after having deliberated, decides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>to award Google LLC a monetary penalty in the amount of 50 (fifty) million euros;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>to send this decision to Google France Sarl for the execution of this decision;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google has already publicly announced it has appealed the case. It\'s of course important as this decision creates a precedent and establish the rules.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is only  start.<a href=\"https://www.laquadrature.net/en/2019/01/21/first-sanction-against-google-following-our-collective-complaints/\"> La Quadrature du Net publishe</a>d : \"<em>Today, the CNIL&nbsp;</em><a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\"><em>sanctioned</em></a><em>&nbsp;</em><strong><em>Google to a 50 million Euros fine</em></strong><em>, stating that the targeted advertising it engages in with its operating system Android is in breach of the GDPR, the new European regulation that came into effect on May 25. However, this sanction is really only the beginning of an answer to our complaint against Google, which denounced especially the targeted advertising imposed on Youtube, Gmail and Google Search in violation of our consent.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In this respect, the CNIL explains the low amount of its sanction, considering Google’s nearly&nbsp;</em><a href=\"https://www.statista.com/statistics/266206/googles-annual-global-revenue/\"><em>110 billion US dollars</em></a><em>&nbsp;revenue, by the fact it limited the scope of its examination to “the data processing covered by the privacy policy presented to a user when creating their account on their Android mobile phone” (our translation).&nbsp;</em><sup><em>1</em></sup><em>&nbsp;We therefore expect the CNIL to quickly answer the rest of our complaint, which concerns Youtube, Gmail and Google Search, by issuing a fine commensurate with this company and the extent and the duration of the violation of ours rights (the maximum amount possible is 4 billion euros – 4% of global revenue –, which we hope for).</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This publication is licensed under a Creative Commons Attribution 4.0 International<br>More information on the licence can be found <a href=\"http://creativecommons.org/licenses/by/4.0/\">here</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Google Subject to the Biggest Fine Under GDPR','In what is today the biggest fine under the GDPR, the French Data Protection Authority CNIL investigated Google Android transparency in Data procession. The investigation was consecutive to two class actions filed on the 25th of May 2018. One by the Austrian NGO Non Of Your Business (NOYB), another by the French La Quadrature du Net (LQDN). This decision worth a close look.','inherit','closed','closed','','204-revision-v1','','','2020-10-25 23:02:27','2020-10-25 23:02:27','',204,'https://datarainbow.eu/?p=1065',0,'revision','',0),(1067,5,'2020-11-06 20:43:35','2020-11-06 20:43:35','<!-- wp:paragraph -->\n<p>Legal and Regulatory Responses to Technology Challenges</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Octobre 2020, I participated to this online event organised by the Practicing Law Institute PLI.  I participated, along with EU and US experts, on the first panel on E.U. Developments in Platform Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pli.edu/programs/online-platforms\">The material remains available on demand until Octobre 2021.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I focused on Chapitre V, Lawful data transfer and the Schrems-II European Court of Justice decision in July 2020. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During the day, various speakers develop other aspects of online platforms:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Learn about the geopolitical and industry rivalries and debates about platforms and popular technologies</li><li>Hear about the implications of Brexit for platform regulations</li><li>Understand how the pandemic has affected, and will profoundly affect, issues relating to privacy, surveillance, AI and algorithms, and other topics</li><li>Gain insight into the politicization of social media platforms and communication technologies</li><li>Find connections among seemingly disparate topics of hate speech, copyright, and “fake news” through the lens of “content moderation”</li><li>Benefit from perspectives of seasoned in-house counsel, advisors, and litigators</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":1068} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/11/Screenshot-2020-10-21-at-18.29.03-1024x489.png\" alt=\"\" class=\"wp-image-1068\" /></figure>\n<!-- /wp:image -->','Online Platforms and Popular Technologies 2020','','publish','closed','closed','','online-platforms-and-popular-technologies-2020','','','2020-11-06 20:44:23','2020-11-06 20:44:23','',0,'http://datarainbow.eu/?p=1067',0,'post','',0),(1068,5,'2020-11-06 20:43:26','2020-11-06 20:43:26','','Screenshot 2020-10-21 at 18.29.03','','inherit','closed','closed','','screenshot-2020-10-21-at-18-29-03','','','2020-11-06 20:43:26','2020-11-06 20:43:26','',1067,'/wp-content/uploads/sites/3/2020/11/Screenshot-2020-10-21-at-18.29.03.png',0,'attachment','image/png',0),(1069,5,'2020-11-06 20:43:35','2020-11-06 20:43:35','<!-- wp:paragraph -->\n<p>Legal and Regulatory Responses to Technology Challenges</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Octobre 2020, I participated to this online event organised by the Practicing Law Institute PLI.  I participated, along with EU and US experts, on the first panel on E.U. Developments in Platform Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pli.edu/programs/online-platforms\">The material remains available on demand until Octobre 2021.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I focused on Chapitre V, Lawful data transfer and the Schrems-II European Court of Justice decision in July 2020. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During the day, various speakers develop other aspects of online platforms:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Learn about the geopolitical and industry rivalries and debates about platforms and popular technologies</li><li>Hear about the implications of Brexit for platform regulations</li><li>Understand how the pandemic has affected, and will profoundly affect, issues relating to privacy, surveillance, AI and algorithms, and other topics</li><li>Gain insight into the politicization of social media platforms and communication technologies</li><li>Find connections among seemingly disparate topics of hate speech, copyright, and “fake news” through the lens of “content moderation”</li><li>Benefit from perspectives of seasoned in-house counsel, advisors, and litigators</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":1068} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/11/Screenshot-2020-10-21-at-18.29.03-1024x489.png\" alt=\"\" class=\"wp-image-1068\" /></figure>\n<!-- /wp:image -->','Online Platforms and Popular Technologies 2020','','inherit','closed','closed','','1067-revision-v1','','','2020-11-06 20:43:35','2020-11-06 20:43:35','',1067,'https://datarainbow.eu/?p=1069',0,'revision','',0),(1070,5,'2020-11-06 21:33:02','0000-00-00 00:00:00','<!-- wp:paragraph -->\n<p>Pourquoi les visages des policiers en action doivent etre floutés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>S\'il est vrai que la liberté d\'expression et la liberté d\'information sont garantie par la Constitution francaise et la Convention Europeenne des Droits de l\'homme, la Protection de la vie privee est tout autant digne d\'interet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Quels sont les textes :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Ainsi, toute personne, même celle qui exerce des activités publiques, politiques, économiques ou professionnelles peut se prévaloir du principe du droit au respect de la vie privée. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> (<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679#d1e1559-1-1\" target=\"_blank\">voir l’article 4 paragraphe 2 du RGPD</a>), devrait donc normalement faire l’objet d’une autorisation par la personne concernée, par exemple le policier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le traitement de données personnelles à des fins journalistiques, sauf cas exceptionnels, n’a pas à faire l’objet d’une autorisation<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Liberté d\'expression des citoyens, article 10 de la Convention, aux termes duquel</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"1. Toute personne a droit à la liberté d\'expression. Ce droit comprend la liberté d\'opinion et la liberté de recevoir ou de communiquer des informations ou des idées sans qu\'il puisse y avoir ingérence d\'autorités publiques et sans considération de frontière. Le présent article (art. 10) n\'empêche pas les États de soumettre les entreprises de radiodiffusion, de cinéma ou de télévision à un régime d\'autorisations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. L\'exercice de ces libertés comportant des devoirs et des responsabilités peut être soumis à certaines formalités, conditions, restrictions ou sanctions, prévues par la loi, qui constituent des mesures nécessaires, dans une société démocratique, à la sécurité nationale, à l\'intégrité territoriale ou à la sûreté publique, à la défense de l\'ordre et à la prévention du crime, à la protection de la santé ou de la morale, à la protection de la réputation ou des droits d\'autrui, pour empêcher la divulgation d\'informations confidentielles ou pour garantir l\'autorité et l\'impartialité du pouvoir judiciaire.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https:\\/\\/hudoc.echr.coe.int\\/eng#{%22itemid%22:[%22001-62057%22]}\",\"type\":\"rich\",\"providerNameSlug\":\"embed-handler\",\"className\":\"\"} -->\n<figure class=\"wp-block-embed is-type-rich is-provider-embed-handler\"><div class=\"wp-block-embed__wrapper\">\nhttps://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-62057%22]}\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>Arrêt de 2011 sur la minimisation des données et anonymisation des fonctionnaires de police <a rel=\"noreferrer noopener\" href=\"https://t.co/a8caDVgFNh?amp=1\" target=\"_blank\">https://legifrance.gouv.fr/jorf/id/JORFTEXT000023865789/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art. 12. La garantie des droits de l\'Homme et du Citoyen nécessite une force publique : cette force est donc instituée pour l\'avantage de tous, et non pour l\'utilité particulière de ceux auxquels elle est confiée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Code civil un <strong>article 9 </strong> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><strong><em>\"chacun a droit au respect de sa vie privée\".</em></strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En Chypre A newspaper was fined €10,000 for publishing the names and photographs of police officers alongside allegations of unnecessary and unlawful detention. The Commissioner found that the aim of the news article could have been achieved without the officers being identified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A TV station and online newspaper operator was fined €5,000 for publishing, without consent, the photograph of a police informant who had expressed the wish to remain anonymous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Principe de minimisation des données personnelles Art 5 du RGDP</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ne doivent traiter (diffuser sur internet, divulguer dans un article…) que les données personnelles nécessaires à la démonstration. L’impact sur la vie privée des personnes doit être le plus réduit possible, comme le prévoit là encore le RGPD</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;Inutile donc de montrer les visages de manifestants mais aussi de policier, si ce n’est pas nécessaire. Chacun a droit au respect de sa vie privée et les conséquences d’une diffusion massive de données personnelles peuvent être particulièrement désagréables, voire dramatiques pour certains, en particulier pour les agents des forces de l’ordre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Conclusion&nbsp;: lors d’une manifestation, toute personne peut prendre des images et les diffuser, à condition qu’elle agisse dans un but journalistique, qu’elle ne traite que le minimum utile de données personnelles (visages, voix de passants, etc.). Par ailleurs, les visages des agents de certains services d’intervention et de renseignement listés dans&nbsp;<a href=\"https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000023865789&amp;categorieLien=id\" target=\"_blank\" rel=\"noreferrer noopener\">un arrêté de 2011</a>&nbsp;doivent impérativement être floutées.</p>\n<!-- /wp:paragraph -->','Liberté d\'Expression, Liberté. d\'Information et la Protection de la Vie Privée','','draft','closed','closed','','','','','2020-11-06 21:33:02','2020-11-06 21:33:02','',0,'http://datarainbow.eu/?p=1070',0,'post','',0),(1071,5,'2020-11-06 21:06:42','2020-11-06 21:06:42','{{unknown}}','','','publish','closed','closed','','29fb22829a86f1e61ef4a7ea05773619','','','2020-11-06 21:06:42','2020-11-06 21:06:42','',0,'https://datarainbow.eu/?p=1071',0,'oembed_cache','',0),(1072,5,'2020-11-06 21:33:01','2020-11-06 21:33:01','<!-- wp:paragraph -->\n<p>Pourquoi les visages des policiers en action doivent etre floutés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>S\'il est vrai que la liberté d\'expression et la liberté d\'information sont garantie par la Constitution francaise et la Convention Europeenne des Droits de l\'homme, la Protection de la vie privee est tout autant digne d\'interet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Quels sont les textes :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Ainsi, toute personne, même celle qui exerce des activités publiques, politiques, économiques ou professionnelles peut se prévaloir du principe du droit au respect de la vie privée. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> (<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679#d1e1559-1-1\" target=\"_blank\">voir l’article 4 paragraphe 2 du RGPD</a>), devrait donc normalement faire l’objet d’une autorisation par la personne concernée, par exemple le policier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le traitement de données personnelles à des fins journalistiques, sauf cas exceptionnels, n’a pas à faire l’objet d’une autorisation<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Liberté d\'expression des citoyens, article 10 de la Convention, aux termes duquel</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"1. Toute personne a droit à la liberté d\'expression. Ce droit comprend la liberté d\'opinion et la liberté de recevoir ou de communiquer des informations ou des idées sans qu\'il puisse y avoir ingérence d\'autorités publiques et sans considération de frontière. Le présent article (art. 10) n\'empêche pas les États de soumettre les entreprises de radiodiffusion, de cinéma ou de télévision à un régime d\'autorisations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. L\'exercice de ces libertés comportant des devoirs et des responsabilités peut être soumis à certaines formalités, conditions, restrictions ou sanctions, prévues par la loi, qui constituent des mesures nécessaires, dans une société démocratique, à la sécurité nationale, à l\'intégrité territoriale ou à la sûreté publique, à la défense de l\'ordre et à la prévention du crime, à la protection de la santé ou de la morale, à la protection de la réputation ou des droits d\'autrui, pour empêcher la divulgation d\'informations confidentielles ou pour garantir l\'autorité et l\'impartialité du pouvoir judiciaire.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https:\\/\\/hudoc.echr.coe.int\\/eng#{%22itemid%22:[%22001-62057%22]}\",\"type\":\"rich\",\"providerNameSlug\":\"embed-handler\",\"className\":\"\"} -->\n<figure class=\"wp-block-embed is-type-rich is-provider-embed-handler\"><div class=\"wp-block-embed__wrapper\">\nhttps://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-62057%22]}\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>Arrêt de 2011 sur la minimisation des données et anonymisation des fonctionnaires de police <a rel=\"noreferrer noopener\" href=\"https://t.co/a8caDVgFNh?amp=1\" target=\"_blank\">https://legifrance.gouv.fr/jorf/id/JORFTEXT000023865789/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art. 12. La garantie des droits de l\'Homme et du Citoyen nécessite une force publique : cette force est donc instituée pour l\'avantage de tous, et non pour l\'utilité particulière de ceux auxquels elle est confiée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Code civil un <strong>article 9 </strong> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><strong><em>\"chacun a droit au respect de sa vie privée\".</em></strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En Chypre A newspaper was fined €10,000 for publishing the names and photographs of police officers alongside allegations of unnecessary and unlawful detention. The Commissioner found that the aim of the news article could have been achieved without the officers being identified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A TV station and online newspaper operator was fined €5,000 for publishing, without consent, the photograph of a police informant who had expressed the wish to remain anonymous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Principe de minimisation des données personnelles Art 5 du RGDP</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ne doivent traiter (diffuser sur internet, divulguer dans un article…) que les données personnelles nécessaires à la démonstration. L’impact sur la vie privée des personnes doit être le plus réduit possible, comme le prévoit là encore le RGPD</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;Inutile donc de montrer les visages de manifestants mais aussi de policier, si ce n’est pas nécessaire. Chacun a droit au respect de sa vie privée et les conséquences d’une diffusion massive de données personnelles peuvent être particulièrement désagréables, voire dramatiques pour certains, en particulier pour les agents des forces de l’ordre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Conclusion&nbsp;: lors d’une manifestation, toute personne peut prendre des images et les diffuser, à condition qu’elle agisse dans un but journalistique, qu’elle ne traite que le minimum utile de données personnelles (visages, voix de passants, etc.). Par ailleurs, les visages des agents de certains services d’intervention et de renseignement listés dans&nbsp;<a href=\"https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000023865789&amp;categorieLien=id\" target=\"_blank\" rel=\"noreferrer noopener\">un arrêté de 2011</a>&nbsp;doivent impérativement être floutées.</p>\n<!-- /wp:paragraph -->','Liberté d\'Expression, Liberté. d\'Information et la Protection de la Vie Privée','','inherit','closed','closed','','1070-revision-v1','','','2020-11-06 21:33:01','2020-11-06 21:33:01','',1070,'https://datarainbow.eu/?p=1072',0,'revision','',0),(1073,5,'2020-11-06 21:44:05','0000-00-00 00:00:00','<!-- wp:paragraph -->\n<p>First of all, what are the specificities of the legal professions in this regard and who are we targeting?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>All legal experts, lawyers, bailiffs or notaries.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>All professionals dealing with the law, in the service of justice, one of the major pillars of our democracy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They are legal technicians, they are well qualified to read and interpret laws and regulations. They know how to write and handle legal technical terms, as well as the rights and obligations that applies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They are bound by professional secrecy or client attorney privilege.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They are entrusted with personal data of all kinds, often of a sensitive nature or, to use the exact terminology introduced by the RGDP, “  Special category <em>personal data </em>  ” Article 9 RGDP. Imagine a divorce file, the documents exchanged include the entire personal, family, professional, financial, medical,… information related to the entire life of the couple. It goes from birth certificates, family record book, bank accounts, notarial deeds of all kinds, pay slips, etc. Everything will be handed over to the lawyer, some documents will be shared with the notary or the bailiff.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We will leave aside the jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It therefore includes the personal data of children, certain members of the family and when a testimony is entered in the file, the certificate will be accompanied by the witness\'s identity document to be valid.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of the transmission of personal data.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The lawyer communicates with the courts via a RPVA key giving access to a secure platform.&nbsp;A new RPVA2 platform has just been set up.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, when it comes to communicating with clients, notaries or bailiffs, nothing is planned.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Most often, parts will be sent by email attachment.<br>Some will use file transmission modes, especially when the volume of parts requires it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The transmission of personal data within the European Union extended to the EEA, the European Economic Area.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any collection or processing of personal data must comply with the principles of the GDPR, in particular the principles set out in Article 5, namely lawfulness, loyalty, transparency, limitation of purposes, minimization of data, limitation of storage, accuracy of information, and above all, the integrity and confidentiality of data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The definition of the processing of personal data in Article 4 of the GDPR is quite broad, it includes</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"&nbsp;&nbsp;<em>Any operation or set of operations carried out or not using automated processes and applied to data or sets of personal data, such as collection, recording, organization, structuring, preservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, reconciliation or interconnection, limitation, erasure or the destruction ;&nbsp;</em>&nbsp;\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The legal professional, like any personal data controller, must display a&nbsp;<em>privacy policy</em>, or information notice, defining the methods, lawfulness, or duration of the processing.&nbsp;The information notice must be presented before the data is collected - in accordance with article 13 RGDP - in simple and understandable language for all.&nbsp;The purposes of the data processing, the retention periods, the contact details of the data controller and, if applicable, the contact details of the Data Protection Officer, for the largest structures processing a larger volume of data, must be mentioned therein.&nbsp;Information on the rights of access, the right of modification, the right of erasure as well as the right of complaint as defined in detail in articles 13 to 20 of the GDPR will be recalled in this notice.&nbsp;In addition, the National Commission for Information Technology and Freedoms, CNIL,<em>Privacy Impact Assessment</em>&nbsp;to verify the compliance of processing with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although court officers are protected by professional secrecy on the content of the data entrusted to them, they remain required to respond, without infringing professional secrecy, to any request for access or information which is theirs. sent under Article 15 of the GDPR as soon as possible and at the latest within one month.&nbsp;This will be the case, for example, of a customer or any other person legitimately wishing to know the processing of his personal data, as well as the retention period, the subcontractors accessing the data, the means of security, any transfers outside the EU. , etc ...</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pay attention therefore to the methods and duration of storage and the identity of third parties with whom the data is shared, this information, which must be mentioned in the information notice, must be communicated to all persons who request it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also beware of requests for abusive identity checks.&nbsp;The communication of the identity document is not always necessary and moreover, it remains in itself a personal data whose treatment will be subject to the regulations.&nbsp;If you ask for an identity document and then answer that you do not have any personal data, you have omitted the identity document which burns your fingers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The definition of \"&nbsp;&nbsp;<em>personal data</em>&nbsp;&nbsp;\" is quite broad and includes</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“&nbsp;&nbsp;<em>Any information relating to an identified or identifiable natural person</em>&nbsp;&nbsp;”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Identifiable when the identity of the person can be revealed by the combination of scattered information.&nbsp;The man in the bowler hat is not named, but his presence noted on a guest list identifying a single hatchet makes him identifiable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some European countries have opted for the extension of protection to the deceased.&nbsp;This is not the case with France.&nbsp;However, it is possible that data of deceased persons involve survivors, in which case protection will apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An important limit to the obligation of communication article 15 RGDP comes up against the data of third parties.&nbsp;This information cannot be communicated and must therefore be extracted from the transmission.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It should be noted that the GDPR is not limited to digitized data.&nbsp;Classified manual processing is also covered.&nbsp;According to the terms of article 2 paragraph 1 of the RGDP, the material field extends</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"The&nbsp;&nbsp;<em>processing of personal data, automated in whole or in part, as well as the non-automated processing of personal data contained or required to appear in a file</em>&nbsp;&nbsp;\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>It will therefore be necessary to ensure the integrity of the data accumulated in the files n, in particular limiting access to customer files.&nbsp;Think of the&nbsp;<em>cocktail parties</em>&nbsp;organized, opening the doors of the premises to third parties.&nbsp;The paper files must be kept under lock and key.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What remains crucial are the methods of data retention and restricted access by third parties.&nbsp;Remember that a processing agreement must be signed with&nbsp;<strong>all</strong>&nbsp;subcontractors.&nbsp;This includes IT services.&nbsp;This contract may include a confidentiality clause.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Archiving of resolved cases, offline or in a secure location is essential.&nbsp;Data minimization encourages the return of parts without delay.&nbsp;For current cases, the computer system should be regularly updated, protected by strong passwords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the&nbsp;<em>Panamapapers</em>&nbsp;scandal&nbsp;could explode, it is precisely thanks to a poorly protected and not updated computer system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cyberattacks and&nbsp;<em>ransomware,</em>&nbsp;or in the barbaric term,&nbsp;<em>ransomware</em>&nbsp;, have seen a marked upsurge during this pandemic period.&nbsp;The European security agency, ENISA, has released the latest official cyberattack figures.&nbsp;A second ENISA document explains the growing number of email attacks.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The European Union Agency for Cyber ​​Security (ENISA) has published its annual report on data breaches (January-April 2020).&nbsp;Highlights:<br>&nbsp;(i) 54% increase in the total number of violations by mid-2019 compared to 2018;<br>&nbsp;(ii) 71% of data breaches were motivated by financial reasons.&nbsp;Almost 25% had long-term strategic objectives (nation-state / espionage);<br>&nbsp;(iii) 32% of data breaches involve&nbsp;<em>phishing</em>&nbsp;activity&nbsp;.&nbsp;Email is the primary method of distributing malware (94%) in a chain of events leading to a data breach;<br>(iv) 52% of data breaches involved hacking.&nbsp;The other tactics used are social attacks (33%), malware (28%), and errors or mistakes (21%).&nbsp;Since 2016, hacking has been the leading cause of data breaches in the healthcare industry.&nbsp;In 2019, almost 59% of reported violations were caused by hacking;<br>&nbsp;(v) 70% of data breaches expose emails.&nbsp;Although the username / email and passwords (i.e. credentials) are easily changed relative to personal details (such as date of birth), the emphasis is mainly put on these in data breaches.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We mentioned earlier the case of very often used file transfer links.&nbsp;However, the free WeTransfer service is not encrypted.&nbsp;WeTransfer has been the subject of email-deflecting computer attacks or more recently a&nbsp;<em>phishing</em>&nbsp;attack&nbsp;, the link having been corrupted.&nbsp;“&nbsp;&nbsp;<em>Finally, continues Jean-Marc Boursat, CIOs must urge employees to be cautious about using public cloud solutions such as Dropbox or WeTransfer.&nbsp;Very popular for exchanging confidential documents and projects, these solutions nonetheless present a certain vagueness on the accommodation locations and their data confidentiality conditions.</em>&nbsp;\".&nbsp;Very often if the informed user had read the terms of use of these services, he would quickly have turned around.&nbsp;Only the paid version offers the guarantee of encryption.&nbsp;Only, the recipient does not know what service it is.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Encryption of transfers is absolutely essential to guarantee their integrity.&nbsp;There are several solutions on the market.&nbsp;Do not neglect security or you risk damaging your reputation or the sustainability of your business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recently, the Paris Judicial Court, law firms and the Ministry of Justice were again victims of computer attacks.&nbsp;A judicial inquiry has been opened.&nbsp;It is no longer IF an attack occurs, it is&nbsp;<strong>when</strong>it will happen, we will have to be ready.&nbsp;The responsibility is heavy, the fines of the CNIL can go up to 20 million Euros or 4% of the total income in the event of non-compliance.&nbsp;In the event of a data leak or computer attack, the CNIL and / or the individuals affected when their data is at risk must be notified without delay and at the latest within 72 hours, in accordance with article 33 of the RGDP.&nbsp;This period runs even if the professional is on leave.&nbsp;72 hours at the latest suggests that one or two managers have been identified in advance to be the point of contact with the CNIL 24/24 and 365/365.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Data transfers to countries outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are two main categories of destinations outside the EEA: countries that have concluded adequacy agreements with the European Commission, there are currently 11, the latest being Japan.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The rest of the world is considered a country of inadequate protection.&nbsp;In principle no personal data should be transferred there without appropriate guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Until this summer, the United States benefited from a Protection&nbsp;<em>Shield</em>&nbsp;or&nbsp;<em>Privacy Shield agreement</em>&nbsp;.&nbsp;At the end of a long and very expensive legal battle, the&nbsp;<em>Privacy Shield</em>&nbsp;was invalidated by a judgment of the ECJ of July 2020, Schrems-II against Facebook.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From now on, no personal data can be transferred to the United States, but also to China, Russia, India and all countries outside the EEA or the group of 11 benefiting from an adequacy agreement.&nbsp;The notion of transfer has not been defined in the GDPR.&nbsp;The CNIL recently clarified in its observations to the Council of State in the case of the transfer of DataHub medical data to Microsoft, that a transfer took place when the data was placed in the hands of a company governed by American law such as than Microsoft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ\'s position stems from Edward Snowden\'s revelations on US government interceptions, including FISA Section 702,&nbsp;<em>Executive Order</em>&nbsp;12333, and DP98.&nbsp;The&nbsp;<em>US Cloud Act</em>&nbsp;authorizes the&nbsp;<em>US</em>&nbsp;government to claim data wherever it is located and regardless of the location of computer servers.&nbsp;This American interference is accompanied by a lack of guarantee of the rights of European subjects who do not have sufficient rights of recourse, at least equivalent to the rights conferred on them by the RGDP, for&nbsp;<em>judicial redress</em>&nbsp;in the United States.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since the Schrems-II judgment and pending the resolution of a probable new negotiation between the European Commission and the American government, any transfer of data to the United States or any country without an adequacy agreement must be suspended.&nbsp;The&nbsp;<em>Standard Contractual Clauses</em>&nbsp;, or&nbsp;<em>Standard Clauses</em>&nbsp;of Data Protection, and&nbsp;<em>Binding Corporates Rules</em>&nbsp;, or&nbsp;<em>Binding Company Rules</em>&nbsp;, heavier and more expensive instruments, in principle maintained, must be the subject of increased protection measures and a risk analysis and of adequacy on a case by case basis.&nbsp;The Commission\'s SCC models pre-date the GDPR, these clauses, the Commission promised, will need to be modernized by the end of the year.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cases of derogations have been provided for.&nbsp;They are listed in article 49 RGDP.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Subject to transparency and information to the persons concerned on the risks incurred due to the lack of an adequacy decision and appropriate guarantees - attention this may be the client himself or any person whose data is transferred or even the opposing party - in the case of explicit consent from the interested party (s) or when the transfer is necessary for the performance or conclusion of a contract.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But be careful, these exceptions do not apply:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"&nbsp;&nbsp;<em>That if this transfer is not of a repetitive nature, affects only a limited number of data subjects, is necessary for the purposes of the overriding legitimate interests pursued by the controller over which the interests or the rights and freedoms of the data subject, and whether the controller has assessed all the circumstances surrounding the data transfer and has offered, on the basis of this assessment, appropriate guarantees with regard to the protection of personal data.&nbsp;The controller informs the supervisory authority of the transfer.&nbsp;In addition to providing the information referred to in Articles 13 and 14, the controller informs the data subject of the transfer and of the overriding legitimate interests he pursues</em>&nbsp;&nbsp;”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>These exemptions, you will understand, are very strictly supervised.&nbsp;The case of the public interest does not seem to adapt within the framework of the activities of the auxiliaries of justice.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The assessment of the circumstances of the transfer is very important in all cases of transfer of sensitive personal data of which the judicial officers may be the holder.&nbsp;Encryption and the use of strong passwords are absolutely essential.&nbsp;In short, the exporter must ensure that the importer will guarantee a level of protection equivalent to the European protection guaranteed by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Personal data collected on websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More and more law firms, notaries or bailiffs have a website to represent their Officine on the net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These websites often feature&nbsp;small file&nbsp;<em>cookies</em>&nbsp;that collect data from visitors and can track their&nbsp;<em>web browsing</em>&nbsp;.&nbsp;They facilitate site navigation by retaining usage parameters.&nbsp;They are also used to profile and target users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are two main forms,&nbsp;<em>first party</em>&nbsp;cookies&nbsp;which collect data directly for the site manager, and&nbsp;<em>third party</em>&nbsp;cookies&nbsp;which collect data by third parties, such as the best known, Google analytics, Facebook or YouTube when videos are imported. .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The regulations that apply to cookies derive from the&nbsp;<em>ePrivacy</em>&nbsp;directive&nbsp;currently under revision.&nbsp;There has recently been some back and forth between the Commission Nationale Informatique et Libertés, the CNIL, and the Council of State having partly invalidated the recommendations of the CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A recent judgment of the European Court of Justice, CEJ, Planet 49, fixed the rules of validity of the tracers, they can be cookies, or any other tracers like Pixels, Java Script, Fingerprint, etc….&nbsp;Any tracing and collection of personal data presupposes transparency prior to any collection and the collection of consent.&nbsp;Consent must be expressed by a positive act.&nbsp;The principles of&nbsp;<em>Privacy by Design</em>&nbsp;and by default require that by default no data be collected without the express and informed consent of visitors.&nbsp;The obligation of transparency requires the presence of an information notice as mentioned above, accessible from all pages of the site.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The recommendations of the CNIL limited the retention period of cookies to 13 months.&nbsp;This period should be reduced to six months.&nbsp;In addition, the consent must be entered in a consent register and can be withdrawn at any time.&nbsp;The CNIL suggests ways to prove consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Each actor relying on consent must be able to provide proof of this.&nbsp;For this, he can use the following, non-exclusive methods:<br>&nbsp;A sequestration with a third party of the computer code used by the body collecting the consent, for the different versions of its site or its mobile application, or even simply by the time-stamped publication on a public platform of a digest (or “&nbsp;&nbsp;<em>hash</em>&nbsp;&nbsp;”) of this code in order to be able to prove its authenticity&nbsp;<em>a posteriori</em>&nbsp;&nbsp;;<br>&nbsp;A screenshot of the visual rendering displayed on a mobile or fixed terminal can be kept, in a time-stamped manner, for each version of the site or of the application;<br>&nbsp;Regular audits of the consent collection mechanisms implemented by the sites or applications from which it is collected may be implemented by third parties appointed for this purpose;<br>&nbsp;Information relating to the tools implemented and their successive configurations (such as consent collection solutions, also known under the name CMP “&nbsp;&nbsp;<em>Consent Management Platform</em>&nbsp;&nbsp;”) can be kept, in a time-stamped manner, by third parties editing these solutions. .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the regulation of cookies and trackers depends on the&nbsp;<em>ePrivacy</em>&nbsp;Directive&nbsp;, the standard and the consent requirements must comply with articles 4 (11) and 7 of the GDPR, the European Regulation on Personal Data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"&nbsp;&nbsp;<em>It must therefore be free, specific, enlightened, unambiguous and the user must be able to withdraw it, at any time, with the same simplicity as he has granted it</em>&nbsp;&nbsp;\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Remember</em>&nbsp;to always include an&nbsp;unsubscrive&nbsp;option&nbsp;to unsubscribe, if you distribute&nbsp;<em>newsletters</em>&nbsp;by email.&nbsp;\"&nbsp;&nbsp;<em>The CNIL adopted guidelines on September 17, 2020, supplemented by a recommendation aimed in particular at providing examples of practical methods of obtaining consent</em>&nbsp;&nbsp;\".&nbsp;These provisions have been transposed into French law in article 82 of the Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The site manager must ensure compliance with these two texts.&nbsp;He has the obligation, according to GDPR art 28, to sign an agreement with all subcontractors, ensuring their compliance with the GDPR, which will also apply to the web designer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He will not be able to hide behind a simple promise of conformity.&nbsp;A compliance audit is required.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It should be noted that when the site shares data with companies incorporated under American law, such as Google, YouTube or Facebook, this access to the data of site visitors should be considered as transfer to the United States.&nbsp;NOYB, the association created by Max Schrems, did not fail to file a complaint against 101 American companies, including the latter.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the decision of the ECJ, FashionID, it was judged that the website manager who authorizes access to personal data to a third party, becomes Co-controller with it, without the need to demonstrate that he would exercise control over this processing.&nbsp;This judgment made Co-controller, and thereby co-responsible, a Facebook page administrator with Facebook for the processing of personal data of its members.&nbsp;This principle will naturally be extended to the site manager who allows the collection of data by&nbsp;<em>third party</em>&nbsp;cookies&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The CNIL specifies, as an indication, that cookies which require the prior consent of users: All cookies not having the sole purpose of allowing or facilitating electronic communication or not being strictly necessary for the provision of an online communication service at the express request of the user requires the prior consent of the user.&nbsp;Among the cookies requiring prior information and the prior collection of the user\'s consent, we can cite in particular:<br>&nbsp;cookies related to operations relating to personalized advertising;<br>&nbsp;social network cookies, in particular generated by their share buttons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>With regard to tracers not subject to consent, we can mention:<br>&nbsp;tracers retaining the choice expressed by users on the deposit of tracers;<br>&nbsp;tracers intended for authentication with a service, including those intended to ensure the security of the authentication mechanism, for example by limiting robotic or unexpected access attempts;<br>&nbsp;trackers intended to keep in memory the contents of a shopping cart on a merchant site or to invoice the user for the product (s) and / or service (s) purchased;<br>&nbsp;user interface personalization plotters (for example, for the choice of language or presentation of a service), when such personalization constitutes an intrinsic and expected element of the service;<br>&nbsp;the tracers allowing load balancing of the equipment contributing to a communication service;<br>&nbsp;plotters allowing paid sites to limit free access to a sample of content requested by users (predefined quantity and / or over a limited period);<br>&nbsp;certain audience measurement tracers as long as they meet certain conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Beware of cookie banners which either place cookies even before having received the visitor\'s consent or which, despite the refusal of cookies, install them on the user\'s terminal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the use of videoconferencing applications.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These apps can also transfer data outside of EEA and also carry security risks for their users.&nbsp;We invite you to read a previous article analyzing the question of their use by lawyers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If these rules may seem restrictive, they are no less justified by digital globalization, the ease of intercepting, accumulating and the successful business of personal data.&nbsp;Digital technology has brought many facilities to the simplified processing of documents and the work of the lawyer. Gone are the days when assignments were typed one by one with a typewriter, each fault forcing to hand over the task.&nbsp;The modern lawyer has at his disposal means of performance allowing him a greatly increased efficiency.&nbsp;The downside, which is compliance with basic security rules and data protection, is a lesser evil.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNB has produced practical factsheets for law firms.&nbsp;However, the practice is still far from the required and necessary conformity.<br>Encryption is an absolute necessity.&nbsp;Cookie control should be strengthened as we approach the end of the grace period left by the CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The national control authorities are overwhelmed, of course, if you have been able to escape their control, there remains, in addition to individual remedies, the action of associations for the defense of rights such as&nbsp;<em>NOYB, la Quadrature du Net, Privacy International</em>&nbsp;, and others.&nbsp;Class actions are now allowed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Above all, the legal professional, bound by professional secrecy which is so dear to him, and enamored of rights and freedoms, must comply with the regulations which are imposed on everyone.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To finish and to complete the picture, a last article on the Why of Respect for Privacy:&nbsp;&nbsp;[&nbsp;<a href=\"https://www.village-justice.com/articles/les-professionnels-droit-protection-des-donnees,37019.html?utm_source=dlvr.it&amp;utm_medium=twitter&amp;utm_campaign=RSS#nb2-1\">1</a>&nbsp;]&nbsp;.<br></p>\n<!-- /wp:paragraph -->','GDPR Compliance and ~Data Transfers for the Legal Profession','','draft','closed','closed','','','','','2020-11-06 21:44:05','2020-11-06 21:44:05','',0,'http://datarainbow.eu/?p=1073',0,'post','',0),(1074,5,'2020-11-06 21:44:05','2020-11-06 21:44:05','<!-- wp:paragraph -->\n<p>First of all, what are the specificities of the legal professions in this regard and who are we targeting?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>All legal experts, lawyers, bailiffs or notaries.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>All professionals dealing with the law, in the service of justice, one of the major pillars of our democracy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They are legal technicians, they are well qualified to read and interpret laws and regulations. They know how to write and handle legal technical terms, as well as the rights and obligations that applies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They are bound by professional secrecy or client attorney privilege.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They are entrusted with personal data of all kinds, often of a sensitive nature or, to use the exact terminology introduced by the RGDP, “  Special category <em>personal data </em>  ” Article 9 RGDP. Imagine a divorce file, the documents exchanged include the entire personal, family, professional, financial, medical,… information related to the entire life of the couple. It goes from birth certificates, family record book, bank accounts, notarial deeds of all kinds, pay slips, etc. Everything will be handed over to the lawyer, some documents will be shared with the notary or the bailiff.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We will leave aside the jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It therefore includes the personal data of children, certain members of the family and when a testimony is entered in the file, the certificate will be accompanied by the witness\'s identity document to be valid.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of the transmission of personal data.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The lawyer communicates with the courts via a RPVA key giving access to a secure platform.&nbsp;A new RPVA2 platform has just been set up.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, when it comes to communicating with clients, notaries or bailiffs, nothing is planned.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Most often, parts will be sent by email attachment.<br>Some will use file transmission modes, especially when the volume of parts requires it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The transmission of personal data within the European Union extended to the EEA, the European Economic Area.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any collection or processing of personal data must comply with the principles of the GDPR, in particular the principles set out in Article 5, namely lawfulness, loyalty, transparency, limitation of purposes, minimization of data, limitation of storage, accuracy of information, and above all, the integrity and confidentiality of data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The definition of the processing of personal data in Article 4 of the GDPR is quite broad, it includes</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"&nbsp;&nbsp;<em>Any operation or set of operations carried out or not using automated processes and applied to data or sets of personal data, such as collection, recording, organization, structuring, preservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, reconciliation or interconnection, limitation, erasure or the destruction ;&nbsp;</em>&nbsp;\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The legal professional, like any personal data controller, must display a&nbsp;<em>privacy policy</em>, or information notice, defining the methods, lawfulness, or duration of the processing.&nbsp;The information notice must be presented before the data is collected - in accordance with article 13 RGDP - in simple and understandable language for all.&nbsp;The purposes of the data processing, the retention periods, the contact details of the data controller and, if applicable, the contact details of the Data Protection Officer, for the largest structures processing a larger volume of data, must be mentioned therein.&nbsp;Information on the rights of access, the right of modification, the right of erasure as well as the right of complaint as defined in detail in articles 13 to 20 of the GDPR will be recalled in this notice.&nbsp;In addition, the National Commission for Information Technology and Freedoms, CNIL,<em>Privacy Impact Assessment</em>&nbsp;to verify the compliance of processing with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although court officers are protected by professional secrecy on the content of the data entrusted to them, they remain required to respond, without infringing professional secrecy, to any request for access or information which is theirs. sent under Article 15 of the GDPR as soon as possible and at the latest within one month.&nbsp;This will be the case, for example, of a customer or any other person legitimately wishing to know the processing of his personal data, as well as the retention period, the subcontractors accessing the data, the means of security, any transfers outside the EU. , etc ...</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pay attention therefore to the methods and duration of storage and the identity of third parties with whom the data is shared, this information, which must be mentioned in the information notice, must be communicated to all persons who request it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also beware of requests for abusive identity checks.&nbsp;The communication of the identity document is not always necessary and moreover, it remains in itself a personal data whose treatment will be subject to the regulations.&nbsp;If you ask for an identity document and then answer that you do not have any personal data, you have omitted the identity document which burns your fingers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The definition of \"&nbsp;&nbsp;<em>personal data</em>&nbsp;&nbsp;\" is quite broad and includes</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“&nbsp;&nbsp;<em>Any information relating to an identified or identifiable natural person</em>&nbsp;&nbsp;”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Identifiable when the identity of the person can be revealed by the combination of scattered information.&nbsp;The man in the bowler hat is not named, but his presence noted on a guest list identifying a single hatchet makes him identifiable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some European countries have opted for the extension of protection to the deceased.&nbsp;This is not the case with France.&nbsp;However, it is possible that data of deceased persons involve survivors, in which case protection will apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An important limit to the obligation of communication article 15 RGDP comes up against the data of third parties.&nbsp;This information cannot be communicated and must therefore be extracted from the transmission.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It should be noted that the GDPR is not limited to digitized data.&nbsp;Classified manual processing is also covered.&nbsp;According to the terms of article 2 paragraph 1 of the RGDP, the material field extends</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"The&nbsp;&nbsp;<em>processing of personal data, automated in whole or in part, as well as the non-automated processing of personal data contained or required to appear in a file</em>&nbsp;&nbsp;\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>It will therefore be necessary to ensure the integrity of the data accumulated in the files n, in particular limiting access to customer files.&nbsp;Think of the&nbsp;<em>cocktail parties</em>&nbsp;organized, opening the doors of the premises to third parties.&nbsp;The paper files must be kept under lock and key.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What remains crucial are the methods of data retention and restricted access by third parties.&nbsp;Remember that a processing agreement must be signed with&nbsp;<strong>all</strong>&nbsp;subcontractors.&nbsp;This includes IT services.&nbsp;This contract may include a confidentiality clause.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Archiving of resolved cases, offline or in a secure location is essential.&nbsp;Data minimization encourages the return of parts without delay.&nbsp;For current cases, the computer system should be regularly updated, protected by strong passwords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the&nbsp;<em>Panamapapers</em>&nbsp;scandal&nbsp;could explode, it is precisely thanks to a poorly protected and not updated computer system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cyberattacks and&nbsp;<em>ransomware,</em>&nbsp;or in the barbaric term,&nbsp;<em>ransomware</em>&nbsp;, have seen a marked upsurge during this pandemic period.&nbsp;The European security agency, ENISA, has released the latest official cyberattack figures.&nbsp;A second ENISA document explains the growing number of email attacks.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The European Union Agency for Cyber ​​Security (ENISA) has published its annual report on data breaches (January-April 2020).&nbsp;Highlights:<br>&nbsp;(i) 54% increase in the total number of violations by mid-2019 compared to 2018;<br>&nbsp;(ii) 71% of data breaches were motivated by financial reasons.&nbsp;Almost 25% had long-term strategic objectives (nation-state / espionage);<br>&nbsp;(iii) 32% of data breaches involve&nbsp;<em>phishing</em>&nbsp;activity&nbsp;.&nbsp;Email is the primary method of distributing malware (94%) in a chain of events leading to a data breach;<br>(iv) 52% of data breaches involved hacking.&nbsp;The other tactics used are social attacks (33%), malware (28%), and errors or mistakes (21%).&nbsp;Since 2016, hacking has been the leading cause of data breaches in the healthcare industry.&nbsp;In 2019, almost 59% of reported violations were caused by hacking;<br>&nbsp;(v) 70% of data breaches expose emails.&nbsp;Although the username / email and passwords (i.e. credentials) are easily changed relative to personal details (such as date of birth), the emphasis is mainly put on these in data breaches.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We mentioned earlier the case of very often used file transfer links.&nbsp;However, the free WeTransfer service is not encrypted.&nbsp;WeTransfer has been the subject of email-deflecting computer attacks or more recently a&nbsp;<em>phishing</em>&nbsp;attack&nbsp;, the link having been corrupted.&nbsp;“&nbsp;&nbsp;<em>Finally, continues Jean-Marc Boursat, CIOs must urge employees to be cautious about using public cloud solutions such as Dropbox or WeTransfer.&nbsp;Very popular for exchanging confidential documents and projects, these solutions nonetheless present a certain vagueness on the accommodation locations and their data confidentiality conditions.</em>&nbsp;\".&nbsp;Very often if the informed user had read the terms of use of these services, he would quickly have turned around.&nbsp;Only the paid version offers the guarantee of encryption.&nbsp;Only, the recipient does not know what service it is.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Encryption of transfers is absolutely essential to guarantee their integrity.&nbsp;There are several solutions on the market.&nbsp;Do not neglect security or you risk damaging your reputation or the sustainability of your business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recently, the Paris Judicial Court, law firms and the Ministry of Justice were again victims of computer attacks.&nbsp;A judicial inquiry has been opened.&nbsp;It is no longer IF an attack occurs, it is&nbsp;<strong>when</strong>it will happen, we will have to be ready.&nbsp;The responsibility is heavy, the fines of the CNIL can go up to 20 million Euros or 4% of the total income in the event of non-compliance.&nbsp;In the event of a data leak or computer attack, the CNIL and / or the individuals affected when their data is at risk must be notified without delay and at the latest within 72 hours, in accordance with article 33 of the RGDP.&nbsp;This period runs even if the professional is on leave.&nbsp;72 hours at the latest suggests that one or two managers have been identified in advance to be the point of contact with the CNIL 24/24 and 365/365.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Data transfers to countries outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are two main categories of destinations outside the EEA: countries that have concluded adequacy agreements with the European Commission, there are currently 11, the latest being Japan.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The rest of the world is considered a country of inadequate protection.&nbsp;In principle no personal data should be transferred there without appropriate guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Until this summer, the United States benefited from a Protection&nbsp;<em>Shield</em>&nbsp;or&nbsp;<em>Privacy Shield agreement</em>&nbsp;.&nbsp;At the end of a long and very expensive legal battle, the&nbsp;<em>Privacy Shield</em>&nbsp;was invalidated by a judgment of the ECJ of July 2020, Schrems-II against Facebook.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From now on, no personal data can be transferred to the United States, but also to China, Russia, India and all countries outside the EEA or the group of 11 benefiting from an adequacy agreement.&nbsp;The notion of transfer has not been defined in the GDPR.&nbsp;The CNIL recently clarified in its observations to the Council of State in the case of the transfer of DataHub medical data to Microsoft, that a transfer took place when the data was placed in the hands of a company governed by American law such as than Microsoft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ\'s position stems from Edward Snowden\'s revelations on US government interceptions, including FISA Section 702,&nbsp;<em>Executive Order</em>&nbsp;12333, and DP98.&nbsp;The&nbsp;<em>US Cloud Act</em>&nbsp;authorizes the&nbsp;<em>US</em>&nbsp;government to claim data wherever it is located and regardless of the location of computer servers.&nbsp;This American interference is accompanied by a lack of guarantee of the rights of European subjects who do not have sufficient rights of recourse, at least equivalent to the rights conferred on them by the RGDP, for&nbsp;<em>judicial redress</em>&nbsp;in the United States.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since the Schrems-II judgment and pending the resolution of a probable new negotiation between the European Commission and the American government, any transfer of data to the United States or any country without an adequacy agreement must be suspended.&nbsp;The&nbsp;<em>Standard Contractual Clauses</em>&nbsp;, or&nbsp;<em>Standard Clauses</em>&nbsp;of Data Protection, and&nbsp;<em>Binding Corporates Rules</em>&nbsp;, or&nbsp;<em>Binding Company Rules</em>&nbsp;, heavier and more expensive instruments, in principle maintained, must be the subject of increased protection measures and a risk analysis and of adequacy on a case by case basis.&nbsp;The Commission\'s SCC models pre-date the GDPR, these clauses, the Commission promised, will need to be modernized by the end of the year.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cases of derogations have been provided for.&nbsp;They are listed in article 49 RGDP.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Subject to transparency and information to the persons concerned on the risks incurred due to the lack of an adequacy decision and appropriate guarantees - attention this may be the client himself or any person whose data is transferred or even the opposing party - in the case of explicit consent from the interested party (s) or when the transfer is necessary for the performance or conclusion of a contract.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But be careful, these exceptions do not apply:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"&nbsp;&nbsp;<em>That if this transfer is not of a repetitive nature, affects only a limited number of data subjects, is necessary for the purposes of the overriding legitimate interests pursued by the controller over which the interests or the rights and freedoms of the data subject, and whether the controller has assessed all the circumstances surrounding the data transfer and has offered, on the basis of this assessment, appropriate guarantees with regard to the protection of personal data.&nbsp;The controller informs the supervisory authority of the transfer.&nbsp;In addition to providing the information referred to in Articles 13 and 14, the controller informs the data subject of the transfer and of the overriding legitimate interests he pursues</em>&nbsp;&nbsp;”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>These exemptions, you will understand, are very strictly supervised.&nbsp;The case of the public interest does not seem to adapt within the framework of the activities of the auxiliaries of justice.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The assessment of the circumstances of the transfer is very important in all cases of transfer of sensitive personal data of which the judicial officers may be the holder.&nbsp;Encryption and the use of strong passwords are absolutely essential.&nbsp;In short, the exporter must ensure that the importer will guarantee a level of protection equivalent to the European protection guaranteed by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Personal data collected on websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More and more law firms, notaries or bailiffs have a website to represent their Officine on the net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These websites often feature&nbsp;small file&nbsp;<em>cookies</em>&nbsp;that collect data from visitors and can track their&nbsp;<em>web browsing</em>&nbsp;.&nbsp;They facilitate site navigation by retaining usage parameters.&nbsp;They are also used to profile and target users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are two main forms,&nbsp;<em>first party</em>&nbsp;cookies&nbsp;which collect data directly for the site manager, and&nbsp;<em>third party</em>&nbsp;cookies&nbsp;which collect data by third parties, such as the best known, Google analytics, Facebook or YouTube when videos are imported. .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The regulations that apply to cookies derive from the&nbsp;<em>ePrivacy</em>&nbsp;directive&nbsp;currently under revision.&nbsp;There has recently been some back and forth between the Commission Nationale Informatique et Libertés, the CNIL, and the Council of State having partly invalidated the recommendations of the CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A recent judgment of the European Court of Justice, CEJ, Planet 49, fixed the rules of validity of the tracers, they can be cookies, or any other tracers like Pixels, Java Script, Fingerprint, etc….&nbsp;Any tracing and collection of personal data presupposes transparency prior to any collection and the collection of consent.&nbsp;Consent must be expressed by a positive act.&nbsp;The principles of&nbsp;<em>Privacy by Design</em>&nbsp;and by default require that by default no data be collected without the express and informed consent of visitors.&nbsp;The obligation of transparency requires the presence of an information notice as mentioned above, accessible from all pages of the site.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The recommendations of the CNIL limited the retention period of cookies to 13 months.&nbsp;This period should be reduced to six months.&nbsp;In addition, the consent must be entered in a consent register and can be withdrawn at any time.&nbsp;The CNIL suggests ways to prove consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Each actor relying on consent must be able to provide proof of this.&nbsp;For this, he can use the following, non-exclusive methods:<br>&nbsp;A sequestration with a third party of the computer code used by the body collecting the consent, for the different versions of its site or its mobile application, or even simply by the time-stamped publication on a public platform of a digest (or “&nbsp;&nbsp;<em>hash</em>&nbsp;&nbsp;”) of this code in order to be able to prove its authenticity&nbsp;<em>a posteriori</em>&nbsp;&nbsp;;<br>&nbsp;A screenshot of the visual rendering displayed on a mobile or fixed terminal can be kept, in a time-stamped manner, for each version of the site or of the application;<br>&nbsp;Regular audits of the consent collection mechanisms implemented by the sites or applications from which it is collected may be implemented by third parties appointed for this purpose;<br>&nbsp;Information relating to the tools implemented and their successive configurations (such as consent collection solutions, also known under the name CMP “&nbsp;&nbsp;<em>Consent Management Platform</em>&nbsp;&nbsp;”) can be kept, in a time-stamped manner, by third parties editing these solutions. .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the regulation of cookies and trackers depends on the&nbsp;<em>ePrivacy</em>&nbsp;Directive&nbsp;, the standard and the consent requirements must comply with articles 4 (11) and 7 of the GDPR, the European Regulation on Personal Data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"&nbsp;&nbsp;<em>It must therefore be free, specific, enlightened, unambiguous and the user must be able to withdraw it, at any time, with the same simplicity as he has granted it</em>&nbsp;&nbsp;\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Remember</em>&nbsp;to always include an&nbsp;unsubscrive&nbsp;option&nbsp;to unsubscribe, if you distribute&nbsp;<em>newsletters</em>&nbsp;by email.&nbsp;\"&nbsp;&nbsp;<em>The CNIL adopted guidelines on September 17, 2020, supplemented by a recommendation aimed in particular at providing examples of practical methods of obtaining consent</em>&nbsp;&nbsp;\".&nbsp;These provisions have been transposed into French law in article 82 of the Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The site manager must ensure compliance with these two texts.&nbsp;He has the obligation, according to GDPR art 28, to sign an agreement with all subcontractors, ensuring their compliance with the GDPR, which will also apply to the web designer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He will not be able to hide behind a simple promise of conformity.&nbsp;A compliance audit is required.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It should be noted that when the site shares data with companies incorporated under American law, such as Google, YouTube or Facebook, this access to the data of site visitors should be considered as transfer to the United States.&nbsp;NOYB, the association created by Max Schrems, did not fail to file a complaint against 101 American companies, including the latter.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the decision of the ECJ, FashionID, it was judged that the website manager who authorizes access to personal data to a third party, becomes Co-controller with it, without the need to demonstrate that he would exercise control over this processing.&nbsp;This judgment made Co-controller, and thereby co-responsible, a Facebook page administrator with Facebook for the processing of personal data of its members.&nbsp;This principle will naturally be extended to the site manager who allows the collection of data by&nbsp;<em>third party</em>&nbsp;cookies&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The CNIL specifies, as an indication, that cookies which require the prior consent of users: All cookies not having the sole purpose of allowing or facilitating electronic communication or not being strictly necessary for the provision of an online communication service at the express request of the user requires the prior consent of the user.&nbsp;Among the cookies requiring prior information and the prior collection of the user\'s consent, we can cite in particular:<br>&nbsp;cookies related to operations relating to personalized advertising;<br>&nbsp;social network cookies, in particular generated by their share buttons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://www.village-justice.com/articles/local/cache-vignettes/L8xH11/puce-32883.gif?1589621704\" alt=\"-\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>With regard to tracers not subject to consent, we can mention:<br>&nbsp;tracers retaining the choice expressed by users on the deposit of tracers;<br>&nbsp;tracers intended for authentication with a service, including those intended to ensure the security of the authentication mechanism, for example by limiting robotic or unexpected access attempts;<br>&nbsp;trackers intended to keep in memory the contents of a shopping cart on a merchant site or to invoice the user for the product (s) and / or service (s) purchased;<br>&nbsp;user interface personalization plotters (for example, for the choice of language or presentation of a service), when such personalization constitutes an intrinsic and expected element of the service;<br>&nbsp;the tracers allowing load balancing of the equipment contributing to a communication service;<br>&nbsp;plotters allowing paid sites to limit free access to a sample of content requested by users (predefined quantity and / or over a limited period);<br>&nbsp;certain audience measurement tracers as long as they meet certain conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Beware of cookie banners which either place cookies even before having received the visitor\'s consent or which, despite the refusal of cookies, install them on the user\'s terminal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the use of videoconferencing applications.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These apps can also transfer data outside of EEA and also carry security risks for their users.&nbsp;We invite you to read a previous article analyzing the question of their use by lawyers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If these rules may seem restrictive, they are no less justified by digital globalization, the ease of intercepting, accumulating and the successful business of personal data.&nbsp;Digital technology has brought many facilities to the simplified processing of documents and the work of the lawyer. Gone are the days when assignments were typed one by one with a typewriter, each fault forcing to hand over the task.&nbsp;The modern lawyer has at his disposal means of performance allowing him a greatly increased efficiency.&nbsp;The downside, which is compliance with basic security rules and data protection, is a lesser evil.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNB has produced practical factsheets for law firms.&nbsp;However, the practice is still far from the required and necessary conformity.<br>Encryption is an absolute necessity.&nbsp;Cookie control should be strengthened as we approach the end of the grace period left by the CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The national control authorities are overwhelmed, of course, if you have been able to escape their control, there remains, in addition to individual remedies, the action of associations for the defense of rights such as&nbsp;<em>NOYB, la Quadrature du Net, Privacy International</em>&nbsp;, and others.&nbsp;Class actions are now allowed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Above all, the legal professional, bound by professional secrecy which is so dear to him, and enamored of rights and freedoms, must comply with the regulations which are imposed on everyone.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To finish and to complete the picture, a last article on the Why of Respect for Privacy:&nbsp;&nbsp;[&nbsp;<a href=\"https://www.village-justice.com/articles/les-professionnels-droit-protection-des-donnees,37019.html?utm_source=dlvr.it&amp;utm_medium=twitter&amp;utm_campaign=RSS#nb2-1\">1</a>&nbsp;]&nbsp;.<br></p>\n<!-- /wp:paragraph -->','GDPR Compliance and ~Data Transfers for the Legal Profession','','inherit','closed','closed','','1073-revision-v1','','','2020-11-06 21:44:05','2020-11-06 21:44:05','',1073,'https://datarainbow.eu/?p=1074',0,'revision','',0),(1076,5,'2020-11-13 20:12:08','2020-11-13 20:12:08','<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Latest news, unless I have missed something :</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU wants to ban encryption,</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EDPB published their after SchremsII Supplementary Transfer Measures and Surveillance</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU Commission\'s draft Implementing Decision on SCCs</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅Datatilsynet\'s accreditation requirements for code of conduct monitoring body</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPS\' opinion on the European Commission\'s proposal for temporary derogations of the ePrivacy Directive</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s recommendations on Supplementary Transfer Measures and Surveillance</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s first binding decision under article 65 GDPR</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ U.K. ICO fined BA in cooperation with the French CNIL</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ And the Marriott International fined.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Meanwhile US might have voted for a new President😍.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ The older president is stock in and will be tough job getting him out.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Cyberattack is as ever high.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Data security and protection more crucial than ever. ENISA published its alarming report</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Open Rights Group has signed onto a joint civil society statement expressing concerns over proposals by the UK government which would undermine encryption, including through its Online Harms Bill.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s first binding decision under article 65 GDPR</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅CJEU\'s judgment in Orange România case</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ENISA Guidelines on Securing the IoT Supply Chain</a></li><li>✅ <a href=\"https://ico.org.uk/media/action-weve-taken/2618609/ticketmaster-uk-limited-mpn.pdf\">UK ICO fined Ticketmaster</a></li><li><a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000042499856?tab_selection=all&amp;searchField=ALL&amp;query=433311&amp;page=1&amp;init=true\"> ✅ French Conseil d\'Etat confirmed CNIL fine of 400.000€ for data breach</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Here is a digital brief from Euractiv <a href=\"https://www.euractiv.com/section/digital/news/digital-brief-powered-by-google-schrems-2-data-guidance-copyright-5g-in-the-eu/\">here&nbsp;</a></p>\n<!-- /wp:paragraph -->','A week with a 11.11.2020 and a Friday 13th was Going to be Memorable.','','publish','closed','closed','','a-week-with-a-11-11-2020-and-a-friday-13th-was-going-to-be-memorable','','','2020-11-15 09:31:39','2020-11-15 09:31:39','',0,'http://datarainbow.eu/?p=1076',0,'post','',0),(1077,5,'2020-11-13 20:01:18','2020-11-13 20:01:18','<!-- wp:paragraph -->\n<p>✅ the latest ICO fine for Ticketmaster</p>\n<!-- /wp:paragraph -->','Untitled Reusable Block','','trash','closed','closed','','untitled-reusable-block-2__trashed','','','2020-11-13 20:01:37','2020-11-13 20:01:37','',0,'https://datarainbow.eu/?p=1077',0,'wp_block','',0),(1078,5,'2020-11-13 20:05:32','2020-11-13 20:05:32','','EDPB','','inherit','closed','closed','','edpb','','','2020-11-13 20:05:32','2020-11-13 20:05:32','',1076,'/wp-content/uploads/sites/3/2020/11/EDPB.jpeg',0,'attachment','image/jpeg',0),(1079,5,'2020-11-13 20:12:08','2020-11-13 20:12:08','<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Latest news, unless I have missed something :</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU wants to ban encryption,<br>✅ EDPB published their after SchremsII Supplementary Transfer Measures and Surveillance<br>✅ EU Commission\'s draft Implementing Decision on SCCs<br>✅Datatilsynet\'s accreditation requirements for code of conduct monitoring body<br>✅EDPS\' opinion on the European Commission\'s proposal for temporary derogations of the ePrivacy Directive<br>✅EDPB\'s recommendations on Supplementary Transfer Measures and Surveillance<br>✅EDPB\'s first binding decision under article 65 GDPR<br>✅ U.K. ICO fined BA in cooperation with the French CNIL<br>✅ And the Marriott International fined.<br>✅ Meanwhile US might have voted for a new President😍.<br>✅ The older president is stock in and will be tough job getting him out.<br>✅ Cyberattack is as ever high.<br>Data security and protection more crucial than ever. ENISA published its alarming report<br>✅ Open Rights Group has signed onto a joint civil society statement expressing concerns over proposals by the UK government which would undermine encryption, including through its Online Harms Bill.<br>✅EDPB\'s first binding decision under article 65 GDPR<br>✅CJEU\'s judgment in Orange România case<br>✅ENISA Guidelines on Securing the IoT Supply Chain</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>✅ UK ICO fined Ticketmaster</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> ✅ French Conseil d\'Etat confirmed CNIL fine of 400.000€ for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a digital brief from Euractiv <a href=\"https://www.euractiv.com/section/digital/news/digital-brief-powered-by-google-schrems-2-data-guidance-copyright-5g-in-the-eu/\">here </a></p>\n<!-- /wp:paragraph -->','A week with a 11.11.2020 and a Friday 13th was Going to be Memorable.','','inherit','closed','closed','','1076-revision-v1','','','2020-11-13 20:12:08','2020-11-13 20:12:08','',1076,'https://datarainbow.eu/?p=1079',0,'revision','',0),(1082,5,'2020-11-15 09:13:22','2020-11-15 09:13:22','<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Latest news, unless I have missed something :</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU wants to ban encryption,<br>✅ EDPB published their after SchremsII Supplementary Transfer Measures and Surveillance<br>✅ EU Commission\'s draft Implementing Decision on SCCs<br>✅Datatilsynet\'s accreditation requirements for code of conduct monitoring body<br>✅EDPS\' opinion on the European Commission\'s proposal for temporary derogations of the ePrivacy Directive<br>✅EDPB\'s recommendations on Supplementary Transfer Measures and Surveillance<br>✅EDPB\'s first binding decision under article 65 GDPR<br>✅ U.K. ICO fined BA in cooperation with the French CNIL<br>✅ And the Marriott International fined.<br>✅ Meanwhile US might have voted for a new President😍.<br>✅ The older president is stock in and will be tough job getting him out.<br>✅ Cyberattack is as ever high.<br>Data security and protection more crucial than ever. ENISA published its alarming report<br>✅ Open Rights Group has signed onto a joint civil society statement expressing concerns over proposals by the UK government which would undermine encryption, including through its Online Harms Bill.<br>✅EDPB\'s first binding decision under article 65 GDPR<br>✅CJEU\'s judgment in Orange România case<br>✅ENISA Guidelines on Securing the IoT Supply Chain</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>✅ <a href=\"https://ico.org.uk/media/action-weve-taken/2618609/ticketmaster-uk-limited-mpn.pdf\">UK ICO fined Ticketmaster</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> ✅ French Conseil d\'Etat confirmed CNIL fine of 400.000€ for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a digital brief from Euractiv <a href=\"https://www.euractiv.com/section/digital/news/digital-brief-powered-by-google-schrems-2-data-guidance-copyright-5g-in-the-eu/\">here&nbsp;</a></p>\n<!-- /wp:paragraph -->','A week with a 11.11.2020 and a Friday 13th was Going to be Memorable.','','inherit','closed','closed','','1076-revision-v1','','','2020-11-15 09:13:22','2020-11-15 09:13:22','',1076,'http://datarainbow.eu/?p=1082',0,'revision','',0),(1083,5,'2020-11-15 09:27:46','2020-11-15 09:27:46','<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Latest news, unless I have missed something :</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU wants to ban encryption,<br>✅ EDPB published their after SchremsII Supplementary Transfer Measures and Surveillance<br>✅ EU Commission\'s draft Implementing Decision on SCCs<br>✅Datatilsynet\'s accreditation requirements for code of conduct monitoring body<br>✅EDPS\' opinion on the European Commission\'s proposal for temporary derogations of the ePrivacy Directive<br>✅EDPB\'s recommendations on Supplementary Transfer Measures and Surveillance<br>✅EDPB\'s first binding decision under article 65 GDPR<br>✅ U.K. ICO fined BA in cooperation with the French CNIL<br>✅ And the Marriott International fined.<br>✅ Meanwhile US might have voted for a new President😍.<br>✅ The older president is stock in and will be tough job getting him out.<br>✅ Cyberattack is as ever high.<br>Data security and protection more crucial than ever. ENISA published its alarming report<br>✅ Open Rights Group has signed onto a joint civil society statement expressing concerns over proposals by the UK government which would undermine encryption, including through its Online Harms Bill.<br>✅EDPB\'s first binding decision under article 65 GDPR<br>✅CJEU\'s judgment in Orange România case<br>✅ENISA Guidelines on Securing the IoT Supply Chain</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>✅ <a href=\"https://ico.org.uk/media/action-weve-taken/2618609/ticketmaster-uk-limited-mpn.pdf\">UK ICO fined Ticketmaster</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000042499856?tab_selection=all&amp;searchField=ALL&amp;query=433311&amp;page=1&amp;init=true\"> ✅ French Conseil d\'Etat confirmed CNIL fine of 400.000€ for data breac</a>h</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a digital brief from Euractiv <a href=\"https://www.euractiv.com/section/digital/news/digital-brief-powered-by-google-schrems-2-data-guidance-copyright-5g-in-the-eu/\">here&nbsp;</a></p>\n<!-- /wp:paragraph -->','A week with a 11.11.2020 and a Friday 13th was Going to be Memorable.','','inherit','closed','closed','','1076-revision-v1','','','2020-11-15 09:27:46','2020-11-15 09:27:46','',1076,'http://datarainbow.eu/?p=1083',0,'revision','',0),(1085,5,'2020-11-15 09:31:38','2020-11-15 09:31:38','<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Latest news, unless I have missed something :</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU wants to ban encryption,</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EDPB published their after SchremsII Supplementary Transfer Measures and Surveillance</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU Commission\'s draft Implementing Decision on SCCs</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅Datatilsynet\'s accreditation requirements for code of conduct monitoring body</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPS\' opinion on the European Commission\'s proposal for temporary derogations of the ePrivacy Directive</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s recommendations on Supplementary Transfer Measures and Surveillance</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s first binding decision under article 65 GDPR</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ U.K. ICO fined BA in cooperation with the French CNIL</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ And the Marriott International fined.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Meanwhile US might have voted for a new President😍.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ The older president is stock in and will be tough job getting him out.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Cyberattack is as ever high.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Data security and protection more crucial than ever. ENISA published its alarming report</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Open Rights Group has signed onto a joint civil society statement expressing concerns over proposals by the UK government which would undermine encryption, including through its Online Harms Bill.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s first binding decision under article 65 GDPR</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅CJEU\'s judgment in Orange România case</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ENISA Guidelines on Securing the IoT Supply Chain</a></li><li>✅ <a href=\"https://ico.org.uk/media/action-weve-taken/2618609/ticketmaster-uk-limited-mpn.pdf\">UK ICO fined Ticketmaster</a></li><li><a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000042499856?tab_selection=all&amp;searchField=ALL&amp;query=433311&amp;page=1&amp;init=true\"> ✅ French Conseil d\'Etat confirmed CNIL fine of 400.000€ for data breach</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Here is a digital brief from Euractiv <a href=\"https://www.euractiv.com/section/digital/news/digital-brief-powered-by-google-schrems-2-data-guidance-copyright-5g-in-the-eu/\">here&nbsp;</a></p>\n<!-- /wp:paragraph -->','A week with a 11.11.2020 and a Friday 13th was Going to be Memorable.','','inherit','closed','closed','','1076-revision-v1','','','2020-11-15 09:31:38','2020-11-15 09:31:38','',1076,'https://datarainbow.eu/?p=1085',0,'revision','',0),(1086,5,'2020-11-18 16:30:59','2020-11-18 16:30:59','<!-- wp:image {\"id\":1038} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-11-at-14.56.11.png\" alt=\"\" class=\"wp-image-1038\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Part of the data protection duties for any controller owning a website is to ensure the security of the electronic transmissions and the personal data of their visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One way of tracking visitors is by first party cookies or allowing third party cookies to access visitors data. As an illustration, many websites use Google Analytics, or a Facebook \'Like\' button, etc... These allow the parties to track users web browsing even outside the website itself, in order to fingerprint, track, profile ad target them. Our personal data have monetary values and are aggressively monetised. Ad Tech is a huge, wealthy industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since Privacy Shield invalidation by the European Court of Justice in the so-called Schrems-II decision, US corporations, especially the Electronic Communication Providers (ECP) have no legitimate basis to transfer data outside the EU/EEA. Therefore, any website owner using Google Analytics or other US ECP enabled to access their visitors\' data, are considered co-controller and as such liable for the unlawful data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A second security issue you can find on some websites is their lack of end to end encryption or E2EE allowing access to data during electronic transmissions. Google Chrome web browser has been labelling such websites of \'Not secure\' that you can spot at the top bar of your web browser. Other web browsers would omit to display the lock next to the URL as a sign the website is lacking security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Shamefully, this exact website we are using has been recently, every now and on, missing the SSL certificate for E2EE. This website is hosted by Godaddy for the last few months. Godaddy does not allow the use of the free letsencrypt certificate, they sell their own SSL certificate which sadly has shown to be un-reliable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, we want to reassure you, we do not collect any personal data. We do not place any first party cookies. We do not use any kind of analytics. We only use a Google font. We are constantly working to make this website as secure as compliant as possible. If you notice anything suspicious, do contact us at data@datarainbow.eu We are looking for web developers, with coding skills to build a website without any template or tracking Java Script or cookies.</p>\n<!-- /wp:paragraph -->','End to End Encryption on Website','Part of the data protection duties for any controller owning a website is to ensure the security of the electronic transmissions and the personal data of their visitors and E2EE.','inherit','closed','closed','','1033-autosave-v1','','','2020-11-18 16:30:59','2020-11-18 16:30:59','',1033,'http://datarainbow.eu/?p=1086',0,'revision','',0);
