(402,5,'2019-05-09 17:45:43','2019-05-09 16:45:43','<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Two new guidances, one by the <a href=\"https://t.co/iLfWe3PxTR\">Irish Data Protection commissionner</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and one by the <a href=\"https://ico.org.uk/for-organisations/in-your-sector/business/general-data-protection-regulation-gdpr-faqs-for-small-retailers?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=11692803-24bf-4164-9af2-1bd530eea6b7&amp;utm_content&amp;utm_campaign&amp;fbclid=IwAR03GMYAKvSjh92H8VC5mHW69dv7Ldll_GYaJ5KcVaz4RGlwwDvMEhL8sD8\">UK ICO.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What is the nature of the pictures recorded by the CCTV cameras?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'<em>special category</em>\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying an individual with its racial or ethic origin, by the colour of the skin or any external religious sign, these should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not noticing much improvement with the cameras, the management has now decided to name and shame the perpetrators. When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://securityboulevard.com/2019/05/smart-cities-and-smarter-hackers/amp/\">Smart cities and smarter hackers</a>. \'<em>Japan is planning a mass hackathon after passing legislation to prepare their citizens in advance of their 2020 Olympics. The company’s government plans to test the security of 200 Million IoT devices to create awareness of IoT security and its importance in the run up to the big event next year.</em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Balancing fairness and proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>When the same result could be achieved in a less intrusive way </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV Code of Conduct suggests other measures such as more lighting for a bette security. In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>As example of issues created by pictures posted online to identify criminals:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','publish','closed','closed','','life-under-digits-and-freedom','','https://datarainbow.eu/2019/01/22/why-privacy-matters/\nhttps://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\nhttps://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/','2020-01-18 14:05:18','2020-01-18 14:05:18','',0,'http://datarainbow.eu/?p=402',0,'post','',0),(403,5,'2019-05-09 15:42:16','2019-05-09 14:42:16','{{unknown}}','','','publish','closed','closed','','c63f35ced37b9f9163d175dce02cd9f5','','','2019-05-09 15:42:16','2019-05-09 14:42:16','',0,'https://datarainbow.eu/2019/05/09/c63f35ced37b9f9163d175dce02cd9f5/',0,'oembed_cache','',0),(404,5,'2019-05-09 16:52:21','2019-05-09 15:52:21','','Cameras','','inherit','closed','closed','','cameras','','','2019-05-09 16:52:21','2019-05-09 15:52:21','',402,'/wp-content/uploads/sites/3/2019/05/Cameras.jpg',0,'attachment','image/jpeg',0),(405,5,'2019-05-09 17:39:50','2019-05-09 16:39:50','{{unknown}}','','','publish','closed','closed','','8e28f0d0342acf85e740e4fdba1dfc39','','','2019-05-09 17:39:50','2019-05-09 16:39:50','',0,'https://datarainbow.eu/2019/05/09/8e28f0d0342acf85e740e4fdba1dfc39/',0,'oembed_cache','',0),(406,5,'2019-05-09 17:45:43','2019-05-09 16:45:43','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Or the omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\" </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is the nature of the pictures recorded by the CCTV cameras?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\" <a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\"> </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents <a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a> and therefore a burden to keep safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.  In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.  A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Balancing fairness and proportionality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller <em>and</em> those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the same result could be achieved in a less intrusive way </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As example of issues created by pictures posted online to identify criminals: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->','Life Under Digits and Freedom','','inherit','closed','closed','','402-revision-v1','','','2019-05-09 17:45:43','2019-05-09 16:45:43','',402,'https://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(408,5,'2019-05-09 17:57:09','2019-05-09 16:57:09','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Or the omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\" </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is the nature of the pictures recorded by the CCTV cameras?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\" <a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\"> </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents <a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a> and therefore a burden to keep safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.  In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.  A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Balancing fairness and proportionality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller <em>and</em> those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the same result could be achieved in a less intrusive way </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As example of issues created by pictures posted online to identify criminals: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->','Life Under Digits and Freedom','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-09 17:57:09','2019-05-09 16:57:09','',402,'http://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(409,5,'2019-05-09 17:57:29','2019-05-09 16:57:29','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Or the omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is the nature of the pictures recorded by the CCTV cameras?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Balancing fairness and proportionality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the same result could be achieved in a less intrusive way </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As example of issues created by pictures posted online to identify criminals: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->','Life Under Digits and Freedom','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-09 17:57:29','2019-05-09 16:57:29','',402,'https://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(411,5,'2019-05-09 18:03:18','2019-05-09 17:03:18','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is the nature of the pictures recorded by the CCTV cameras?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Balancing fairness and proportionality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the same result could be achieved in a less intrusive way </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As example of issues created by pictures posted online to identify criminals: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-09 18:03:18','2019-05-09 17:03:18','',402,'https://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(413,5,'2019-05-09 18:09:59','2019-05-09 17:09:59','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is the nature of the pictures recorded by the CCTV cameras?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Balancing fairness and proportionality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the same result could be achieved in a less intrusive way </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As example of issues created by pictures posted online to identify criminals:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-09 18:09:59','2019-05-09 17:09:59','',402,'https://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(414,5,'2019-05-09 18:12:19','2019-05-09 17:12:19','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is the nature of the pictures recorded by the CCTV cameras?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Balancing fairness and proportionality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the same result could be achieved in a less intrusive way </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As example of issues created by pictures posted online to identify criminals:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-09 18:12:19','2019-05-09 17:12:19','',402,'https://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(416,5,'2019-05-09 18:30:48','2019-05-09 17:30:48','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is the nature of the pictures recorded by the CCTV cameras?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Balancing fairness and proportionality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the same result could be achieved in a less intrusive way </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As example of issues created by pictures posted online to identify criminals:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-09 18:30:48','2019-05-09 17:30:48','',402,'https://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(418,5,'2019-05-09 18:41:15','2019-05-09 17:41:15','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is the nature of the pictures recorded by the CCTV cameras?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\" <a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\"> </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Balancing fairness and proportionality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the same result could be achieved in a less intrusive way </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As example of issues created by pictures posted online to identify criminals:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-09 18:41:15','2019-05-09 17:41:15','',402,'https://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(419,5,'2019-05-09 19:16:49','2019-05-09 18:16:49','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is the nature of the pictures recorded by the CCTV cameras?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Balancing fairness and proportionality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the same result could be achieved in a less intrusive way </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As example of issues created by pictures posted online to identify criminals:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-09 19:16:49','2019-05-09 18:16:49','',402,'https://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(421,5,'2019-05-09 19:19:32','2019-05-09 18:19:32','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What is the nature of the pictures recorded by the CCTV cameras?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'special category\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying racial or ethic origin, by the colour of the skin or any external religious sign, they should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Balancing fairness and proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>When the same result could be achieved in a less intrusive way </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. <a href=\"https://www.facebook.com/nicole.holt4\">N</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>As example of issues created by pictures posted online to identify criminals:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-09 19:19:32','2019-05-09 18:19:32','',402,'https://datarainbow.eu/2019/05/09/402-revision-v1/',0,'revision','',0),(423,5,'2019-05-10 15:35:31','2019-05-10 14:35:31','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What is the nature of the pictures recorded by the CCTV cameras?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'<em>special category</em>\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying an individual with its racial or ethic origin, by the colour of the skin or any external religious sign, these should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not noticing much improvement with the cameras, the management has now decided to name and shame the perpetrators. When public naming and shaming, they should be ready for this sort of out of control incidents <a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a> and therefore a burden to keep safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://securityboulevard.com/2019/05/smart-cities-and-smarter-hackers/amp/\">Smart cities and smarter hackers</a>. \'<em>Japan is planning a mass hackathon after passing legislation to prepare their citizens in advance of their 2020 Olympics. The company’s government plans to test the security of 200 Million IoT devices to create awareness of IoT security and its importance in the run up to the big event next year.</em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Balancing fairness and proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>When the same result could be achieved in a less intrusive way </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV Code of Conduct suggests other measures such as more lighting for a bette security. In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>As example of issues created by pictures posted online to identify criminals:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-10 15:35:31','2019-05-10 14:35:31','',402,'https://datarainbow.eu/2019/05/10/402-revision-v1/',0,'revision','',0),(426,5,'2019-05-30 13:46:55','2019-05-30 12:46:55','<!-- wp:image {\"id\":404} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/05/Cameras.jpg\" alt=\"\" class=\"wp-image-404\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Two new guidances, one by the <a href=\"https://t.co/iLfWe3PxTR\">Irish Data Protection commissionner</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and one by the <a href=\"https://ico.org.uk/for-organisations/in-your-sector/business/general-data-protection-regulation-gdpr-faqs-for-small-retailers?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=11692803-24bf-4164-9af2-1bd530eea6b7&amp;utm_content&amp;utm_campaign&amp;fbclid=IwAR03GMYAKvSjh92H8VC5mHW69dv7Ldll_GYaJ5KcVaz4RGlwwDvMEhL8sD8\">UK ICO.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What is the nature of the pictures recorded by the CCTV cameras?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'<em>special category</em>\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying an individual with its racial or ethic origin, by the colour of the skin or any external religious sign, these should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not noticing much improvement with the cameras, the management has now decided to name and shame the perpetrators. When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://securityboulevard.com/2019/05/smart-cities-and-smarter-hackers/amp/\">Smart cities and smarter hackers</a>. \'<em>Japan is planning a mass hackathon after passing legislation to prepare their citizens in advance of their 2020 Olympics. The company’s government plans to test the security of 200 Million IoT devices to create awareness of IoT security and its importance in the run up to the big event next year.</em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Balancing fairness and proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>When the same result could be achieved in a less intrusive way </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV Code of Conduct suggests other measures such as more lighting for a bette security. In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>As example of issues created by pictures posted online to identify criminals:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2019-05-30 13:46:55','2019-05-30 12:46:55','',402,'https://datarainbow.eu/2019/05/30/402-revision-v1/',0,'revision','',0),(428,5,'2019-06-16 15:31:46','2019-06-16 14:31:46','<!-- wp:paragraph -->\n<p>As a privacy and data protection advocate, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent request where applicable. The French Data Protection Authority, CNIL, has played a lead role in <a href=\"https://datarainbow.eu/2019/01/27/french-cnils-six-first-month-of-gdpr/\">clarifying the regulation</a>. The expectation would be that French websites would have benefited from the guidances produced, using the two years of preparation and the first year of GDPR application to comply. Sadly, this has not always been the case. Even pointing the issues to some web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular recognised expert, Allen Woods, retired today, kindly accepted to have a look to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting, data sharing with third parties not only via cookies but Java Script codes used by the web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers advising Data Protection compliance, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen the hidden JavaScript codes on the website \'represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered.\' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font but no analytics, we are looking to change this.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing how much users\' behaviour is tracked gives a tough burden and liability to website owners as data controller unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that comes out of users control tracking behaviour and location. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page. The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. A detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many web owners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’ has become an anti-trust issue of over grown corporations. GAFAM\'s seems to have become too big to any regulator to combat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing on all kind of websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, in <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can imagine the gathering of information on each individual internet user to profile their personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wish</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t anymore need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, not that long ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://policyreview.info/articles/news/data-subjects-data-controllers-fashionable-concept/1400\">On the expanding notion of data controller </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','publish','closed','closed','','websites-surreptitiously-tracking-and-reporting-on-visitors','','https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\nhttps://datarainbow.eu/2019/01/22/why-privacy-matters/\nhttps://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\nhttps://datarainbow.eu/2019/01/27/french-cnils-six-first-month-of-gdpr/','2020-05-20 16:19:07','2020-05-20 15:19:07','',0,'http://datarainbow.eu/?p=428',0,'post','',0),(429,5,'2019-06-16 14:47:39','2019-06-16 13:47:39','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection. We have previously wrote about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case.Even pointing these issues to the web owners has not had any effect. compliance with cookies laws should not be that not. a cookie banner based on opt in giving visitors the option of refusing the tracking. a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure the observations on websites were correct, we required few IT and security experts to double checks the reports found. One particular expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw a whole different light on the depth of tracking, profiling and fingerprinting to the benefit of third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>, the use, by second, third and fourth<br> parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and<br> therefore their owners, with a considerable degree of accuracy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Wood writes in his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name:<br> “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that \'this represents a multiple risk in that source<br>and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control trackings.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. An intrusion privacy regulation might find challenging to combat as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://Facebook users cannot avoid location-based ads, investigation finds\">Facebook users cannot avoid location-based ads, investigation finds. Facebook</a> users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. Read more <a href=\"https://fixad.tech/ad-tech-gdpr-complaint-is-extended-to-five-more-european-regulators/?fbclid=IwAR1Y0fdXrLeMQgjpER7KNqs80C_kKtXEVJQZA7Cl7YCCg8ZRVxnhOoW0sR4\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. Google\'s wishes is to know your needs before even yourself. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until a sickness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : dog Fitbit walker to simulate exercise to trick the insurance company. Would that be sufficient? probably not enough to hide actual sickness that the insurance would love to the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered why all that matters, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','','inherit','closed','closed','','428-revision-v1','','','2019-06-16 14:47:39','2019-06-16 13:47:39','',428,'https://datarainbow.eu/2019/06/16/428-revision-v1/',0,'revision','',0),(430,5,'2019-06-16 15:11:05','2019-06-16 14:11:05','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection. We have previously wrote about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case.Even pointing these issues to the web owners has not had any effect. compliance with cookies laws should not be that not. a cookie banner based on opt in giving visitors the option of refusing the tracking. a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure the observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw a whole different light on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and<br>therefore their owners, with a considerable degree of accuracy,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Wood then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that \'this represents a multiple risk in that source<br>and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://Facebook users cannot avoid location-based ads, investigation finds\">Facebook users cannot avoid location-based ads, investigation finds. Facebook</a> users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.     The new complaints have been filed by <a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a> (Eticas Foundation) and <a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a> (Finch), <a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a> (Bits of Freedom), <a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a> (University of Amsterdam), <a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a> (University of Leuven), and <a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a> (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\"> </a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a> and <a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before even yourself. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until a sickness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : dog Fitbit walker to simulate exercise to trick the insurance company. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company would love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered why all that matters, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','','inherit','closed','closed','','428-revision-v1','','','2019-06-16 15:11:05','2019-06-16 14:11:05','',428,'https://datarainbow.eu/2019/06/16/428-revision-v1/',0,'revision','',0),(431,5,'2019-06-16 15:31:46','2019-06-16 14:31:46','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection. We have previously wrote about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case.Even pointing these issues to the web owners has not had any effect. compliance with cookies laws should not be that not. a cookie banner based on opt in giving visitors the option of refusing the tracking. a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure the observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw a whole different light on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and<br>therefore their owners, with a considerable degree of accuracy,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Wood then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that \'this represents a multiple risk in that source<br>and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://Facebook users cannot avoid location-based ads, investigation finds\">Facebook users cannot avoid location-based ads, investigation finds. Facebook</a> users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.     The new complaints have been filed by <a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a> (Eticas Foundation) and <a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a> (Finch), <a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a> (Bits of Freedom), <a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a> (University of Amsterdam), <a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a> (University of Leuven), and <a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a> (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\"> </a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a> and <a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before even yourself. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until a sickness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company would love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered why all that matters, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','','inherit','closed','closed','','428-revision-v1','','','2019-06-16 15:31:46','2019-06-16 14:31:46','',428,'https://datarainbow.eu/2019/06/16/428-revision-v1/',0,'revision','',0),(433,5,'2019-06-16 15:33:39','2019-06-16 14:33:39','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection. We have previously wrote about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case.Even pointing these issues to the web owners has not had any effect. compliance with cookies laws should not be that not. a cookie banner based on opt in giving visitors the option of refusing the tracking. a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure the observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw a whole different light on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and<br>therefore their owners, with a considerable degree of accuracy,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Wood then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that \'this represents a multiple risk in that source<br>and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://Facebook users cannot avoid location-based ads, investigation finds\">Facebook users cannot avoid location-based ads, investigation finds. Facebook</a> users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before even yourself. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until a sickness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company would love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered why all that matters, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors\n','inherit','closed','closed','','428-revision-v1','','','2019-06-16 15:33:39','2019-06-16 14:33:39','',428,'https://datarainbow.eu/2019/06/16/428-revision-v1/',0,'revision','',0),(435,5,'2019-06-16 15:49:02','2019-06-16 14:49:02','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Wood then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a wordpress template, and uses Google\'s Guthenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing. <a href=\"http://Facebook users cannot avoid location-based ads, investigation finds\">Facebook users cannot avoid location-based ads, investigation finds. Facebook</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before even yourself. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until a sickness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company would love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered why all that matters, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors\n','inherit','closed','closed','','428-revision-v1','','','2019-06-16 15:49:02','2019-06-16 14:49:02','',428,'https://datarainbow.eu/2019/06/16/428-revision-v1/',0,'revision','',0),(437,5,'2019-06-16 15:51:59','2019-06-16 14:51:59','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Wood then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a wordpress template, and uses Google\'s Guthenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing. \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”<a href=\"http://Facebook users cannot avoid location-based ads, investigation finds\">Facebook users cannot avoid location-based ads, investigation finds. Facebook</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before even yourself. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until a sickness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company would love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered why all that matters, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors\n','inherit','closed','closed','','428-revision-v1','','','2019-06-16 15:51:59','2019-06-16 14:51:59','',428,'https://datarainbow.eu/2019/06/16/428-revision-v1/',0,'revision','',0),(439,5,'2019-06-16 15:53:40','2019-06-16 14:53:40','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Wood then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a wordpress template, and uses Google\'s Guthenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook </a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before even yourself. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until a sickness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company would love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered why all that matters, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors\n','inherit','closed','closed','','428-revision-v1','','','2019-06-16 15:53:40','2019-06-16 14:53:40','',428,'https://datarainbow.eu/2019/06/16/428-revision-v1/',0,'revision','',0),(441,5,'2019-06-16 15:58:05','2019-06-16 14:58:05','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Wood then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a wordpress template, and uses Google\'s Guthenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook </a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors\n','inherit','closed','closed','','428-revision-v1','','','2019-06-16 15:58:05','2019-06-16 14:58:05','',428,'https://datarainbow.eu/2019/06/16/428-revision-v1/',0,'revision','',0),(442,5,'2019-06-16 16:18:49','2019-06-16 15:18:49','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Wood then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a wordpress template, and uses Google\'s Guthenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors\n','inherit','closed','closed','','428-revision-v1','','','2019-06-16 16:18:49','2019-06-16 15:18:49','',428,'https://datarainbow.eu/2019/06/16/428-revision-v1/',0,'revision','',0),(444,5,'2019-06-17 07:02:07','2019-06-17 06:02:07','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Wood, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analyse threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a wordpress template, and uses Google\'s Guthenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a real certification assuring web developers real competences and no simply a \'lego block\' assembler expert. Increasingly web developper use templates such as Wordpress that come out of users control tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2019-06-17 07:02:07','2019-06-17 06:02:07','',428,'http://datarainbow.eu/2019/06/17/428-revision-v1/',0,'revision','',0),(446,5,'2019-06-17 08:02:08','2019-06-17 07:02:08','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Woods, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Guthenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that come out of users control tracking. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page.The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. a detailed picture of users is build to target advertising to users. ECJ in the Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many webowners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further read : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2019-06-17 08:02:08','2019-06-17 07:02:08','',428,'https://datarainbow.eu/2019/06/17/428-revision-v1/',0,'revision','',0),(447,5,'2019-06-17 08:54:01','2019-06-17 07:54:01','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Woods, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Guthenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that come out of users control tracking. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page.The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. a detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many webowners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2019-06-17 08:54:01','2019-06-17 07:54:01','',428,'https://datarainbow.eu/2019/06/17/428-revision-v1/',0,'revision','',0),(448,5,'2019-06-17 09:06:01','2019-06-17 08:06:01','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Woods, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that come out of users control tracking. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page.The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. a detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many webowners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishes</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2019-06-17 09:06:01','2019-06-17 08:06:01','',428,'https://datarainbow.eu/2019/06/17/428-revision-v1/',0,'revision','',0),(450,5,'2019-06-17 09:10:18','2019-06-17 08:10:18','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Woods, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that come out of users control tracking. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page.The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. a detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many webowners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, in <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishe</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t anymore need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2019-06-17 09:10:18','2019-06-17 08:10:18','',428,'https://datarainbow.eu/2019/06/17/428-revision-v1/',0,'revision','',0),(452,5,'2019-06-17 09:18:26','2019-06-17 08:18:26','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular well recognised expert, Allen Woods, accepted to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that come out of users control tracking. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page.The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. a detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many webowners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, in <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishe</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t anymore need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://policyreview.info/articles/news/data-subjects-data-controllers-fashionable-concept/1400\">On the expanding notion of data controller </a></p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2019-06-17 09:18:26','2019-06-17 08:18:26','',428,'https://datarainbow.eu/2019/06/17/428-revision-v1/',0,'revision','',0),(454,5,'2019-06-17 09:29:26','2019-06-17 08:29:26','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent where applicable. The CNIL has played a lead role in clarifying the regulation. The expectation would be that French websites would have benefited from the guidances produced, the two years of preparation and the first year of GDPR application to comply. Sadly, this has not been the case. Even pointing these issues to the web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular recognised expert, Allen Woods, retired today, kindly accepted to have a look to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting data sharing with third parties not only via cookies but Java Script codes used by web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen \'this represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered. \' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font we are looking to change.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This gives a tough burden and liability as data controller to website owners unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that come out of users control tracking. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page.The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. a detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many webowners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’s more an anti-trust issue of over grown corporations. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, in <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can legitimately imagine the gathering of information on each individual internet user, used to profile the personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wishe</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t anymore need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, a history not that far ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://policyreview.info/articles/news/data-subjects-data-controllers-fashionable-concept/1400\">On the expanding notion of data controller </a></p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2019-06-17 09:29:26','2019-06-17 08:29:26','',428,'https://datarainbow.eu/2019/06/17/428-revision-v1/',0,'revision','',0),(457,5,'2019-06-28 07:49:34','2019-06-28 06:49:34','<!-- wp:paragraph -->\n<p>As a privacy and data protection legal advisor, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent request where applicable. The French Data Protection Authority, CNIL, has played a lead role in <a href=\"https://datarainbow.eu/2019/01/27/french-cnils-six-first-month-of-gdpr/\">clarifying the regulation</a>. The expectation would be that French websites would have benefited from the guidances produced, using the two years of preparation and the first year of GDPR application to comply. Sadly, this has not always been the case. Even pointing the issues to some web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular recognised expert, Allen Woods, retired today, kindly accepted to have a look to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting, data sharing with third parties not only via cookies but Java Script codes used by the web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers advising Data Protection compliance, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen the hidden JavaScript codes on the website \'represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered.\' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font but no analytics, we are looking to change this.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing how much users\' behaviour is tracked gives a tough burden and liability to website owners as data controller unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that comes out of users control tracking behaviour and location. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page. The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. A detailed picture of users is build to target advertising to users. ECJ in the Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many web owners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’ has become an anti-trust issue of over grown corporations. GAFAM\'s seems to have become too big to any regulator to combat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook </a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing on all kind of websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, in <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can imagine the gathering of information on each individual internet user to profile their personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wish</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t anymore need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, not that long ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://policyreview.info/articles/news/data-subjects-data-controllers-fashionable-concept/1400\">On the expanding notion of data controller </a></p>\n<!-- /wp:paragraph -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2019-06-28 07:49:34','2019-06-28 06:49:34','',428,'https://datarainbow.eu/2019/06/28/428-revision-v1/',0,'revision','',0),(458,5,'2019-07-03 08:59:58','2019-07-03 07:59:58','<!-- wp:paragraph -->\n<p>Sharing Stewart Room\'s Privacy insights with his authorisation. Stewart Room is Partner at PwC UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top reasons to cherish concepts of </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23privacy\"><strong>privacy</strong></a>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Discovery and development</em>: we need a private place to develop and grow, to experiment and to find out who we are. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Happiness</em>: our relationships with one another require a private place to kindle, to sustain, for love. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Sanctuary</em>: a private place is a refuge from persecution, intolerance, abuse and harm. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Disagreement, dissent</em>: sometimes people need to resist or fight back against dictators, demagogues and dystopian potentials, for which privacy is essential. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Trust in tech</em>: amazing tech innovations have the capacity to change the world for the good, but not without privacy trust and confidence. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Consumer protection</em>: personal data fuels business and public services, but its our data, not theirs, so privacy rules protect us from abusive practices. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Reputation</em>: respecting privacy enhances reputations, from policing, to the workplace, to online activities and everything in between. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Business purpose</em>: creating and sustaining economic value for the long term can’t be divorced from the need to respect privacy.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Our values</em>: privacy is a fundamental right in a democratic society, upon which everything stands or falls, so it’s a differentiator between what we value and what we would dread to become.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top reasons why </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23Data_Protection\"><strong>Data_Protection</strong></a><strong> programmes fail to deliver: </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Purpose</em>: if an organisation doesn’t understand why a good approach to DP is integral to its purpose, how can we expect good outcomes? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Tone from the top</em>: leadership is everything, but if the Board won’t lead on DP, what’s there to follow? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Skills</em>: DP needs a multi-disciplinary team to deliver, so if key skills are lacking, problems will embed. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Silos</em>: silos mean behavioural, virtual and physical barriers standing in the way of DP success. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Vision</em>: yes, DP is a legal topic, but in the real world it needs more than a legalistic vision.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Narrow and shallow transformation</em>: DP needs to be delivered in all layers of the organisation, covering paper, people, tech and data, so change needs to be broad and deep. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Technology Reference Architecture</em>: a comprehensive approach needs a TRA, so if you haven’t got one, don’t be surprised by DP failure. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Special Characteristics</em>: buying off the peg is ok at times, but DP needs ‘made to measure’ solutions, knowing the factors that make your organisation unique. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Adverse Scrutiny</em>: DP needs to survive adversity, so ignoring your risks is a recipe for disaster.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>People</em>: the main concern of DP is people and if you forget that, you’ve got nothing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top things that make </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23privacy\"><strong>#privacy</strong></a><strong> professionals sigh</strong>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♂️ <em>New oil</em>: sorry, personal data isn’t oil, or some other kind of commodity that can be owned then exploited and until you understand that, you just won’t understand anything about privacy, period. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>GDPR is done</em>: GDPR has barely started, so get real and stick with the programme, because there’s a 50 year history here and its not going away. ?‍♂️ Privacy activists are a pain: if they are, then power to them, because they do a good job and we need them. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>X owns privacy</em>: no, everyone owns privacy. ?‍♂️ Decades of experience: really, tell us about it.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>Security or privacy</em>: a false dichotomy, a mantra for a surveillance society or police state. ?‍♂️ Security is privacy: nope, still wrong, keep trying. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>They’re jumping on the bandwagon</em>: hey, this is a community and everyone is welcome, so lend them a hand. ?‍♂️ Consent is best: yes, consent is important, but it’s not the only route to lawfulness and certainly not the best or appropriate route in all circumstances. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>Leading privacy expert:</em> it’s not yours to claim, but for others to think. ?‍♂️ Privacy stymies innovation and competitiveness: ok, prove it. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>We need fines</em>: we don’t, we need a change of mindset.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BECAUSE <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">PRIVACY MATTERS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Privacy Insights by Stewart Room','','publish','closed','closed','','privacy-insights-by-stewart-room','','\nhttps://datarainbow.eu/2019/01/22/why-privacy-matters/','2019-07-03 09:00:01','2019-07-03 08:00:01','',0,'http://datarainbow.eu/?p=458',0,'post','',0),(459,5,'2019-07-03 08:59:58','2019-07-03 07:59:58','<!-- wp:paragraph -->\n<p>Sharing Stewart Room\'s Privacy insights with his authorisation. Stewart Room is Partner at PwC UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top reasons to cherish concepts of </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23privacy\"><strong>privacy</strong></a>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Discovery and development</em>: we need a private place to develop and grow, to experiment and to find out who we are. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Happiness</em>: our relationships with one another require a private place to kindle, to sustain, for love. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Sanctuary</em>: a private place is a refuge from persecution, intolerance, abuse and harm. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Disagreement, dissent</em>: sometimes people need to resist or fight back against dictators, demagogues and dystopian potentials, for which privacy is essential. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Trust in tech</em>: amazing tech innovations have the capacity to change the world for the good, but not without privacy trust and confidence. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Consumer protection</em>: personal data fuels business and public services, but its our data, not theirs, so privacy rules protect us from abusive practices. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Reputation</em>: respecting privacy enhances reputations, from policing, to the workplace, to online activities and everything in between. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Business purpose</em>: creating and sustaining economic value for the long term can’t be divorced from the need to respect privacy.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Our values</em>: privacy is a fundamental right in a democratic society, upon which everything stands or falls, so it’s a differentiator between what we value and what we would dread to become.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top reasons why </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23Data_Protection\"><strong>Data_Protection</strong></a><strong> programmes fail to deliver: </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Purpose</em>: if an organisation doesn’t understand why a good approach to DP is integral to its purpose, how can we expect good outcomes? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Tone from the top</em>: leadership is everything, but if the Board won’t lead on DP, what’s there to follow? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Skills</em>: DP needs a multi-disciplinary team to deliver, so if key skills are lacking, problems will embed. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Silos</em>: silos mean behavioural, virtual and physical barriers standing in the way of DP success. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Vision</em>: yes, DP is a legal topic, but in the real world it needs more than a legalistic vision.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Narrow and shallow transformation</em>: DP needs to be delivered in all layers of the organisation, covering paper, people, tech and data, so change needs to be broad and deep. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Technology Reference Architecture</em>: a comprehensive approach needs a TRA, so if you haven’t got one, don’t be surprised by DP failure. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Special Characteristics</em>: buying off the peg is ok at times, but DP needs ‘made to measure’ solutions, knowing the factors that make your organisation unique. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Adverse Scrutiny</em>: DP needs to survive adversity, so ignoring your risks is a recipe for disaster.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>People</em>: the main concern of DP is people and if you forget that, you’ve got nothing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top things that make </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23privacy\"><strong>#privacy</strong></a><strong> professionals sigh</strong>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♂️ <em>New oil</em>: sorry, personal data isn’t oil, or some other kind of commodity that can be owned then exploited and until you understand that, you just won’t understand anything about privacy, period. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>GDPR is done</em>: GDPR has barely started, so get real and stick with the programme, because there’s a 50 year history here and its not going away. ?‍♂️ Privacy activists are a pain: if they are, then power to them, because they do a good job and we need them. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>X owns privacy</em>: no, everyone owns privacy. ?‍♂️ Decades of experience: really, tell us about it.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>Security or privacy</em>: a false dichotomy, a mantra for a surveillance society or police state. ?‍♂️ Security is privacy: nope, still wrong, keep trying. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>They’re jumping on the bandwagon</em>: hey, this is a community and everyone is welcome, so lend them a hand. ?‍♂️ Consent is best: yes, consent is important, but it’s not the only route to lawfulness and certainly not the best or appropriate route in all circumstances. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>Leading privacy expert:</em> it’s not yours to claim, but for others to think. ?‍♂️ Privacy stymies innovation and competitiveness: ok, prove it. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>We need fines</em>: we don’t, we need a change of mindset.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BECAUSE <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">PRIVACY MATTERS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Privacy Insights by Stewart Room','','inherit','closed','closed','','458-revision-v1','','','2019-07-03 08:59:58','2019-07-03 07:59:58','',458,'https://datarainbow.eu/2019/07/03/458-revision-v1/',0,'revision','',0),(462,5,'2019-07-10 14:53:55','2019-07-10 13:53:55','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been said and complained about data protection regulations. Lots of criticism, its cost, resources consumption, business killer,….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What\'s been forgotten is that the&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\">General Data Protection Regulation (GDPR)</a>&nbsp;is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a&nbsp;<a rel=\"noreferrer noopener\" href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\">Fundamental Human Right</a>, for dignity and freedom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The equation is simple : Privacy = Transparency + Control</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights and freedom of data subjects with respect to the interest of the business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Before the GDPR, data protection directive lacked uniformity and the necessary certainty throughout the EU. The new Regulation is based on harmonisation and the&nbsp;<a href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\" rel=\"noreferrer noopener\">European Data Protection Board (EDPB)</a>&nbsp;is the authority in charge of the&nbsp;<a href=\"https://gdpr-info.eu/art-63-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">consistency mechanism - Article 63</a>&nbsp;- to make sure the regulation and its enforcement are harmoniously applied by all national Data Protection Authorities (DPAs).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One of the more pro-active DPAs has been the French&nbsp;<a href=\"https://www.cnil.fr/en/home\" target=\"_blank\" rel=\"noreferrer noopener\">Commission Nationale de l\'Informatique et des Libertes (CNIL)</a>&nbsp;producing many guidelines in both French and English, including a very useful&nbsp;<a href=\"https://www.cnil.fr/en/pia-software-20-available-and-growth-pia-ecosystem\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy Impact Assessment (PIA) tool</a>. So, I would like to think French companies have benefited from all necessary guidances to comply after two years period of preparation and 6 months after the GDPR entered into effect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In two previous article, I wrote about the&nbsp;<a href=\"https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">CNIL’s report after 6 months of activities</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">some of their main cases.</a>&nbsp;While The UK ICO has been more focusing on fining nuisance calls and clarifying data subject\'s access after investigating Facebook Analytica case, The French CNIL focus has been :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clarifying criteria of consent in four cases of Mobile App data collection,</li><li>clarifying CCTV monitoring and biometrics in work place</li><li>clarifying cookie compliance.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>What are cookies?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Better than me,&nbsp;<a href=\"https://termly.io/resources/articles/cookies-comprehensive-guide/\" target=\"_blank\" rel=\"noreferrer noopener\">KJ Kearie has a Comprehensive Guide&nbsp;</a>on cookies, I recommend you read.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A cookie is&nbsp;<a href=\"https://www.theguardian.com/technology/2012/apr/23/cookies-and-web-tracking-intro\" target=\"_blank\" rel=\"noreferrer noopener\">a tiny bit of plain text</a>&nbsp;that a website downloads to a computer when that user’s browser opens a new webpage. They are used to remember useful pieces of data from the users they encounter, acting as an<strong>invisible liaison between a domain’s owner and visitors</strong>.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>A cookie can identify both the user and the browser, and can be left on the user’s device indefinitely. When the user’s browser returns to that website, the cookie connects with the domain and shares with it the data it has collected or stored about that user.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>There are two main types of cookies –&nbsp;<a href=\"http://www.allaboutcookies.org/cookies/session-cookies-used-for.html\" target=\"_blank\" rel=\"noreferrer noopener\">session cookies</a>&nbsp;only collect details from a single browsing sessions, while&nbsp;<a href=\"https://www.techopedia.com/definition/4901/persistent-cookie\" target=\"_blank\" rel=\"noreferrer noopener\">persistent cookies</a>remain on the user’s device and collect information over time.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In terms of functionality, some cookies aim to a better browsing experience such as remembering the language of their visitor, others, more pernicious, track the users habits, profiling users for targeted advertising. Data collected has fuelled a huge business of data brokage raising privacy and security concerns. In November,&nbsp;<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy International</a>, the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-and\" target=\"_blank\" rel=\"noreferrer noopener\">complaints</a>&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you think online tracking and profiling are legitimate? Watch&nbsp;<a href=\"https://www.youtube.com/watch?v=xYZtHIPktQg&amp;feature=youtu.be\" target=\"_blank\" rel=\"noreferrer noopener\">this video</a>&nbsp;it\'s eloquent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Online customers deserve the same privacy as offline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookie law, known as the ePrivacy Directive, has long been misunderstood. It is not a useless banner asking you to confirm you agree for your personal data to be collected in order to access the website. Just in case, you have forgotten, an IP address or any identifiable information is considered a personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are website owners duties exactly ?</strong>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To provide clear transparency to inform their visitors about the personal data they collect, how long it is kept, with whom they share the data and data subjects rights of access, right to delete, amend or the right of portability. These informations should be provided at the time of data collection, made accessible on each webpage, in clear language.&nbsp;<a href=\"https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227\" target=\"_blank\" rel=\"noreferrer noopener\">The WP art 29&nbsp;</a>requires that</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Every organisation that maintains a website should publish a privacy statement/ notice on the website. A link to this privacy statement/ notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible. “</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:list -->\n<ul><li>it must be concise, transparent, intelligible and easily accessible (Article 12.1);</li><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In short, a privacy notice is required to provide “<em>Concise, transparent, intelligible and easily accessible</em>” information about the data collected from visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alined with the WP guidance, the&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">French DPA CNIL</a>&nbsp;has required clear information for visitors, and for non exclusively technical cookies, consent is required. AND - that is very important - opting out of cookie tracking should not be detrimental to the use of the service. This goes with the clear position of the Working Party Art 29, replaced by the EDPB.&nbsp;For more on Privacy by Design, you might want to follow&nbsp;<a href=\"https://www.ryerson.ca/pbdce/about/ann-cavoukian/\" target=\"_blank\" rel=\"noreferrer noopener\">Ann Cavoukian</a>, Leading the Privacy by Design Centre of Excellence at Ryerson University.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So, remember, privacy = transparency + control. that means an obligation to tell visitors what is collected, with whom is shared, users rights and clear opt out.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite all clear guidance, too many websites are non compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You’d expect lawyers would have it right, for being well aware of the regulation. The French association of lawyers, the CNB, has done a good job informing their members by producing ample&nbsp;<a href=\"https://www.cnb.avocat.fr/sites/default/files/documents/guide_rgpd_avocats-2018.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>&nbsp;to follow.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally law firms handle sensitive data of clients, so they should be the ones showing the good example.&nbsp;<a href=\"https://twitter.com/clarinette02/status/1071025796767236097\" target=\"_blank\" rel=\"noreferrer noopener\">Recently</a>, I have looked at&nbsp;<a href=\"http://www.cbbc-avocats.com/cbbc/lequipe\" target=\"_blank\" rel=\"noreferrer noopener\">few websites</a>&nbsp;from some of&nbsp;<a href=\"http://www.hleclerc-avocats.fr/alain-weber\" target=\"_blank\" rel=\"noreferrer noopener\">the top law firms</a>&nbsp;in Paris. It is outraging to see they are mostly ignoring their obligations. Lack of information about cookies, no privacy notice or insufficient information. Too many are even&nbsp;<a href=\"https://www.theverge.com/2018/7/24/17603126/google-chrome-unencrypted-not-secure\" target=\"_blank\" rel=\"noreferrer noopener\">tagged as ‘Not Secure’ by Google Chrome web browser&nbsp;</a>lacking encryption. [This is when the lock does not show next to the URL ‘http’ instead of https. unencrypted transmission means that data can be intercepted.] Some of the websites I visited have visitors contact forms or candidates applications online with CV upload.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I raised the issue few weeks ago, two of the law firms amended the security certification to https. One specialised DPO did not considered a cookie banner or&nbsp;<a href=\"http://www.jacobavocats.com/mentions-legales/\" target=\"_blank\" rel=\"noreferrer noopener\">more comprehensive privacy notice was needed</a>. It is painful to see members of the law society or big law firms could have so little consideration for privacy and data protection of clients and web visitors. I see too many exchange documents via un-encrypted email attachments. These big law firms have opulent clients around the world including outside the EU. How do they comply with data flow regulation to countries of non adequate data protection, not just China, that includes the USA as well. I have brought the CNIL\'s attention to this issue. Knowing that a website is the vitrine of a business, it worth the effort.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Data breach has been on everyday news. Have you heard of&nbsp;<a href=\"https://www.forbes.com/sites/davidvolodzko/2018/12/04/marriott-breach-exposes-far-more-than-just-data/\" target=\"_blank\" rel=\"noreferrer noopener\">Marriott hotels breach</a>&nbsp;gone undetected for four years?&nbsp;<a href=\"https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/\" target=\"_blank\" rel=\"noreferrer noopener\">Air Canada</a>, British Airways, Cathay Pacific, Yahoo, Equifax,,.... and many more. Fines will not give back data subjects\' hassle when dealing with ID theft or financial misuse.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s not anymore IF but WHEN.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any data collection creates data breach risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I invite you to read&nbsp;<a href=\"https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Memory, Forgetfulness and Delete</a>&nbsp;because Privacy matters to us all,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and from&nbsp;<a href=\"https://blog.usejournal.com/is-your-web-site-breaking-eu-law-7e5b7eb33d5d?fbclid=IwAR3n5duN22qnmVk_he_EHxsg2JQA2DCeCzAzoTk9AUBUWlUvV8h4k75FoBg\" target=\"_blank\" rel=\"noreferrer noopener\">Alexander Hanff&nbsp;</a>: \"<em>Your consent notice should provide a list of all of these assets (unless covered by the “strictly necessary” exception) and provide the option for the data to refuse the loading of any or all of these assets.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Connected read&nbsp;<a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Law&nbsp;</a>Firm Internet Security and Data Protection</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Firms Data Security</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Follow ongoing&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\">Pearltrees curation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE : Google-Style GDPR Fines for Everyone? <a href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\">Bavarian DPA </a>Conducts Website Cookie Practices Sweep, Announces Fines under Consideration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The Bavarian DPA audited 40 “large websites”. The companies audited were from the following industries</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a) Online retail ; (b) Sports; (c) Banking &amp; insurance; (d) Media; (e) Automotive &amp; electronics; (f) Home and residential; and (g) Other.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>•&nbsp;<em> The sweep revealed that&nbsp;all 40&nbsp;websites had integrated cookies or other “tracking tools”. While the Bavarian DPA leaves the term “tracking tools” largely undefined, it indicates they are provided by third parties and result in data being sent to these third party providers, such as pixels, beacons, or the like.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The Bavarian DPA found that&nbsp;none&nbsp;of the 40 websites’ cookie practices were GDPR-compliant. It found the following violations</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Websites lacked the transparency needed for “informed” cookie consent</em></strong><em>. </em></li><li><strong><em>No “prior” consent was collected from users</em></strong><em>. </em></li><li><strong><em>The consent obtained was not sufficiently “active”</em>.</strong>&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>The Bavarian DPA announced it was considering GDPR fines for the website operators.\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In July 2019, the UK ICO published a new guidance on the use of cookies after admitting <a href=\"https://www.itpro.co.uk/general-data-protection-regulation-gdpr/33850/ico-admits-its-own-cookie-policy-is-non-compliant-with\">its own website was not compliant</a>. Read more <a href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=7704459a-682b-4360-83e2-195bbba3a4c6&amp;utm_content=&amp;utm_campaign=\">here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The French CNIL tweeted : \"The legal framework relating to consent has evolved, and so does the website of the CNIL. On <a rel=\"noreferrer noopener\" href=\"https://t.co/R3uTY6ghS5\" target=\"_blank\">http://cnil.fr </a>, no more tracking devices are deposited, as long as the user has not given his active consent\" with the following <a href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\">link</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following \"Online targeted advertisement: what action plan for the CNIL_en ?\" <a href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Website transparency : Cookies and privacy notice','The General Data Protection Regulation (GDPR) is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a Fundamental Human Right, for dignity and freedom.','inherit','closed','closed','','26-revision-v1','','','2019-07-10 14:53:55','2019-07-10 13:53:55','',26,'https://datarainbow.eu/2019/07/10/26-revision-v1/',0,'revision','',0),(464,5,'2019-07-10 14:55:19','2019-07-10 13:55:19','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been said and complained about data protection regulations. Lots of criticism, its cost, resources consumption, business killer,….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What\'s been forgotten is that the&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\">General Data Protection Regulation (GDPR)</a>&nbsp;is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a&nbsp;<a rel=\"noreferrer noopener\" href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\">Fundamental Human Right</a>, for dignity and freedom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The equation is simple : Privacy = Transparency + Control</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights and freedom of data subjects with respect to the interest of the business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Before the GDPR, data protection directive lacked uniformity and the necessary certainty throughout the EU. The new Regulation is based on harmonisation and the&nbsp;<a href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\" rel=\"noreferrer noopener\">European Data Protection Board (EDPB)</a>&nbsp;is the authority in charge of the&nbsp;<a href=\"https://gdpr-info.eu/art-63-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">consistency mechanism - Article 63</a>&nbsp;- to make sure the regulation and its enforcement are harmoniously applied by all national Data Protection Authorities (DPAs).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One of the more pro-active DPAs has been the French&nbsp;<a href=\"https://www.cnil.fr/en/home\" target=\"_blank\" rel=\"noreferrer noopener\">Commission Nationale de l\'Informatique et des Libertes (CNIL)</a>&nbsp;producing many guidelines in both French and English, including a very useful&nbsp;<a href=\"https://www.cnil.fr/en/pia-software-20-available-and-growth-pia-ecosystem\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy Impact Assessment (PIA) tool</a>. So, I would like to think French companies have benefited from all necessary guidances to comply after two years period of preparation and 6 months after the GDPR entered into effect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In two previous article, I wrote about the&nbsp;<a href=\"https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">CNIL’s report after 6 months of activities</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">some of their main cases.</a>&nbsp;While The UK ICO has been more focusing on fining nuisance calls and clarifying data subject\'s access after investigating Facebook Analytica case, The French CNIL focus has been :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clarifying criteria of consent in four cases of Mobile App data collection,</li><li>clarifying CCTV monitoring and biometrics in work place</li><li>clarifying cookie compliance.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>What are cookies?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Better than me,&nbsp;<a href=\"https://termly.io/resources/articles/cookies-comprehensive-guide/\" target=\"_blank\" rel=\"noreferrer noopener\">KJ Kearie has a Comprehensive Guide&nbsp;</a>on cookies, I recommend you read.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A cookie is&nbsp;<a href=\"https://www.theguardian.com/technology/2012/apr/23/cookies-and-web-tracking-intro\" target=\"_blank\" rel=\"noreferrer noopener\">a tiny bit of plain text</a>&nbsp;that a website downloads to a computer when that user’s browser opens a new webpage. They are used to remember useful pieces of data from the users they encounter, acting as an<strong>invisible liaison between a domain’s owner and visitors</strong>.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>A cookie can identify both the user and the browser, and can be left on the user’s device indefinitely. When the user’s browser returns to that website, the cookie connects with the domain and shares with it the data it has collected or stored about that user.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>There are two main types of cookies –&nbsp;<a href=\"http://www.allaboutcookies.org/cookies/session-cookies-used-for.html\" target=\"_blank\" rel=\"noreferrer noopener\">session cookies</a>&nbsp;only collect details from a single browsing sessions, while&nbsp;<a href=\"https://www.techopedia.com/definition/4901/persistent-cookie\" target=\"_blank\" rel=\"noreferrer noopener\">persistent cookies</a>remain on the user’s device and collect information over time.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In terms of functionality, some cookies aim to a better browsing experience such as remembering the language of their visitor, others, more pernicious, track the users habits, profiling users for targeted advertising. Data collected has fuelled a huge business of data brokage raising privacy and security concerns. In November,&nbsp;<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy International</a>, the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-and\" target=\"_blank\" rel=\"noreferrer noopener\">complaints</a>&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you think online tracking and profiling are legitimate? Watch&nbsp;<a href=\"https://www.youtube.com/watch?v=xYZtHIPktQg&amp;feature=youtu.be\" target=\"_blank\" rel=\"noreferrer noopener\">this video</a>&nbsp;it\'s eloquent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Online customers deserve the same privacy as offline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookie law, known as the ePrivacy Directive, has long been misunderstood. It is not a useless banner asking you to confirm you agree for your personal data to be collected in order to access the website. Just in case, you have forgotten, an IP address or any identifiable information is considered a personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are website owners duties exactly ?</strong>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To provide clear transparency to inform their visitors about the personal data they collect, how long it is kept, with whom they share the data and data subjects rights of access, right to delete, amend or the right of portability. These informations should be provided at the time of data collection, made accessible on each webpage, in clear language.&nbsp;<a href=\"https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227\" target=\"_blank\" rel=\"noreferrer noopener\">The WP art 29&nbsp;</a>requires that</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Every organisation that maintains a website should publish a privacy statement/ notice on the website. A link to this privacy statement/ notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible. “</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:list -->\n<ul><li>it must be concise, transparent, intelligible and easily accessible (Article 12.1);</li><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In short, a privacy notice is required to provide “<em>Concise, transparent, intelligible and easily accessible</em>” information about the data collected from visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alined with the WP guidance, the&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">French DPA CNIL</a>&nbsp;has required clear information for visitors, and for non exclusively technical cookies, consent is required. AND - that is very important - opting out of cookie tracking should not be detrimental to the use of the service. This goes with the clear position of the Working Party Art 29, replaced by the EDPB.&nbsp;For more on Privacy by Design, you might want to follow&nbsp;<a href=\"https://www.ryerson.ca/pbdce/about/ann-cavoukian/\" target=\"_blank\" rel=\"noreferrer noopener\">Ann Cavoukian</a>, Leading the Privacy by Design Centre of Excellence at Ryerson University.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So, remember, privacy = transparency + control. that means an obligation to tell visitors what is collected, with whom is shared, users rights and clear opt out.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite all clear guidance, too many websites are non compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You’d expect lawyers would have it right, for being well aware of the regulation. The French association of lawyers, the CNB, has done a good job informing their members by producing ample&nbsp;<a href=\"https://www.cnb.avocat.fr/sites/default/files/documents/guide_rgpd_avocats-2018.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>&nbsp;to follow.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally law firms handle sensitive data of clients, so they should be the ones showing the good example.&nbsp;<a href=\"https://twitter.com/clarinette02/status/1071025796767236097\" target=\"_blank\" rel=\"noreferrer noopener\">Recently</a>, I have looked at&nbsp;<a href=\"http://www.cbbc-avocats.com/cbbc/lequipe\" target=\"_blank\" rel=\"noreferrer noopener\">few websites</a>&nbsp;from some of&nbsp;<a href=\"http://www.hleclerc-avocats.fr/alain-weber\" target=\"_blank\" rel=\"noreferrer noopener\">the top law firms</a>&nbsp;in Paris. It is outraging to see they are mostly ignoring their obligations. Lack of information about cookies, no privacy notice or insufficient information. Too many are even&nbsp;<a href=\"https://www.theverge.com/2018/7/24/17603126/google-chrome-unencrypted-not-secure\" target=\"_blank\" rel=\"noreferrer noopener\">tagged as ‘Not Secure’ by Google Chrome web browser&nbsp;</a>lacking encryption. [This is when the lock does not show next to the URL ‘http’ instead of https. unencrypted transmission means that data can be intercepted.] Some of the websites I visited have visitors contact forms or candidates applications online with CV upload.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I raised the issue few weeks ago, two of the law firms amended the security certification to https. One specialised DPO did not considered a cookie banner or&nbsp;<a href=\"http://www.jacobavocats.com/mentions-legales/\" target=\"_blank\" rel=\"noreferrer noopener\">more comprehensive privacy notice was needed</a>. It is painful to see members of the law society or big law firms could have so little consideration for privacy and data protection of clients and web visitors. I see too many exchange documents via un-encrypted email attachments. These big law firms have opulent clients around the world including outside the EU. How do they comply with data flow regulation to countries of non adequate data protection, not just China, that includes the USA as well. I have brought the CNIL\'s attention to this issue. Knowing that a website is the vitrine of a business, it worth the effort.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Data breach has been on everyday news. Have you heard of&nbsp;<a href=\"https://www.forbes.com/sites/davidvolodzko/2018/12/04/marriott-breach-exposes-far-more-than-just-data/\" target=\"_blank\" rel=\"noreferrer noopener\">Marriott hotels breach</a>&nbsp;gone undetected for four years?&nbsp;<a href=\"https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/\" target=\"_blank\" rel=\"noreferrer noopener\">Air Canada</a>, British Airways, Cathay Pacific, Yahoo, Equifax,,.... and many more. Fines will not give back data subjects\' hassle when dealing with ID theft or financial misuse.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s not anymore IF but WHEN.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any data collection creates data breach risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I invite you to read&nbsp;<a href=\"https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Memory, Forgetfulness and Delete</a>&nbsp;because Privacy matters to us all,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and from&nbsp;<a href=\"https://blog.usejournal.com/is-your-web-site-breaking-eu-law-7e5b7eb33d5d?fbclid=IwAR3n5duN22qnmVk_he_EHxsg2JQA2DCeCzAzoTk9AUBUWlUvV8h4k75FoBg\" target=\"_blank\" rel=\"noreferrer noopener\">Alexander Hanff&nbsp;</a>: \"<em>Your consent notice should provide a list of all of these assets (unless covered by the “strictly necessary” exception) and provide the option for the data to refuse the loading of any or all of these assets.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Connected read&nbsp;<a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Law&nbsp;</a>Firm Internet Security and Data Protection</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Firms Data Security</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Follow ongoing&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\">Pearltrees curation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE : Google-Style GDPR Fines for Everyone? <a href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\">Bavarian DPA </a>Conducts Website Cookie Practices Sweep, Announces Fines under Consideration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The Bavarian DPA audited 40 “large websites”. The companies audited were from the following industries</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a) Online retail ; (b) Sports; (c) Banking &amp; insurance; (d) Media; (e) Automotive &amp; electronics; (f) Home and residential; and (g) Other.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>•&nbsp;<em> The sweep revealed that&nbsp;all 40&nbsp;websites had integrated cookies or other “tracking tools”. While the Bavarian DPA leaves the term “tracking tools” largely undefined, it indicates they are provided by third parties and result in data being sent to these third party providers, such as pixels, beacons, or the like.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The Bavarian DPA found that&nbsp;none&nbsp;of the 40 websites’ cookie practices were GDPR-compliant. It found the following violations</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Websites lacked the transparency needed for “informed” cookie consent</em></strong><em>. </em></li><li><strong><em>No “prior” consent was collected from users</em></strong><em>. </em></li><li><strong><em>The consent obtained was not sufficiently “active”</em>.</strong>&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>The Bavarian DPA announced it was considering GDPR fines for the website operators.\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In July 2019, the UK ICO published a new guidance on the use of cookies after admitting <a href=\"https://www.itpro.co.uk/general-data-protection-regulation-gdpr/33850/ico-admits-its-own-cookie-policy-is-non-compliant-with\">its own website was not compliant</a>. Read more <a href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=7704459a-682b-4360-83e2-195bbba3a4c6&amp;utm_content=&amp;utm_campaign=\">here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the French regulator, CNIL  \"<em>Online targeted advertisement: what action plan for the CNIL_en ?\"</em> <a href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The  CNIL tweeted : \"<em>The legal framework relating to consent has evolved, and so does the website of the CNIL. On </em><a rel=\"noreferrer noopener\" href=\"https://t.co/R3uTY6ghS5\" target=\"_blank\"><em>http://cnil.fr </em></a><em>, no more tracking devices are deposited, as long as the user has not given his active consent</em>\" with the following <a href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\">link</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Website transparency : Cookies and privacy notice','The General Data Protection Regulation (GDPR) is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a Fundamental Human Right, for dignity and freedom.','inherit','closed','closed','','26-revision-v1','','','2019-07-10 14:55:19','2019-07-10 13:55:19','',26,'https://datarainbow.eu/2019/07/10/26-revision-v1/',0,'revision','',0),(466,5,'2019-07-10 14:59:41','2019-07-10 13:59:41','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been said and complained about data protection regulations. Lots of criticism, its cost, resources consumption, business killer,….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What\'s been forgotten is that the&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\">General Data Protection Regulation (GDPR)</a>&nbsp;is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a&nbsp;<a rel=\"noreferrer noopener\" href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\">Fundamental Human Right</a>, for dignity and freedom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The equation is simple : Privacy = Transparency + Control</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights and freedom of data subjects with respect to the interest of the business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Before the GDPR, data protection directive lacked uniformity and the necessary certainty throughout the EU. The new Regulation is based on harmonisation and the&nbsp;<a href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\" rel=\"noreferrer noopener\">European Data Protection Board (EDPB)</a>&nbsp;is the authority in charge of the&nbsp;<a href=\"https://gdpr-info.eu/art-63-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">consistency mechanism - Article 63</a>&nbsp;- to make sure the regulation and its enforcement are harmoniously applied by all national Data Protection Authorities (DPAs).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One of the more pro-active DPAs has been the French&nbsp;<a href=\"https://www.cnil.fr/en/home\" target=\"_blank\" rel=\"noreferrer noopener\">Commission Nationale de l\'Informatique et des Libertes (CNIL)</a>&nbsp;producing many guidelines in both French and English, including a very useful&nbsp;<a href=\"https://www.cnil.fr/en/pia-software-20-available-and-growth-pia-ecosystem\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy Impact Assessment (PIA) tool</a>. So, I would like to think French companies have benefited from all necessary guidances to comply after two years period of preparation and 6 months after the GDPR entered into effect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In two previous article, I wrote about the&nbsp;<a href=\"https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">CNIL’s report after 6 months of activities</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">some of their main cases.</a>&nbsp;While The UK ICO has been more focusing on fining nuisance calls and clarifying data subject\'s access after investigating Facebook Analytica case, The French CNIL focus has been :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clarifying criteria of consent in four cases of Mobile App data collection,</li><li>clarifying CCTV monitoring and biometrics in work place</li><li>clarifying cookie compliance.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>What are cookies?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Better than me,&nbsp;<a href=\"https://termly.io/resources/articles/cookies-comprehensive-guide/\" target=\"_blank\" rel=\"noreferrer noopener\">KJ Kearie has a Comprehensive Guide&nbsp;</a>on cookies, I recommend you read.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A cookie is&nbsp;<a href=\"https://www.theguardian.com/technology/2012/apr/23/cookies-and-web-tracking-intro\" target=\"_blank\" rel=\"noreferrer noopener\">a tiny bit of plain text</a>&nbsp;that a website downloads to a computer when that user’s browser opens a new webpage. They are used to remember useful pieces of data from the users they encounter, acting as an<strong>invisible liaison between a domain’s owner and visitors</strong>.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>A cookie can identify both the user and the browser, and can be left on the user’s device indefinitely. When the user’s browser returns to that website, the cookie connects with the domain and shares with it the data it has collected or stored about that user.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>There are two main types of cookies –&nbsp;<a href=\"http://www.allaboutcookies.org/cookies/session-cookies-used-for.html\" target=\"_blank\" rel=\"noreferrer noopener\">session cookies</a>&nbsp;only collect details from a single browsing sessions, while&nbsp;<a href=\"https://www.techopedia.com/definition/4901/persistent-cookie\" target=\"_blank\" rel=\"noreferrer noopener\">persistent cookies</a>remain on the user’s device and collect information over time.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In terms of functionality, some cookies aim to a better browsing experience such as remembering the language of their visitor, others, more pernicious, track the users habits, profiling users for targeted advertising. Data collected has fuelled a huge business of data brokage raising privacy and security concerns. In November,&nbsp;<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy International</a>, the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-and\" target=\"_blank\" rel=\"noreferrer noopener\">complaints</a>&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you think online tracking and profiling are legitimate? Watch&nbsp;<a href=\"https://www.youtube.com/watch?v=xYZtHIPktQg&amp;feature=youtu.be\" target=\"_blank\" rel=\"noreferrer noopener\">this video</a>&nbsp;it\'s eloquent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Online customers deserve the same privacy as offline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookie law, known as the ePrivacy Directive, has long been misunderstood. It is not a useless banner asking you to confirm you agree for your personal data to be collected in order to access the website. Just in case, you have forgotten, an IP address or any identifiable information is considered a personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are website owners duties exactly ?</strong>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To provide clear transparency to inform their visitors about the personal data they collect, how long it is kept, with whom they share the data and data subjects rights of access, right to delete, amend or the right of portability. These informations should be provided at the time of data collection, made accessible on each webpage, in clear language.&nbsp;<a href=\"https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227\" target=\"_blank\" rel=\"noreferrer noopener\">The WP art 29&nbsp;</a>requires that</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Every organisation that maintains a website should publish a privacy statement/ notice on the website. A link to this privacy statement/ notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible. “</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:list -->\n<ul><li>it must be concise, transparent, intelligible and easily accessible (Article 12.1);</li><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In short, a privacy notice is required to provide “<em>Concise, transparent, intelligible and easily accessible</em>” information about the data collected from visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alined with the WP guidance, the&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">French DPA CNIL</a>&nbsp;has required clear information for visitors, and for non exclusively technical cookies, consent is required. AND - that is very important - opting out of cookie tracking should not be detrimental to the use of the service. This goes with the clear position of the Working Party Art 29, replaced by the EDPB.&nbsp;For more on Privacy by Design, you might want to follow&nbsp;<a href=\"https://www.ryerson.ca/pbdce/about/ann-cavoukian/\" target=\"_blank\" rel=\"noreferrer noopener\">Ann Cavoukian</a>, Leading the Privacy by Design Centre of Excellence at Ryerson University.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So, remember, privacy = transparency + control. that means an obligation to tell visitors what is collected, with whom is shared, users rights and clear opt out.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite all clear guidance, too many websites are non compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You’d expect lawyers would have it right, for being well aware of the regulation. The French association of lawyers, the CNB, has done a good job informing their members by producing ample&nbsp;<a href=\"https://www.cnb.avocat.fr/sites/default/files/documents/guide_rgpd_avocats-2018.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>&nbsp;to follow.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally law firms handle sensitive data of clients, so they should be the ones showing the good example.&nbsp;<a href=\"https://twitter.com/clarinette02/status/1071025796767236097\" target=\"_blank\" rel=\"noreferrer noopener\">Recently</a>, I have looked at&nbsp;<a href=\"http://www.cbbc-avocats.com/cbbc/lequipe\" target=\"_blank\" rel=\"noreferrer noopener\">few websites</a>&nbsp;from some of&nbsp;<a href=\"http://www.hleclerc-avocats.fr/alain-weber\" target=\"_blank\" rel=\"noreferrer noopener\">the top law firms</a>&nbsp;in Paris. It is outraging to see they are mostly ignoring their obligations. Lack of information about cookies, no privacy notice or insufficient information. Too many are even&nbsp;<a href=\"https://www.theverge.com/2018/7/24/17603126/google-chrome-unencrypted-not-secure\" target=\"_blank\" rel=\"noreferrer noopener\">tagged as ‘Not Secure’ by Google Chrome web browser&nbsp;</a>lacking encryption. [This is when the lock does not show next to the URL ‘http’ instead of https. unencrypted transmission means that data can be intercepted.] Some of the websites I visited have visitors contact forms or candidates applications online with CV upload.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I raised the issue few weeks ago, two of the law firms amended the security certification to https. One specialised DPO did not considered a cookie banner or&nbsp;<a href=\"http://www.jacobavocats.com/mentions-legales/\" target=\"_blank\" rel=\"noreferrer noopener\">more comprehensive privacy notice was needed</a>. It is painful to see members of the law society or big law firms could have so little consideration for privacy and data protection of clients and web visitors. I see too many exchange documents via un-encrypted email attachments. These big law firms have opulent clients around the world including outside the EU. How do they comply with data flow regulation to countries of non adequate data protection, not just China, that includes the USA as well. I have brought the CNIL\'s attention to this issue. Knowing that a website is the vitrine of a business, it worth the effort.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Data breach has been on everyday news. Have you heard of&nbsp;<a href=\"https://www.forbes.com/sites/davidvolodzko/2018/12/04/marriott-breach-exposes-far-more-than-just-data/\" target=\"_blank\" rel=\"noreferrer noopener\">Marriott hotels breach</a>&nbsp;gone undetected for four years?&nbsp;<a href=\"https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/\" target=\"_blank\" rel=\"noreferrer noopener\">Air Canada</a>, British Airways, Cathay Pacific, Yahoo, Equifax,,.... and many more. Fines will not give back data subjects\' hassle when dealing with ID theft or financial misuse.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s not anymore IF but WHEN.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any data collection creates data breach risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I invite you to read&nbsp;<a href=\"https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Memory, Forgetfulness and Delete</a>&nbsp;because Privacy matters to us all,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and from&nbsp;<a href=\"https://blog.usejournal.com/is-your-web-site-breaking-eu-law-7e5b7eb33d5d?fbclid=IwAR3n5duN22qnmVk_he_EHxsg2JQA2DCeCzAzoTk9AUBUWlUvV8h4k75FoBg\" target=\"_blank\" rel=\"noreferrer noopener\">Alexander Hanff&nbsp;</a>: \"<em>Your consent notice should provide a list of all of these assets (unless covered by the “strictly necessary” exception) and provide the option for the data to refuse the loading of any or all of these assets.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Connected read&nbsp;<a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Law&nbsp;</a>Firm Internet Security and Data Protection</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Firms Data Security</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Follow ongoing&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\">Pearltrees curation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE : Google-Style GDPR Fines for Everyone? <a href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\">Bavarian DPA </a>Conducts Website Cookie Practices Sweep, Announces Fines under Consideration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The Bavarian DPA audited 40 “large websites”. The companies audited were from the following industries</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a) Online retail ; (b) Sports; (c) Banking &amp; insurance; (d) Media; (e) Automotive &amp; electronics; (f) Home and residential; and (g) Other.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>•&nbsp;<em> The sweep revealed that&nbsp;all 40&nbsp;websites had integrated cookies or other “tracking tools”. While the Bavarian DPA leaves the term “tracking tools” largely undefined, it indicates they are provided by third parties and result in data being sent to these third party providers, such as pixels, beacons, or the like.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The Bavarian DPA found that&nbsp;none&nbsp;of the 40 websites’ cookie practices were GDPR-compliant. It found the following violations</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Websites lacked the transparency needed for “informed” cookie consent</em></strong><em>. </em></li><li><strong><em>No “prior” consent was collected from users</em></strong><em>. </em></li><li><strong><em>The consent obtained was not sufficiently “active”</em>.</strong>&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>The Bavarian DPA announced it was considering GDPR fines for the website operators.\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In July 2019, the UK ICO published a new guidance on the use of cookies after admitting <a href=\"https://www.itpro.co.uk/general-data-protection-regulation-gdpr/33850/ico-admits-its-own-cookie-policy-is-non-compliant-with\">its own website was not compliant</a>. Read more <a href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=7704459a-682b-4360-83e2-195bbba3a4c6&amp;utm_content=&amp;utm_campaign=\">here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the French regulator, CNIL  \"<em>Online targeted advertisement: what action plan for the CNIL_en ?\"</em> <a href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL tweeted : \"<em>The legal framework relating to consent has evolved, and so does the website of the CNIL. On </em><a rel=\"noreferrer noopener\" href=\"https://t.co/R3uTY6ghS5\" target=\"_blank\"><em>http://cnil.fr </em></a><em>, no more tracking devices are deposited, as long as the user has not given his active consent</em>\" with the following <a href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\">link</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further read on <a href=\"https://datarainbow.eu/2019/06/16/websites-surreptitiously-tracking-and-reporting-on-visitors/\">cookies and Java Script code surreptitiously tracking and reporting on visitors</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> This work is licensed under a <a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Website transparency : Cookies and privacy notice','The General Data Protection Regulation (GDPR) is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a Fundamental Human Right, for dignity and freedom.','inherit','closed','closed','','26-revision-v1','','','2019-07-10 14:59:41','2019-07-10 13:59:41','',26,'https://datarainbow.eu/2019/07/10/26-revision-v1/',0,'revision','',0),(467,5,'2019-07-10 15:52:23','2019-07-10 14:52:23','<!-- wp:paragraph -->\n<p>Following an incident reported to the ICO in September 2018, the Information Commissioners Office (<strong>ICO</strong>), the UK\'s data protection supervisory authority, investigated and uncovered that the personal data of up to 500,000 BA customers had been unlawfully accessed. The BA\'s website had been diverted to a dummy site where customer details were harvested by hackers. Some credit cards long number and security codes had been discolosed causing serious security breaches. On 8th of July 2019, the ICO published a <a href=\"https://lnkd.in/eFdbCXT\">Notice of Intent</a> to fine British Airways 183 million £.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR ‘one stop shop’ provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO’s findings.</em></p><p><em>The ICO will consider carefully the representations made by the company and the other concerned data protection authorities before it takes its final decision.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>  The Following day, a Notice of Intention was issued against Marriott International.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Following an extensive investigation the ICO has issued a notice of its intention to fine Marriott International £99,200,396 for infringements of the General Data Protection Regulation (GDPR).\"</p><p>The proposed fine relates to a cyber incident which was notified to the ICO by Marriott in November 2018. A variety of personal data contained in approximately 339 million guest records globally were exposed by the incident, of which around 30 million related to residents of 31 countries in the European Economic Area (EEA). Seven million related to UK residents.</p><p>It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018. The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to watch the effects of a no deal Brexit on these cases where the ICO will no longer be a lead authority and UK possibly becoming a country of non adequate data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Information Commissioner Elizabeth Denham said:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.</em></p><p><em>“<strong>Personal data has a real value so organisations have a legal duty to ensure its security,</strong> just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In an <a href=\"https://www.wsj.com/articles/u-k-regulator-on-why-it-is-pursuing-record-fines-against-ba-marriott-11562751006\">interview with WSJ Pro Cybersecurity, the&nbsp;Information Commissioner Elizabeth Denham</a> said her office considered cybersecurity gaps, among other factors, in proposing that&nbsp;<a href=\"https://quotes.wsj.com/MAR\">Marriott International</a>&nbsp;Inc.&nbsp;and <a href=\"https://quotes.wsj.com/ICAGY\">British Airways</a>&nbsp;’ parent company pay the biggest fines to date under Europe’s data-privacy laws.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'<em>Companies had fundamental security flaws, says Information Commissioner Elizabeth Denham; their size and number of people affected also played a role</em>\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Both first major cases investigated by the ICO after the FB/Cambridge Analytics concern the security of personal data. It is unknown if they have been found to have infringed the \'Security Principle\' Article 5(1)(f) or the \'Security of Processing\' Article 32(1). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BA and Marriott International have 21 days to make representation. Other concerned EU national data protection supervisory authorities will be able to comment until the final Monetary Penalty Notice is issued.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Both organisations intend to appeal the decision.  Appeal will be presented to the First Tier Tribunal in the General Regulatory Chamber within 28 days of receiving the MPN (Section 162, UK Data Protection Act 2018).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The First Tier Tribunal must allow the appeal if it considers that either the ICO\'s decision was not made in accordance with the law, or a different outcome was expected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Tribunal may also dismiss the appeal, modify the notice or cancel the ICO\'s Intention of fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More investigations are coming to an end. Expected outcomes from Carphone Warehouse and TicketMasters are awaited. The Grace period seems to have ended.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, The French CNIL has kept its promised going after estate agencies, it has issued a fine of 400.000 €. In June, the <a href=\"https://www.huntonprivacyblog.com/2019/06/11/cnil-fines-french-real-estate-service-provider-for-data-security-and-retention-failures/\">CNIL Fines French Real Estate Service Provider for Data Security and Retention Failures.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We will conclude by saying GDPR compliance could seem costly, watch for the cost of non compliance. Privacy Impact Assessment/DPIA, data minimisation and other healthy GDPR requirement would have avoid the security breaches that cost in fines and trust. Next to Data Protection authorities sanctions are customers distrust and other legal actions including class actions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','UK Watchdog Investigation of British Airways and Marriott Hotels Security Breaches','Following an incident reported to the ICO in September 2018, the Information Commissioners Office (ICO), the UK\'s data protection supervisory authority, investigated and uncovered that the personal data of up to 500,000 BA customers had been unlawfully accessed. The BA\'s website had been diverted to a dummy site where customer details were harvested by hackers. Some credit cards long number and security codes had been discolosed causing serious security breaches. On 8th of July 2019, the ICO published a Notice of Intent to fine British Airways 183 million £.','publish','closed','closed','','uk-watchdog-investigation-of-british-airways-and-marriott-hotels-security-breaches','','','2019-11-26 22:06:39','2019-11-26 22:06:39','',0,'http://datarainbow.eu/?p=467',0,'post','',0),(468,5,'2019-07-10 15:52:23','2019-07-10 14:52:23','<!-- wp:paragraph -->\n<p>Following an incident reported to the ICO in September 2018, the Information Commissioners Office (<strong>ICO</strong>), the UK\'s data protection supervisory authority, investigated and uncovered that the personal data of up to 500,000 BA customers had been unlawfully accessed. The BA\'s website had been diverted to a dummy site where customer details were harvested by hackers. Some credit cards long number and security codes had been discol0sed causing serious security breaches. On 8 July 2019, the ICO published a <a href=\"https://lnkd.in/eFdbCXT\">Notice of Intent</a>  to fine British Airways 183 million £. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR ‘one stop shop’ provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO’s findings.</em></p><p><em>The ICO will consider carefully the representations made by the company and the other concerned data protection authorities before it takes its final decision.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>  The Following day, a Notice of Intention was issued against Marriott International.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Following an extensive investigation the ICO has issued a notice of its intention to fine Marriott International £99,200,396 for infringements of the General Data Protection Regulation (GDPR).\"</p><p>The proposed fine relates to a cyber incident which was notified to the ICO by Marriott in November 2018. A variety of personal data contained in approximately 339 million guest records globally were exposed by the incident, of which around 30 million related to residents of 31 countries in the European Economic Area (EEA). Seven million related to UK residents.</p><p>It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018. The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to watch the effects of a no deal Brexit on these cases where the ICO will no longer be a lead authority and UK possibly becoming a country of non adequate data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Information Commissioner Elizabeth Denham said:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.</em></p><p><em>“<strong>Personal data has a real value so organisations have a legal duty to ensure its security,</strong> just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In an <a href=\"https://www.wsj.com/articles/u-k-regulator-on-why-it-is-pursuing-record-fines-against-ba-marriott-11562751006\">interview with WSJ Pro Cybersecurity, the Information Commissioner Elizabeth Denham</a> said her office considered cybersecurity gaps, among other factors, in proposing that <a href=\"https://quotes.wsj.com/MAR\">Marriott International</a> Inc. and <a href=\"https://quotes.wsj.com/ICAGY\">British Airways</a> ’ parent company pay the biggest fines to date under Europe’s data-privacy laws.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'<em>Companies had fundamental security flaws, says Information Commissioner Elizabeth Denham; their size and number of people affected also played a role</em>\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Both first major cases investigated by the ICO after the FB/Cambridge Analytics concern the security of personal data. It is unknown if they have been found to have infringed the \'Security Principle\' Article 5(1)(f) or the \'Security of Processing\' Article 32(1). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BA and Marriott International have 21 to make representation. Other concerned EU national data protection supervisory authorities will be able to comment until the final Monetary Penalty Notice is issued. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Both organisations intend to appeal the decision.  Appeal will be presented to the First Tier Tribunal in the General Regulatory Chamber within 28 days of receiving the MPN (Section 162, UK Data Protection Act 2018).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The First Tier Tribunal must allow the appeal if it considers that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>the ICO decision was not made in accordance with the law, or</li><li>the ICO ought to have exercised its discretion differently where the decision involved an exercise of discretion.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Otherwise, the Tribunal may dismiss the appeal, cancel or vary the notice or cancel the ICO\'s determination, depending on the circumstances.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More investigations are coming to an end. Expected outcomes from Carphone Warehouse and TicketMasters are awaited. The Grace period seems to have ended.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, The French CNIL has kept its promised going after estate agencies, it has issued a fine of 400.000 €. In June, the <a href=\"https://www.huntonprivacyblog.com/2019/06/11/cnil-fines-french-real-estate-service-provider-for-data-security-and-retention-failures/\">CNIL Fines French Real Estate Service Provider for Data Security and Retention Failures.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We will conclude by saying GDPR compliance could seem costly, watch for the cost of non compliance. Privacy Impact Assessment/DPIA, data minimisation and other healthy GDPR requirement would have avoid the security breaches that cost in fines and trust. Next to Data Protection authorities sanctions are customers distrust and other legal actions including class actions.</p>\n<!-- /wp:paragraph -->','UK Watchdog Investigation of British Airways and Marriott Hotels Security Breaches','','inherit','closed','closed','','467-revision-v1','','','2019-07-10 15:52:23','2019-07-10 14:52:23','',467,'https://datarainbow.eu/2019/07/10/467-revision-v1/',0,'revision','',0),(470,5,'2019-07-10 15:54:49','2019-07-10 14:54:49','<!-- wp:paragraph -->\n<p>Following an incident reported to the ICO in September 2018, the Information Commissioners Office (<strong>ICO</strong>), the UK\'s data protection supervisory authority, investigated and uncovered that the personal data of up to 500,000 BA customers had been unlawfully accessed. The BA\'s website had been diverted to a dummy site where customer details were harvested by hackers. Some credit cards long number and security codes had been discol0sed causing serious security breaches. On 8 July 2019, the ICO published a <a href=\"https://lnkd.in/eFdbCXT\">Notice of Intent</a>  to fine British Airways 183 million £. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR ‘one stop shop’ provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO’s findings.</em></p><p><em>The ICO will consider carefully the representations made by the company and the other concerned data protection authorities before it takes its final decision.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>  The Following day, a Notice of Intention was issued against Marriott International.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Following an extensive investigation the ICO has issued a notice of its intention to fine Marriott International £99,200,396 for infringements of the General Data Protection Regulation (GDPR).\"</p><p>The proposed fine relates to a cyber incident which was notified to the ICO by Marriott in November 2018. A variety of personal data contained in approximately 339 million guest records globally were exposed by the incident, of which around 30 million related to residents of 31 countries in the European Economic Area (EEA). Seven million related to UK residents.</p><p>It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018. The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to watch the effects of a no deal Brexit on these cases where the ICO will no longer be a lead authority and UK possibly becoming a country of non adequate data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Information Commissioner Elizabeth Denham said:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.</em></p><p><em>“<strong>Personal data has a real value so organisations have a legal duty to ensure its security,</strong> just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In an <a href=\"https://www.wsj.com/articles/u-k-regulator-on-why-it-is-pursuing-record-fines-against-ba-marriott-11562751006\">interview with WSJ Pro Cybersecurity, the Information Commissioner Elizabeth Denham</a> said her office considered cybersecurity gaps, among other factors, in proposing that <a href=\"https://quotes.wsj.com/MAR\">Marriott International</a> Inc. and <a href=\"https://quotes.wsj.com/ICAGY\">British Airways</a> ’ parent company pay the biggest fines to date under Europe’s data-privacy laws.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'<em>Companies had fundamental security flaws, says Information Commissioner Elizabeth Denham; their size and number of people affected also played a role</em>\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Both first major cases investigated by the ICO after the FB/Cambridge Analytics concern the security of personal data. It is unknown if they have been found to have infringed the \'Security Principle\' Article 5(1)(f) or the \'Security of Processing\' Article 32(1). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BA and Marriott International have 21 to make representation. Other concerned EU national data protection supervisory authorities will be able to comment until the final Monetary Penalty Notice is issued. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Both organisations intend to appeal the decision.  Appeal will be presented to the First Tier Tribunal in the General Regulatory Chamber within 28 days of receiving the MPN (Section 162, UK Data Protection Act 2018).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The First Tier Tribunal must allow the appeal if it considers that either the ICO\'s decision was not made in accordance with the law, or a different outcome was expected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Tribunal may also dismiss the appeal, modify the notice or cancel the ICO\'s Intention of fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More investigations are coming to an end. Expected outcomes from Carphone Warehouse and TicketMasters are awaited. The Grace period seems to have ended.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, The French CNIL has kept its promised going after estate agencies, it has issued a fine of 400.000 €. In June, the <a href=\"https://www.huntonprivacyblog.com/2019/06/11/cnil-fines-french-real-estate-service-provider-for-data-security-and-retention-failures/\">CNIL Fines French Real Estate Service Provider for Data Security and Retention Failures.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We will conclude by saying GDPR compliance could seem costly, watch for the cost of non compliance. Privacy Impact Assessment/DPIA, data minimisation and other healthy GDPR requirement would have avoid the security breaches that cost in fines and trust. Next to Data Protection authorities sanctions are customers distrust and other legal actions including class actions.</p>\n<!-- /wp:paragraph -->','UK Watchdog Investigation of British Airways and Marriott Hotels Security Breaches','','inherit','closed','closed','','467-revision-v1','','','2019-07-10 15:54:49','2019-07-10 14:54:49','',467,'https://datarainbow.eu/2019/07/10/467-revision-v1/',0,'revision','',0),(472,5,'2019-07-10 15:56:55','2019-07-10 14:56:55','<!-- wp:paragraph -->\n<p>Following an incident reported to the ICO in September 2018, the Information Commissioners Office (<strong>ICO</strong>), the UK\'s data protection supervisory authority, investigated and uncovered that the personal data of up to 500,000 BA customers had been unlawfully accessed. The BA\'s website had been diverted to a dummy site where customer details were harvested by hackers. Some credit cards long number and security codes had been discolosed causing serious security breaches. On 8th of July 2019, the ICO published a <a href=\"https://lnkd.in/eFdbCXT\">Notice of Intent</a> to fine British Airways 183 million £.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR ‘one stop shop’ provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO’s findings.</em></p><p><em>The ICO will consider carefully the representations made by the company and the other concerned data protection authorities before it takes its final decision.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>  The Following day, a Notice of Intention was issued against Marriott International.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Following an extensive investigation the ICO has issued a notice of its intention to fine Marriott International £99,200,396 for infringements of the General Data Protection Regulation (GDPR).\"</p><p>The proposed fine relates to a cyber incident which was notified to the ICO by Marriott in November 2018. A variety of personal data contained in approximately 339 million guest records globally were exposed by the incident, of which around 30 million related to residents of 31 countries in the European Economic Area (EEA). Seven million related to UK residents.</p><p>It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018. The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to watch the effects of a no deal Brexit on these cases where the ICO will no longer be a lead authority and UK possibly becoming a country of non adequate data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Information Commissioner Elizabeth Denham said:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.</em></p><p><em>“<strong>Personal data has a real value so organisations have a legal duty to ensure its security,</strong> just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In an <a href=\"https://www.wsj.com/articles/u-k-regulator-on-why-it-is-pursuing-record-fines-against-ba-marriott-11562751006\">interview with WSJ Pro Cybersecurity, the Information Commissioner Elizabeth Denham</a> said her office considered cybersecurity gaps, among other factors, in proposing that <a href=\"https://quotes.wsj.com/MAR\">Marriott International</a> Inc. and <a href=\"https://quotes.wsj.com/ICAGY\">British Airways</a> ’ parent company pay the biggest fines to date under Europe’s data-privacy laws.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'<em>Companies had fundamental security flaws, says Information Commissioner Elizabeth Denham; their size and number of people affected also played a role</em>\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Both first major cases investigated by the ICO after the FB/Cambridge Analytics concern the security of personal data. It is unknown if they have been found to have infringed the \'Security Principle\' Article 5(1)(f) or the \'Security of Processing\' Article 32(1). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BA and Marriott International have 21 days to make representation. Other concerned EU national data protection supervisory authorities will be able to comment until the final Monetary Penalty Notice is issued.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Both organisations intend to appeal the decision.  Appeal will be presented to the First Tier Tribunal in the General Regulatory Chamber within 28 days of receiving the MPN (Section 162, UK Data Protection Act 2018).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The First Tier Tribunal must allow the appeal if it considers that either the ICO\'s decision was not made in accordance with the law, or a different outcome was expected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Tribunal may also dismiss the appeal, modify the notice or cancel the ICO\'s Intention of fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More investigations are coming to an end. Expected outcomes from Carphone Warehouse and TicketMasters are awaited. The Grace period seems to have ended.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, The French CNIL has kept its promised going after estate agencies, it has issued a fine of 400.000 €. In June, the <a href=\"https://www.huntonprivacyblog.com/2019/06/11/cnil-fines-french-real-estate-service-provider-for-data-security-and-retention-failures/\">CNIL Fines French Real Estate Service Provider for Data Security and Retention Failures.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We will conclude by saying GDPR compliance could seem costly, watch for the cost of non compliance. Privacy Impact Assessment/DPIA, data minimisation and other healthy GDPR requirement would have avoid the security breaches that cost in fines and trust. Next to Data Protection authorities sanctions are customers distrust and other legal actions including class actions.</p>\n<!-- /wp:paragraph -->','UK Watchdog Investigation of British Airways and Marriott Hotels Security Breaches','','inherit','closed','closed','','467-revision-v1','','','2019-07-10 15:56:55','2019-07-10 14:56:55','',467,'https://datarainbow.eu/2019/07/10/467-revision-v1/',0,'revision','',0),(473,5,'2019-07-10 16:16:58','2019-07-10 15:16:58','<!-- wp:paragraph -->\n<p>Following an incident reported to the ICO in September 2018, the Information Commissioners Office (<strong>ICO</strong>), the UK\'s data protection supervisory authority, investigated and uncovered that the personal data of up to 500,000 BA customers had been unlawfully accessed. The BA\'s website had been diverted to a dummy site where customer details were harvested by hackers. Some credit cards long number and security codes had been discolosed causing serious security breaches. On 8th of July 2019, the ICO published a <a href=\"https://lnkd.in/eFdbCXT\">Notice of Intent</a> to fine British Airways 183 million £.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR ‘one stop shop’ provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO’s findings.</em></p><p><em>The ICO will consider carefully the representations made by the company and the other concerned data protection authorities before it takes its final decision.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>  The Following day, a Notice of Intention was issued against Marriott International.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Following an extensive investigation the ICO has issued a notice of its intention to fine Marriott International £99,200,396 for infringements of the General Data Protection Regulation (GDPR).\"</p><p>The proposed fine relates to a cyber incident which was notified to the ICO by Marriott in November 2018. A variety of personal data contained in approximately 339 million guest records globally were exposed by the incident, of which around 30 million related to residents of 31 countries in the European Economic Area (EEA). Seven million related to UK residents.</p><p>It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018. The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to watch the effects of a no deal Brexit on these cases where the ICO will no longer be a lead authority and UK possibly becoming a country of non adequate data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Information Commissioner Elizabeth Denham said:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.</em></p><p><em>“<strong>Personal data has a real value so organisations have a legal duty to ensure its security,</strong> just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In an <a href=\"https://www.wsj.com/articles/u-k-regulator-on-why-it-is-pursuing-record-fines-against-ba-marriott-11562751006\">interview with WSJ Pro Cybersecurity, the&nbsp;Information Commissioner Elizabeth Denham</a> said her office considered cybersecurity gaps, among other factors, in proposing that&nbsp;<a href=\"https://quotes.wsj.com/MAR\">Marriott International</a>&nbsp;Inc.&nbsp;and <a href=\"https://quotes.wsj.com/ICAGY\">British Airways</a>&nbsp;’ parent company pay the biggest fines to date under Europe’s data-privacy laws.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'<em>Companies had fundamental security flaws, says Information Commissioner Elizabeth Denham; their size and number of people affected also played a role</em>\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Both first major cases investigated by the ICO after the FB/Cambridge Analytics concern the security of personal data. It is unknown if they have been found to have infringed the \'Security Principle\' Article 5(1)(f) or the \'Security of Processing\' Article 32(1). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BA and Marriott International have 21 days to make representation. Other concerned EU national data protection supervisory authorities will be able to comment until the final Monetary Penalty Notice is issued.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Both organisations intend to appeal the decision.  Appeal will be presented to the First Tier Tribunal in the General Regulatory Chamber within 28 days of receiving the MPN (Section 162, UK Data Protection Act 2018).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The First Tier Tribunal must allow the appeal if it considers that either the ICO\'s decision was not made in accordance with the law, or a different outcome was expected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Tribunal may also dismiss the appeal, modify the notice or cancel the ICO\'s Intention of fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More investigations are coming to an end. Expected outcomes from Carphone Warehouse and TicketMasters are awaited. The Grace period seems to have ended.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, The French CNIL has kept its promised going after estate agencies, it has issued a fine of 400.000 €. In June, the <a href=\"https://www.huntonprivacyblog.com/2019/06/11/cnil-fines-french-real-estate-service-provider-for-data-security-and-retention-failures/\">CNIL Fines French Real Estate Service Provider for Data Security and Retention Failures.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We will conclude by saying GDPR compliance could seem costly, watch for the cost of non compliance. Privacy Impact Assessment/DPIA, data minimisation and other healthy GDPR requirement would have avoid the security breaches that cost in fines and trust. Next to Data Protection authorities sanctions are customers distrust and other legal actions including class actions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','UK Watchdog Investigation of British Airways and Marriott Hotels Security Breaches','','inherit','closed','closed','','467-revision-v1','','','2019-07-10 16:16:58','2019-07-10 15:16:58','',467,'https://datarainbow.eu/2019/07/10/467-revision-v1/',0,'revision','',0),