Category: USA

Settlement in lawsuit against Sony Pictures Entertainment

11. April 2016

A multimillion-dollar settlement in a class-action lawsuit against Sony Pictures Entertainment filed by former employees, whose personal data was stolen when a data bleach took place, was appoved by an US District Judge last week.

About 437,000 people were affected by the data breach from the time of the 2014 hack through 2017.  In terms of the settlement Sony agreed to provide theft protection and an optional service covering up to $1 million in losses and furthermore, create a fund to cover any additional losses. As the deadline for workers to sign up for credit protection and reimbursement has not yet passed,  the exact amount of money for setteling is not yet available. However, up until today Sony had to pay $7 million in order to notify the people beingt affected by the breach and to establish a fund to compensate them. Nevertheless, this amount does not take millions of dollars into account that Sony had to pay for credit monitoring services and for attorney fees. Until now, 18,000 people have signed up for the mentioned optional service retailing for $350.

During the data breach sensitive personal data concerning current and former Sony Pictures Entertainment employees was stolen and posted online. The data breach was due to hackers, who broke into the company computers and released thousands of emails, documents and sensitive personal information.

 

WhatsApp just added end-to-end encryption

6. April 2016

WhatsApp is an online messaging service, that has grown into one of the most used applications, owned by Facebook. Messages, phone calls and photos are exchanged via WhatsApp by more than a billion people. Therefore, only Facebook itself operates a larger communications network.

This week was revealed that the company has added end-to-end encryption to every form of communication developed by a team of 15 of out of 50 overall employees for any person using the latest version of WhatsApp, so that all messages, phone calls and photos are encrypted. This regards any smartphone, from iPhones to Android phones to Windows phones. By encrypting end-to-end not even WhatsApp’s employees have access to the data sent through this communication network. This means that WhatsApp will not be able to comply with a court order demanding the disclosure of the content of messages, phone calls and photos sent by using its service.

This way of encryption has generally led to a public discussion between technology companies and governments. For example, in the UK, politicians have proposed banning this encryption so that companies should be forced to install “backdoors” in order to be able to disclose the content only to law enforcement.

 

Category: Countries · EU · USA
Tags: , ,

EU-U.S. Privacy Shield expected to be effective in June 2016

16. March 2016

On the 14th March, the Digital Commissioner Günther Oettinger spoke out on the EU-U.S. Privacy Shield at the CeBIT fair (Center for Office Automation, Information Technology and Telecommunication), which will take place in Hannover (Germany) from the 14th until the 18th March.

Oettinger stated that the EU DPAs will evaluate the EU-U.S. Privacy Shield in the upcoming weeks, so that the new Framework can be effective in June 2016. He also remarked that without a legal regulation for international transfers of personal data, “the trust in cloud services will be low”.

The EU DPAs are expected to meet on the 12th-13th April in order to issue their opinion on the EU-U.S. Privacy Shield. However, this opinion will not be binding.

General overview of the EU-U.S. Privacy Shield

11. March 2016

After the details of the EU-U.S. Privacy Shield were released on February 29th, several institutions will examine its legal implications and validity in order to determine if the new Framework complies with the European Standards on Data Protection. One of these institutions is the Article 29 WP, which will reveal its opinion on the EU-U.S. Privacy Shield by the end of April.

Eduardo Ustaran, an expert in international Privacy and Data Protection, has analyzed the positive impact that the EU-U.S. Privacy Shield may have for the future development of global privacy:

  • This Framework may widespread the European Data Protection culture at an international level because multinationals will globally adopt this model, in order to comply with the European Standards.
  • Additionally, the U.S. government is adapting its legislation to the Data Protection requirements established by the EU Legislation in this field. For example, the U.S. Judicial Redress Act was approved on February 2016 in line with the new conflict resolution system proposed in the Privacy Shield. This way, EU Citizens will have the possibility to raise complaints to U.S. Authorities when their rights to Privacy and Data Protection have been violated by an organization.
  • Also the judiciary will play an important role as ultimate institution that mediates between the citizens and the state.
  • As mentioned above, the conflict resolution system proposed in the Privacy Shield includes the participation of several institutions at different levels, which provides the individuals many possibilities to exercise their rights as data subjects. Therefore, individuals will be able, for example, to raise a complaint towards the organization or to raise a complaint at the local DPA.
  • The Framework may foster the communication and collaboration between American and European Institutions. For instance, it is foreseen that an annual revision of the Framework takes place.

Fact Sheet of the European Commission about the EU-U.S. Privacy Shield

1. March 2016

On the 29th February 2016, the European Commission released a fact sheet about the Frequently Asked Questions related to the EU-U.S. Privacy Shield. The EU-U.S Privacy Shield aims at regulating international data transfers between the EU (including EEA countries Norway, Lichtenstein and Iceland) and the U.S. after the Safe Harbor Decision was declared invalid by the ECJ on October 2015.

The EU-U.S Privacy Shield is a new adequacy decision, under which the U.S. companies that comply with the described data protection principles and abide the obligations described in the framework, will be considered as ensuring an adequate level of data protection.

In contrast to the former Safe Harbor Decision, the EU-U.S. Privacy Shield imposes stronger obligations on companies related to monitoring and enforcement and prevents generalized access to EU personal data from U.S. public Authorities.

Under the Privacy Shield, U.S. companies will have to self-certify that they meet the requirements described in the Framework. The U.S. Department of Commerce will actively verify that the certifying company actually meets the requirements to certify, for example by reviewing the company´s privacy policy.

A key aspect of the Privacy Shield is the possibility for EU data subject to obtain redress in the US in case that their personal data is misused by commercial companies. The possibility to redress involves the following alternatives for the data subject:

  • to lodge a complaint with the company itself, or
  • to complaint towards their local DPA, or
  • to use the Alternative Dispute Resolution (ADR) mechanisms, or
  • through arbitration by having recourse to the Privacy Shield Panel, if the case is not resolved by any of the abovementioned alternatives.

The possibility to redress with regard to national security will be ensured by the institution of the Ombudsman.

All these aspects of the new EU-U.S. Privacy Shield have been reflected in the Judicial Redress Act, signed on February, 24th. This Act gives EU citizens the possibility to address privacy issues to U.S. Courts in relation to personal data transfers for law enforcement purposes. This Act aims at providing EU citizens with the same rights as U.S. citizens.

Also, the so called EU-U.S. “Umbrella-Agreement” covers relevant aspects of data protection regarding EU-U.S. law enforcement cooperation for the purposes of crime and terrorism prevention. This agreement is not a legal basis for data transfers itself, but it will provide safeguards for data transfers made under other existing agreements.

The EU – U.S. Privacy Shield: next steps

19. February 2016

The EU Commission and the U.S. Government agreed recently on the EU- U.S. privacy Shield as a possible mechanism to carry out international data transfers on a valid basis and providing an adequate level of data protection. The agreement shall be adopted by a decision.

The process until both, the proposed agreement and the corresponding decision, are adopted is complex and requires the opinion of several EU institutions

  • The EU Commission should make the proposal for the decision of adopting the agreement. The decision is expected by thy end of February.
  • The WP29, made up of the DPAs from the EU Member States and the European Data Protection Supervisor (EDPS) will have to give its opinion on the proposed agreement. This opinion will not be binding for the EU Commission.
  • Also the Article 31 Committee, established pursuant to art. 31 of the EU Data Protection Directive, will we asked to give an opinion.
  • Finally, the College of the EU Commission will decide about the adoption of the decision.

Additionally, also the ECJ will be requested to examine the proposal in order to determine if it provides an adequate level of protection of the fundamental rights of EU citizens. Also, the DPAs from the Member States may refer to the ECJ for clarification about the agreement.

Statement of the U.S. Department of Commerce on the „EU – U.S. Privacy Shield“

5. February 2016

Not only European negotiators and institutions have given their opinion on the EU – U.S. Privacy Shield, also the U.S. Department of Commerce and the FTC Commissioner, Julie Brill, have made a public statement on the on the advantages of the implementation of the Privacy Shield.

On the 2nd February, the U.S. Department of Commerce stated that the EU – U.S. Privacy Shield improves, on the one hand, the commercial oversight and enhances privacy protections and, on the other hand, it demonstrates the U.S. commitment to limitations on national security. The statement of the Department of Commerce remarks the cooperation between the FTC and EU Data protection Authorities and its commitment to review the Agreement on an annual basis. Also, it ensures that the U.S. Intelligence Community has described in writing the constitutional, statutory and policy safeguards applied to its operations.

The FTC offered a live webcast on the 4th February in which the EU – U.S. Privacy Shield was explained by FTC Commissioner Julie Brill. During the webcast the main aspects of the EU – U.S. privacy Shield were explained. Julie Brill remarked the commercial relevance of this agreement and the acknowledgement by U.S Authorities that the rights of the individuals and national security should be balanced.

 

Statement of the WP29 on the “EU – U.S. Privacy Shield”

4. February 2016

After the Press Conference held by Věra Jourová and Andrus Ansip from the European Commission about the proposal for a new agreement between EU and U.S. to carry out international data transfers, the WP29 met on the 2-3 February in order to discuss the consequences of the sentence from the ECJ and the future of international data transfers between EU and the U.S.

The WP29 has remarked that the following four guarantees should be ensured when international data transfers take place:

a) Transparency: the data subject whose data is processed should be informed so that he/she is able to foreseen the consequences of the data transfer.

b) Proportionality and necessity: the finality for which personal data is collected and accessed and the rights of the data subject should be balanced.

c) Independency of a control body that carries out checks in an effective and impartial manner.

d) Effective remedies: the individual should have the possibility to defend his/her rights before an independent body.

The WP29 will also analyze the existing mechanisms to carry out international data transfers, which currently can only take place if Standard Contractual Clauses or Binding Corporate Rules (BCR) are used. In any case, European DPAs will examine data transfers on a case-by-case basis.

However, the WP29 is still looking forward to receive the relevant documents related to the EU – U.S. Privacy Shield in order to analyze its content and to determine to which extent the agreement is legally binding.

 

If you would like to be updated on a regular basis on this and other data protection issues such as the General Data Protection Directive (GDPR), sign in for one of our newsletters:

German / European Data Protection http://www.datenschutzticker.de/newsletter/ (German Language)

International Data Protection http://www.privacy-ticker.com/newsletter/ (English language)

For how to proceed with your companies´ policies on internal or external data protection transfers to third countries and prepare for the GDPR seek individual advice.

 

The “EU – U.S. Privacy Shield”, a new agreement for international data transfers

3. February 2016

After continuous negotiations during the last months to agree on a new framework for international data transfers, since the ECJ invalidated the Safe Harbor Decision, Andrus Ansip (EU Commission Vice-President) and Věra Jourová (Commissioner) announced yesterday in a Press Conference that a new agreement (EU – U.S. Privacy Shield) to carry out international data transfers has been reached.

Under the EU – U.S. Privacy Shield, the following elements will be regulated:

  • Several redress possibilities will be guaranteed to EU citizens when data transfers to U.S. take place and companies, as first redress possibility, will have deadlines to resolve complaints.
  • The resolution includes a “multi-layered” approach in order to avoid that any complaints remain unresolved by offering different resolution mechanisms. Also the European DPAs will have the possibility to refer complaints to the U.S. Department of Commerce and to the Federal Trade Commission.
  • Companies will be subject to strong obligations regarding the processing of personal data imported from EU Member States. Particularly, personal data processed for HR purposes in the U.S. will have to comply with the decisions of EU DPAs.
  • It will be ensured that national authorities only have access to personal data from EU citizens in exceptional cases and subject to the principles of necessity and proportionality.
  • The figure of the “ombudsman” will be created, in order to make possible that EU citizens can complain regarding surveillance activities by national authorities.

This new framework should be reviewed in an annual basis, so that the rights of EU citizens regarding data protection are continuously ensured. This is an important step forward in comparison with the invalidated Safe Harbor Decision.

Although the main points of this agreement have been discussed, the written draft may take up to three months, as Commissioner Věra Jourová said. The Working Party 29 will advise the College of Commissioners on this issue before adopting the official decision. Additionally, the agreement will have to withstand scrutiny from the ECJ.

New Safe Harbor Agreement

2. February 2016

European officials and the U.S. agreed today on a new safe harbor agreement. The EU Article 29 Working Group had set a deadline until the end of January 2016 to find an alternative agreement, which was missed. The agreement still needs to be approved by the 28 member states. Further information on the new safe harbor agreement is expected after the EU Article 29 Working Group meeting, which is supposed to take place today and tomorrow.

Pages: Prev 1 2 3 ... 5 6 7 8 9 10 11 12 13 14 15 Next
1 12 13 14 15