Category: General
15. March 2019
Thailand’s National Legislative Assembly approved and endorsed a draft of a new data protection law called Personal Data Protection Act (PDPA).The legislative process will be completed within the next weeks. The process includes that the draft will be submitted for royal endorsement and publicated in the Government Gazette.
The draft provides a one year period for implementation of the new requirements. This grace period should help the business operaters to prepare and implement the new obligations.
The draft of the PDPA has followed and replicated the provisions of the European General Data Protection Regulation (GDPR) to demonstrate that Thailand has an adequate level of data protection. This is necessary for the adoption of an adequacy decision of the European Commission. The adequacy decision requires that the exchange of personal data is based on strong safeguards in regard of EU standards. In case the European Commission adopts an adequacy decision, as they recently did with Japan, the data flows to Thailand as a third country in terms of the GDPR will be much easier for European companies.
14. March 2019
On May 9th, 2019, the „GPEN“(„Global Privacy Enforcement Network“) shared its “2018 Sweep”, an annual intelligence gathering that looked at how well organisations have implemented data privacy accountability into their internal privacy policies and programmes.
GPEN is a global network of more than 60 data protection agencies. The 2018 Sweep was a collaboration between New Zealand’s (New Zealand Office of the Privacy Commissioner, “OPC”) and UK’s (UK Information Commissioner’s Office, “ICO”) data protection authorities and was carried out by several data protection authorities across the globe.
The participating authorities reached out to 667 companies with a set of pre-determined questions that focus on key elements of responsible data protection. Those elements were:
- The importance of internal policies and procedures for data governance;
- Training and awareness;
- Transparency about data practices;
- The assessment and mitigation of risk;
- Incident Management.
Of the 667 organisations contacted, only 53% (356) provided substantive responses and a large point of those had appointed an individual or a team to ensure compliance with relevant data protection regulations.
The 2018 Sweep shows that many organisations are quite good at providing data protection training to their employees but companies have to ensure that those training are offered to all employees and happen on a regular basis. It was also found that several organisations have processes in place on how to deal with data subject complaints and how to handle data breaches.
Overall, most organisations are aware of data protection and have a good understanding of it. Nevertheless, they have to make sure that they have clear policies and procedures in place and monitor their performance regarding the relevant laws and regulations.
12. March 2019
Yesterday evening, shortly before the vote of the UK parliament on the circumstances and if necessary a postponement of the Brexit, Theresa May met again with Jean-Claude Juncker in Strasbourg. Both sides could agree on “clarifications and legal guarantees” regarding the fall-back solution for Northern Ireland.
These (slightly) expand the United Kingdom’s (UK) opportunity to appeal to an arbitration court in the event that the EU should “hold the UK hostage” in terms of the membership of the customs union by means of the Backstop-Clause beyond 2020. This “legally binding instrument”, as Juncker said, intends to clarify that the Backstop-Clause on the Irish border is not to be regarded as a permanent solution. This shall also be confirmed in a joint political declaration on the future relations between the two sides. However, the wording of the complementary regulation is legally vague.
May is nevertheless confident that the British Parliament will approve the “new” agreement to be voted on tonight. Meanwhile, Jeremy Corbyn, Labour Party leader, has announced and urged to vote against the agreement. In any case, Juncker has already rejected further negotiations on adjustments to the current version of the withdrawal agreement, emphasizing that there will be no “third chance”. By 23rd May, when the EU elections begin, the Kingdom shall have left the EU.
The vote on “how” and “when” of the Brexit will be taken in the next few days, starting tonight at 8 p.m. CET. If the withdrawal agreement will be rejected again today, the parliament will vote on a no-deal Brexit tomorrow (the UK would then be a third country in the sense of the GDPR as of 30th March). In case this will also be rejected, on 14th March the parliament will eventually vote on a delay of the Brexit date. A postponement could then lead to a new referendum and thus to a renewed decision on the question of “whether” a Brexit will actually take place.
25. February 2019
It seems very likely that the UK will leave the EU under a “no-deal” Scenario and become a third country in terms of data protection. Beside the fact that in the absence of an adequacy decision each transfer of personal data between the EU and the UK will need to be appropriately safeguarded, UK companies making business in the EU may have to designate an EU representative. In addition, according to the GDPR, companies concerned with the cross-border transfer of personal data obtained within the area of the EU will need to consider specific documentation and information obligations.
As the UK and the EU could not even agree on a transition period yet, all these data protection obligations are required to be in place as of the 30th March, 00:00 h (CET). The data protection authorities of the EU already announced that they will not grant a transition period regarding the required data protection measures and actions pursuant to the GDPR that need to be taken. The unlawful transfer or processing of personal data to or within the UK will thus not be tolerated by the EU supervisory authorities as of day one after BREXIT. Bearing this in mind, first and foremost, the EU Commission’s Standard Contractual Clauses should be in place if there is no other appropriate safeguard, e.g. Binding Corporate Rules (BCR), existent to ensure the lawfulness of the transfer of EU personal data.
If not yet done, now is the time to think about the required steps and develop a “BREXIT data protection strategy” in order to be compliant with the GDPR when the UK leaves the EU under a “no-deal” BREXIT.
14. February 2019
On February 12, 2019 the European Data Protection Board (EDPB) released on their website a document containing a two-year Work Program.
The EDPB acts as an independent European body and is established by the General Data Protection Regulation (GDPR). The board is formed of representatives of the national EU and EEA EFTA data protection supervisory authorities, and the European Data Protection Supervisor (EDPS).
The tasks of the EDPB are to issue guidelines on the interpretation of key ideas of the GDPR as well as the ruling by binding decisions on disputes regarding cross-border processing activities. Its objective is to ensure a consistent application of EU rules to avoid the same case potentially being dealt with differently across various jurisdictions. It promotes cooperation between EEA EFTA and the EU data protection supervisory authorities.
The EDPB work program is based on the needs identified by the members as priority for individuals, stakeholders, as well as the EU legislator- planned activities. It contains Guidelines, Consistency opinions, other types of activities, recurrent activities and possible topics.
Furthermore, the EDPB released an information note about data transfers if a no-deal Brexit occurs. As discussed earlier, in this case the UK will become a so-called “third country” for EU member countries beginning from March 30. According to the UK Government, the transfer of data from the UK to the EEA will remain unaffected, permitting personal data to flow freely in the future.
12. February 2019
According to the British news website The Register, 620 million accounts from hacked websites are for sale on dark web. For less than $20.000 in Bitcoin, people can buy the stolen accounts on Dream Market, located in the Tor network. Criminals should also be able to buy the copied user data individually. The data comes from hacks from the years 2016 to 2018. Some were already known others now became acquianted.
Among the sixteen hacked websites are the video messaging application Dubsmash (162 million accounts), the diet and exercise app MyFitnessPal (151 million accounts) and the family-tree-tracking service MyHeritage (92million accounts).
As reported by The Register, the account records appear to be legit. The data leak contains e-mail addresses, names and passwords but it does not contain any bank or credit card information and the passwords are encrypted and must therefore be decoded before they can be used.
Depending on the affected side, there are also a few other categories of personal information such as social media authentication tokens. It can be expected that the vendees will use the data for credential stuffing attacks. In such attacks, attackers try out lists with email password pairs at various online services to hack accounts. These attacks are made possible because many users reuse the same password across many websites.
The seller told The Register that they possess one billion accounts in total and that their aim is to make “life easier” for hackers. The seller said “I don’t think I am deeply evil, I need the money. I need the leaks to be disclosed […] I’m just a tool used by the system. We all know measures are taken to prevent cyber attacks, but with these upcoming dumps, I’ll make hacking easier than ever.”
Update: 127 million more stolen accounts appeared a few days ago. Affected sites include architecture, interior and designe website Houzz (57 million records), live-video streaming site YouNow (40 million records) and travel booking site Ixigo (18 million records). This data is sold by the hacker for a total of $14,500 in Bitcoin.
Article 17 of the General Data Protection Regulation (GDPR) stipulates the data subject the right to erasure, also called right to be forgotten. The Austrian Data Protection Authority decided that the right to erasure not necessarily mean destruction of the stored data. According to the Authority anonymization may be sufficient.
The decision is based on a complaint of an Austrian who request his former insurance company to delete all stored data. The insurance company deleted his e-mail address and phone number as well as insurance offers and stopped all advertising. However, name and address of the data subject were anonymized and the insurance company told the data subject that the data would be destructed in March 2019.
The Austrian Data Protection Authority proved the company right. According to Art. 4 Nr. 2 GDPR the company can choose whether it deletes or destructs the stored data, it only had to “be ensured that neither the person responsible himself nor a third party can restore a personal reference without disproportionate effort”, explained the Authority.
7. February 2019
The Bundeskartellamt announced in a press release on their website on Febraury 7, 2019 that it imposes far-reaching restrictions on Facebook.
Up to now Facebook’s terms and conditions stated that users have only been able to use the social network under the precondition that Facebook can collect user data also outside of the Facebook website in the internet or on smartphone apps and assign these data to the user’s Facebook account. Therefore, all data collected on the Facebook website, by Facebook-owned services which includes Instagram and WhatsApp as well as on third party websites can be combined and assigned to the account of a Facebook user.
The authority’s decision affects said processing of user data in Germany and covers different sources of data.
Firstly, all social networks/services can continue to collect data under the existing laws. But the collected data can only be transferred to Facebook itself if consent is given by the data subject (the user). If such a consent is not given, the data cannot be assigned to an existing Facebook account. Secondly, the same applies to collecting data from third party websites.
Consequently, without the above mentioned consent Facebook will face far-reaching restrictions concerning collecting and combining data.
The Bundeskartellamt states as reason for this decision that in December 2018 Facebook had 1.52 billion daily active users and 2.32 billion monthly active users and therefore also occupies a dominant position in the German market for social networks. It further claims that the market share of Facebook concerning social networks in Germany is more than 95 % (daily active users) and more than 80 % (monthly active users). Therefore, the conclusion is drawn that the group with its subsidiaries WhatsApp and Instagram occupy a key position in the market which indicates a monopolisation process. Competitors like Google+, Snapchat, YouTube or Twitter or professional networks like LinkedIn or Xing provide only components of the services offered by the Facebook Group.
The authority’s decision is not yet final. Facebook has one month to appeal the decision to the Düsseldorf Higher Regional Court. The company has already announced that it will appeal against the decision.
31. January 2019
Healthcare insurer Aetna will have to pay a 935,000$ fine after letters had been sent to nearly 12.000 patients in 2017, disclosing highly sensitive information on the windows of the envelopes.
The information revealed that the recipients were taking HIV-related medications.
In addition, the insurance company will have to complete privacy risk assessments annualy for three years.
The patients have received compensation through a private class action settlement.
28. January 2019
On the occassion of this year’s Data Protection Day, which was launched in 2006 by the Council of Europe, the Commission has issued the following statement :
“This year Data Protection Day comes eight months after the entry into application of the General Data Protection Regulation on 25 May 2018. We are proud to have the strongest and most modern data protection rules in the world, which are becoming a global standard.”
On January 28th in 2006, the Council of Europe’s data protection convention, known as “Convention 108”, was opened to signature. Data Protection Day is now celebrated globally and is called Privacy Day outside of Europe.
More than 50 countries around the world have already signed up to the convention, which sets out key principles in the area of personal data protection.
The convention has been ratified by the 47 Council of Europe member states and Mauritius, Senegal, Uruguay and Tunisia. Other countries such as Argentina, Burkina Faso, Cabo Verde, Mexico and Morocco have been invited to accede. Many more participate as Observers States in the work of the Committee of the Convention (Australia, Canada, Chile, Ghana, Indonesia, Israel, Japan, Korea, New-Zealand, United States of America).
Governments, parliaments, national data protection bodies and other actors carry out activities on this day to raise awareness about the rights to personal data protection and privacy. These may include campaigns targeting the general public, educational projects for teachers and students, open doors at data protection agencies and conferences.