Category: General

Data of patients disclosed in Singapore’s largest data breach in history

30. July 2018

A cyberattack has impacted data of 1.5 Mio patients of SingHealth clinics by stealing name, ID Card number, address, gender, race and date of birth as reported by ARN Net.

Due to “operational security reasons”, the authorities haven’t disclosed the identity of the responsibles behind the attack.

Even Singapore’s Prime Minister, Lee Hsien Loong, “had his personal particulars stolen as well as his outpatient dispensed medicines record.”

The report further states that all patients, whether or not they were affected will receive an SMS notification over the next five days, with patients also able to access the Health Buddy mobile app or SingHealth website to check if they are affected by this incident.

According to Channel Asia the SingHealth IT system was compromised through an initial breach on a particular front-end workstation, gaining privileged account credentials to gain access to the database.

It is believed that the attack began on June 27th, 2018 and was detected on July 4th, 2018. Apparently, no further illegal exfiltration has been detected since and all Patient records in SingHealth’s IT system remain intact.

Several measures have been taken in terms of IT-security such as controls on workstations and servers, resetting user and systems accounts and installment of additional system monitoring controls.

New Zealand: Privacy after death does matter

27. July 2018

Data protection rights generally refer to living persons only. Among others, the European General Data Protection Regulation (GDPR) explicitly mentions in its Recital 27 that the Regulation does not apply to the personal data of deceased persons.

However, the Recital also contains an opening clause for the EU Member States, stating that these may provide for specific rules for such cases. The GDPR hereby acknowledges that there might be cases that need to be tackled individually.

For example, requests can be made in order to find out whether the deceased had suffered from a hereditary disease. This information is not to be seen as protected for the offspring that might be affected by it.

Consequently, there will be situations that contain mixed information on both the deceased and the requestor.

The Privacy Commissioner’s Office (OPC) of New Zealand has now released a statement regarding the privacy of deceased persons on July 24th, 2018 taking up this exact issue.

Whereas the Privacy Act of New Zealand also defines an individual as a “natural person, other than a deceased person”, the OPC states that “sometimes it will be inappropriate to release the personal information of the dead”.

The OPC further says that “some information is inherently sensitive, for example mental or sexual health information. It could be unfair to release such information to those who are just curious and have no good reason to see it.”

Ultimately, it will often be necessary to balance the rights and elaborate case by case, also taking into consideration the wishes of the deceased person to some extent.

One year after the massive data breach at Equifax

Last year at this time the Credit Bureau Equifax has been hacked and the sensitive data of approximately 143 million consumers has been affected.

The data breach is considered to be the worst data breach in US history, according to the scale and the nature of the information exposed. Hackers have entered the system and stole data like consumer’s name, social security numbers, birth dates, addresses and in some cases also driver’s license numbers, as well as credit card numbers.

After the data breach, the company had to be determined that they were not prepared for such an event, measures had to be taken. So what happened during the past year?

Equifax has remained fairly quiet amidst class action suits, congressional scrutiny, a Federal Trade Commission probe, and a wave of new state regulations designed to ensure that Equifax substantially improves its security defenses. Beyond others, in February a new Chief Information Security Officer, Jamil Farshchi, was hired. Farshchi had managed information security at high-stakes companies and cleaned up data breaches before. Furthermore, Equifax invested $200 million on data security infrastructure.

So the transformation is in process to create a world-class security program at Equifax.

Data breach exposes data including trade secrets from several large carmakers

24. July 2018

A security researcher from the UpGuard Cyber Risk Team detected that various data from carmakers like Volkswagen, Ford and Toyota were exposed. UpGuard is an Australian cybersecurity group that among other things detects data breaches.

The source of the data leak is a small Canadian company called Level One Robotics and Controls. On a publicly accessible backup server of the engineering company were files from more than a hundred companies in business with said company. Belonging to the group of companies affected by the leak are some of the biggest carmakers like Tesla, VW, Toyota, General Motors, Chrysler and ThyssenKrupp.

The 47.000 unsecured files contained inter alia product designs, invoices, bank accounts and contracts. Some of these data are among the industry’s most closely guarded and confidential trade secrets. In addition, a number of non-disclosure agreements explaining the sensitivity of the leaked information formed part of the exposed data.

The researcher issued a leakage warning and since then the accessible information was taken offline within 24 hours.

The California Consumer Privacy Act of 2018

19. July 2018

On June 28th 2018, California passed the California Consumer Privacy Act (CCPA), which is considered to be the strongest privacy protection measure in the U.S. The new California law, which takes effect as of January 1st 2020, grants residents of California a broad protection when it comes to processing their personal data by a profit orientated business.

The new Act has an impact on every company that does business in California or to affiliated, co-branded entities of the business that meets the below criteria even if the affiliate does not have a business in California. For the CCPA to be applicable, the business either

1. has an annual gross Revenue of $25 million or more,
2. collects, busy or sells 50,000 or more consumers’ personal information each year for commercial purposes or
3. dervies 50% or more of their annual Revenue from selling consumers’ personal Information.

After the European General Data Protection Act (GDPR) became effective as of 25th May 2018, businesses who are also dealing with data of Californian residents will have to comply with an additional regulation.

California being the 5th largest global economy behind the United States, China, Japan and Germany (even beating the United Kingdom) companies should take a number of affirmative steps to comply with the new requirements prior to  1st of January 2020.

While both the GDPR and the CCPA address the collection of personal information by businesses, they differ in their obligations and requirements for businesses to be compliant. Unfortunately, the implementations, which came into action for the GDPR, will not be enough for the CCPA regulation.

Even though the CCPA is stricter in some aspects, unlike the GDPR demands, businesses will not be required to get people’s permission to collect their personal data in the first place.

The CCPA however defines personal data more broadly and requires specific disclosures and communication channels that are not required by the GDPR. The CCPA also contains different exceptions to the right to have personal data deleted, establishes broader rights to access personal data and imposes tighter restrictions on data sharing for commercial purposes.

It is advisable that global companies who are impacted by the regulations should try to address the requirements of the GDPR and CCPA simultaneously and holistically.

Category: General

Japan and the EU are establishing an environment of data protection between its citizens (and companies)

18. July 2018

As part of the Economic Partnership Agreement (EPA), the European Union and Japan have signed the 17th July 2018, the two parties recognise each other’s data protection laws as equivalent. In this manner, personal data will flow in the future safely between the EU and Japan.

In Europe, a committee composed of representatives of the EU Member States has to give its consent and the European Data Protection Board (EDPB) publishes its opinion before the European Commission adopts the adequacy decision. Once the agreement is established, EU citizens and 127 Million Japanese consumers will benefit from international trading that includes the high privacy standards of the General Data Protection Regulation (GDPR).

Japanese companies now have to comply some safeguards to fulfil the European data protection level, like the protection of sensitive data, the requirements for transfer of data to a third country or the exercise of individual rights to access individual rights (compared to Art. 12 – 23 of the GDPR). The Japanese watchdog (PPC) will implement these rules as well as a complaint-handling mechanism to investigate and resolve complaints of European citizens concerning the data processing of Japanese controllers.

This agreement is a result of the communication Exchanging and Protecting personal data in a globalised world, announced by the Commission in January 2017.

Data breach at Panini’s online service ‘MyPanini’

2. July 2018

According to a report in the magazine ‘Der Spiegel’, personal data and images of users who wanted to create Panini images with their own photos could be accessed by third parties.

The Italian scrapbook manufacturer for football images Panini has serious problems with the security of their online customer database. Through changing the browser’s URL, unauthorized persons could have accessed personal data of other customers, including pictures of minors. Therefore, the case can be considered as particularly serious.

Through its ‘MyPanini’ service, Panini offers fans the opportunity to upload photos with their own images and have these personalised images sent to them. Until a few days ago, logged in users could have also seen the uploaded images and personal data of other customers. Apparently the full name, the date of birth and partly even the place of residence of the customers are listed.

To a certain degree, the uploaded images showed children and young children from different countries in the private domestic environment, some even with their naked upper body.

The data breach was confirmed and has been known internally for days. Supposedly, the problem has been solved by a security update, but it is not possible to access the website at the moment.

It remains to be seen what financial consequences the data breach has for either Panini or the technical service provider. In accordance with new European General Data Protection Regulation (GDPR) infringements of the provisions can lead to administrative fines up to 10 000 000 EUR or up to 2% of the total worldwide annual turnover of the preceding financial year.

Facebook: EU Data may not have been shared with Cambridge Analytica

27. June 2018

As Bloomberg reports, Facebook said that evidence suggests that EU data may not be shared with Cambridge Analytica at all. Stephen Satterfield, a director on Facebook’s Privacy and Public Policy team told European Union lawmakers in a hearing: “The best information we have suggests that no European user data was shared by Dr. [Aleksandr] Kogan with Cambridge Analytica”. Aleksandr Kogan was the researcher who developed the app that allowed Cambridge Analytica to receive data from millions of Facebook users, which were later sold to the consulting firm working on the Donald Trump U.S. presidential campaign.

Facebook clarifies that they cannot be 100 per cent certain about this matter and that they will have to await the results of their own internal investigations, following the conclusion of the investigations of the U.K. Information Commissioner’s Office (ICO) that are being undertaken at the moment. In March this year, the offices of Cambridge Analytica were investigated by the ICO amid the allegations information of Facebook’s user data was obtained without the data subject’s consents.

Richard Allen, Facebook’s vice president of policy solutions, explaining the evidences that led Facebook to the conclusion that European data may not be shared with Cambridge Analytica, said that Kogan’s contract with Cambridge Analytica instructed Kogan to collect data from Americans to be used in the political campaigns. Allan further said, that Kogan may still have collected European data, while most of the people who installed the app were Americans.

“But the data he delivered to Cambridge Analytica were the Americans’ data because that’s all they wanted,” Allan stated.

However, Facebook previously had announced that about 2.7 million Europeans may have had their data shared with Cambridge Analytica. Ursula Pachl, deputy director-general of European consumer group BEUC said: “I have to say I was a bit surprised by the statements,” by further adding, “this is a contradiction, I don’t know how it can be explained.”

European Court of Justice (ECJ): Facebook fanpages will be treated as a case of Joint Control

11. June 2018

With its judgment of June 5 2018, the ECJ decided that both the initiator of the fan pages (e.g. a company) and Facebook are jointly responsible in terms of the General Data Protection Regulation (GDPR) for the personal data collected within the scope of Facebook fan pages.

Fanpages are a Facebook profile of a company that can be used to easily communicate with customers.

Until now, information has been collected from customers who have contacted a company via Facebook. Depending on the type of use of the fan pages, the name and profile of the customer were stored. Facebook has also passed on information collected from users via tracking tools to the respective initiators of the fan pages. In the opinion of the ECJ, the affected users of the respective fan pages were not sufficiently informed about this fact, so that the following requirements must be observed in future:

Who visits a fan page must be informed about which data is collected for which purposes.

In consultation with Facebook, fan page operators must have their own knowledge of what data are collected in order to be able to inform them. This information is obligated pursuant to Art. 13 and 14 of the GDPR.

Before tracking tools and cookies are used, consent must be obtained.

Furthermore, companies and Facebook must become aware of their shared responsibility. It is not yet clear whether this will be done with a contract pursuant to Art. 26 GDPR on Joint Control or with an order data processing agreement pursuant to Art. 28 GDPR. Another solution may also be found.

However, this judgement will not only have consequences for Facebook, but will also affect all social media platforms. This not only affects companies that have their own company presence on Facebook, but also platforms such as LinkedIn, Twitter, Google+ etc., provided that similar tracking functions or other data surveys offer or are included.

Category: General

Under the new GDPR: Complaints against Google, Instagram, WhatsApp and Facebook

1. June 2018

On the 25th of May, the day the General Data Protection Regulation (GDPR) came into force, noyb.eu filed four complaints over “forced consent” against Google (Android), Instagram, WhatsApp and Facebook.

The complaints filed by the organisation (None Of Your Business) led by Austrian activist Schrems could result in penalties worth up to 7 billion euros. Max Schrems has been fighting Facebook over data protection issues for almost ten years. His earlier lawsuit challenged Facebook’s ability to transfer data from the European Union to the United States (“Safe Harbor”).

The activist alleged that people were not given a “free choice” whether to allow companies to use their data. Noyb.eu bases its opinion on the distinction between necessary and unnecessary data usage. “The GDPR explicitly allows any data processing that is strictly necessary for the service – but using the data additionally for advertisement or to sell it on needs the users’ free opt-in consent.” (See https://noyb.eu/wp-content/uploads/2018/05/pa_forcedconsent_en.pdf) The organisation also claims that under Art. 7 (4) of the GDPR forced consent is prohibited.

The broadly similar complaints have been filed in authorities in various countries, regardless of where the companies have their headquarters. Google (Android) in France (data protection authority: CNIL) with a maximum possible penalty in the amount of 3.7 billion euro although its headquarter is in the USA. Instagram (Facebook) in Belgium (DPA). WhatsApp in Hamburg (HmbBfDI) and Facebook in Austria (DSB). All of these last three have their headquarters in Ireland and could face a maximum possible penalty in the amount of 1.3 billion euro.

Pages: Prev 1 2 3 4 5 6 7 8 9 10 Next
1 3 4 5 6 7 10