Happy New Year!

1. January 2019

Dear readers,

the team of the blog privacy-ticker.com wish you a happy new year and all the best for 2019.

Once again this year we will keep you up to date on the subject of data protection.

Best regards,

privacy-ticker.com

Category: General

USA: Call for National Privacy Law

28. December 2018

The Association of National Advertisers (ANA) is urging the Federal Trade Commission (FTC) to work towards a national privacy legislation and prevent fragmentation of the U.S. privacy landscape.
In its plea, the ANA specifically raises concerns about current developments regarding the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). It deems both legislations to be overly restrictive and threatening to the free flow of information that “is vital to delivering the products and services that consumers value and expect” and asks the FTC to carry out a detailed review of the effects of the GDPR and the CCPA on competition and consumers.

The ANA is worried as “other states are considering additional and potentially inconsistent privacy and data security laws” and has been working with member companies and other industry groups to develop a new privacy paradigm that would be enforced by the FTC as a single national standard.

The approach involves allowing companies to use data considered “per se reasonable,” and prohibiting uses of data deemed “per se unreasonable.”
The reasonable practices “could include the collection and use of non-sensitive data for advertising purposes with consumer transparency and choice,” the ANA writes. Unreasonable ones “could include determining adverse terms or conditions or ineligibility for an individual’s: employment; credit; health care treatment; insurance; education and financial aid”.

The comments were filed in response to a request for input on the February 2019 FTC Hearing on Competition and Consumer Protection in the 21st Century, which will focus on consumer privacy.

Uber to pay another fine for 2016 data breach

27. December 2018

Uber’s major data breach of 2016 still has consequences as it has also been addressed by the French Data Protection Authority “CNIL”.

As reported in November 2017 and September 2018, the company had tried to hide that personal data of 50 million Uber customers had been stolen and chose to pay the hackers instead of disclosing the incident to the public.

1,4 million French customers were affected as well which is why the CNIL has now fined Uber 400K Euros (next to the settlement with the US authorities amounting to $148 Million).

The CNIL came to find out that the breach could have been avoided by implementing certain basic security measures such as stronger authentication.

Great Britain and the Netherlands have also already imposed a fine totalling €1 million.

Google changes Privacy Policy due to GDPR

19. December 2018

As it is widely known these days, the General Data Protection Regulation (GDPR) came into force earlier this year to standardize data protection regulation in the EU. This has now lead to the fact that Google will update the company’s terms of service and privacy policy to be compliant with the GDPR.

The company started to notify the countries in the European Economic Area (EEA) and Switzerland in regard to some upcoming changes. They will come into effect on January 22, 2019.

The most important update, also legally, is the change of the data controller. The Google Ireland Limited will become the so called “data controller” who is responsible for the information of European and Swiss users . Therefore, Google Ireland Limited will be in charge to respond to request from users and to ensure compliance with the GDPR. At present, these services are provided by Google LLC, based in the U.S.

For website operators this means that they might also have to adapt their privacy policy accordingly. This is the case, for example, if Google Analytics is used.

Furthermore, there are no changes in regard to the current settings and services.

Guidelines for Binding Corporate Rules issued in Argentina

18. December 2018

The Argentine Authority of Access to Public Information (Agencia de Acceso a la Información Pública – AAIP) has recently issued its guidelines for Binding Corporate Rules (BCRs) on international data transfer. The Binding Corporate Rules are a mechanism for multinational corporations to legitimize international transfers of personal data within the group. This tool for creating a contractually binding “code of conduct” regarding international data transfers was evolved in the EU and has also been incorporated expressly in Article 47 GDPR. BCRs have been designed as a global solution to comply with the principles of data protection and thus create an adequate level of data protection (cf. Art. 44, 47 GDPR).

Like the GDPR, the Argentine Personal Data Protection Law No. 25, 326 does not permit the cross-border transfer of personal data to countries or international organizations that do not provide an adequate level of data protection. Such transfers would be allowed in accordance with Regulatory Decree No. 1558/2001 when the data subjects expressly gave their consent to the transfer; an appropriate international data transfer agreement is in place; or an adequate protection level arises from self-regulation systems.

According to Regulation 159/2018 published Dec. 7, 2018, the AAIP has now approved guidelines for such BCRs that legitimize international data transfer to countries or international organizations that have not been recognized as providing an adequate level of data protection.

These guidelines provide a framework of principles for a self-regulation mechanism reflecting the requirements and conditions imposed by the Argentine Personal Data Protection Law. The rules of the self-regulation system have to be legally binding upon all members of the corporate group as well as employees, subcontractors and third-party beneficiaries (e.g. data subjects, AAIP). Among other things, those BCRs must consider lawfulness conditions of processing, data subjects’ rights and specific protection concerning sensitive aspects. Furthermore, the subsequent cross-border data transfer to those entities providing a non-adequate level of data protection shall be restricted, data subjects shall be able to place a judicial or administrative complaint and under the BCRs must an appropriate staff data protection training has to take place with regard to data processing activities.

The AAIP shall eventually be entitled to engage in international data transfers originating from an Argentine entity as data exporter and – as third-party beneficiary – in those cases in which personal data of subjects in Argentina is affected.

However, the approval of the AAIP of BCRs that follow the requirements of Regulation No. 159/2018 is not required. In the case a group of companies would rely on BCRs that differ from those conditions though, the relevant documents need to be submitted to the AAIP for approval within the term of 30 calendar days from the date that the transfer took place.

As a valid mechanism to legitimize the international transfer of data within a group of companies, the use of BCRs is been reasonably expected to increase when it comes to in Argentina.

Data Protection Commission announces statutory inquiry into Facebook

17. December 2018

The Irish Data Protection Commission announced in a press release on  December 14, 2018 that it had initiated a statutory inquiry into Facebook.

Due to the frequent, especially in the recent past, data breaches of the American company and the total number of reported data breaches since the GDPR came into force on May 25, 2018, the Irish Data Protection Commission has initiated an investigation into compliance with the relevant provisions of the GDPR against Facebook.

In recent weeks, reports of renewed breaches of data protection by Facebook have continued.

Most recently, it became known that the Italian competition authority AGCM had imposed a fine of 10 million euros on Facebook because the company had passed on data to other platforms without the express consent of the users and that a bug in the programming interface for picture processing led to third-party apps having access to pictures of 6.8 million Facebook users, some of which had not even been published by the users.

Android apps share sensitive information with Facebook

14. December 2018

According to the German information portal mobilsicher.de, about 30 % of all Android apps contact Facebook as soon as you start them. This also includes apps that are directly related to religion, sexual orientation or health. The user has usually no idea of this connection.

Mobilsicher.de tested out several Android app versions, which were available in the Play-Store on November 29, 2018. For example the Apps of the German political parties CDU and SPD.

App developers integrate so-called Software Development Kits (SDK) into their apps because they include the helpful “Facebook Analytics” function. This function provides the app operator with information on how users use the app. Facebook, on the other hand, receive the user’s advertising ID, which is individually assigned to each smartphone and, if available, can link this ID to the corresponding Facebook account. This leads to the fact that someone who has downloaded for example a pregnancy guide app now getting ads for baby clothes displayed on Facebook.

Facebook accesses user data even if they do not have a Facebook account at all. Upon request, the company confirmed that it is not clear to the user which data is transferred to Facebook. A tool called “Clear History”, announced by Mark Zuckerberg in May 2018, which should help this lack of transparency, is still not available.

Facebook itself does not consider this type of collecting data a problem, as users would have the option of opting out of personalized advertising and deactivating it either on their smartphone or in their Facebook account.

„If a person utilizes one of these controls, then Facebook will not use data gathered on these third-party apps (e.g. through Facebook Audience Network), for ad targeting”, the company replied to the question of whether the information would be deleted after the transfer. If someone decides against personalized advertising, Facebook still transfers the data, but with a corresponding note. Nevertheless, the user’s data will be collected.

French Data Protection Authority launches a public consultation on future standards – Data Processing for Managing Business Activities and Unpaid Invoices

12. December 2018

Due to the GDPR and the new French data protection law (“loi Informatique et Libertés”), the French Data Protection Authority (“CNIL”) launched two draft standards (in French: référentiels) on November 29, 2018. One o these CNIL’s draft standards deals with the processing of personal data to manage business activities, the other with unpaid invoices.

Until January 11, 2019 the possibility to consult the CNIL on the two draft Referentials will be open to the public. According to the CNIL, the draft standards will afterwards be adopted by the CNIL in plenary session.

CNIL’s Draft Referential on Data Processing for Managing Business Activities represents an update to the CNIL’s Simplified Norm No. 48 on the management of customers and prospective customers. It provides a framework for the implementation of “customer” and “prospect” files. The Draft Referential is applicable to data processing activities carried out by any data controller, except the following: health or educational institutions, banking or similar institutions, insurance companies and operators subject to approval by the French Online Gambling Regulatory Authority.

CNIL’s second draft (Draft Referential on Data Processing for Managing Unpaid Invoices) intends to provide a framework regarding the processing of personal data for managing unpaid invoices by private or public law entities. It does not apply to the processing of customer data for detecting risks of non-payment, or to identify other infringements (such as incivilities shown by customers).

Adherence to these two standards will ensure that the processing of unpaid invoices and business activities comply with current data protection principles.

Category: French DPA · GDPR · General

Electronic receipts sent by leading retailers may not comply with data protection rules

After investigating several large retailers the consumer body Which? claims that many retailers in the UK include in their e-receipt marketing messages.

A lot of retailers offer the possibility to send digital receipts instead of paper receipts to the shoppers. However, it should be noted that when the General Data Protection Regulation (GDPR) came into force on May 25th earlier this year, the regulations concerning this area were tightened.

Retailers are not allowed to send direct marketing to new customers by email unless the recipient has consented to receive it. Shoppers must be given the opportunity to opt out in case the retailer asks for their email address at the point of sale with the intention to afterwards send marketing information.

According to Which? the following companies were visited at least three times by “mystery shoppers” to test if they send out unwanted marketing information in their e-receipts: Topshop, Dorothy Perkins, Nike, Clarks, New Look, Arcadia Group (Miss Selfridge, Outfit, Burton), Gap, Mothercare, Halfords, Currys PC World and Schuh. The “mystery shoppers” requested an electronic receipt without receiving any additional marketing.

The retailers dealt with this situation differently. One shop apparently sent a marketing email with the e-receipt as an attachment, while others included prompts to sign up for a newsletter or invitations to complete a survey in return for money off a future purchase. The concern is that consumers might be “bombarded” with unwanted marketing messages.

Spain publishes new data protection law

11. December 2018

On December 6, 2018, the new Spanish data protection law was published in the “Boletín Oficial Del Estado”. The “Ley Orgánica de Protección de Datos Personales y Garantía de los Derechos Digitales” (Organic Law on Data Protection and Digital Rights Guarantee) has been approved with 93% parliamentary support and implements the GDPR into national law.

The new law contains a number of regulations that will affect data processing operations. For example that the consent of a data subject is not enough to legitimate the processing of special categories of data if the main purpose is e.g. to identify an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or genetic data.

The law also includes a list of cases in which entities must appoint a data protection officer for example entities that operate networks and provide electronic communications services, education centres and public and private universities. All businesses have up to 10 days after (mandatory or voluntary) appointing a data protection officer to notify the Spanish Data Protection Authority of that fact.

However, one of the biggest changes is the introduction of new digital rights such as the right to universal access to the internet; the right to digital education; the right to privacy and use of digital devices in the workplace; the right to digital disconnection in the workplace; the right to privacy in front of video surveillance devices and sound recording at work; the right to digital will.

Pages: Prev 1 2 3 ... 7 8 9 10 11 12 13 ... 37 38 39 Next
1 8 9 10 11 12 39