Brexit: Deal or “No-deal”

12. March 2019

Yesterday evening, shortly before the vote of the UK parliament on the circumstances and if necessary a postponement of the Brexit, Theresa May met again with Jean-Claude Juncker in Strasbourg. Both sides could agree on “clarifications and legal guarantees” regarding the fall-back solution for Northern Ireland.

These (slightly) expand the United Kingdom’s (UK) opportunity to appeal to an arbitration court in the event that the EU should “hold the UK hostage” in terms of the membership of the customs union by means of the Backstop-Clause beyond 2020. This “legally binding instrument”, as Juncker said, intends to clarify that the Backstop-Clause on the Irish border is not to be regarded as a permanent solution. This shall also be confirmed in a joint political declaration on the future relations between the two sides. However, the wording of the complementary regulation is legally vague.

May is nevertheless confident that the British Parliament will approve the “new” agreement to be voted on tonight. Meanwhile, Jeremy Corbyn, Labour Party leader, has announced and urged to vote against the agreement. In any case, Juncker has already rejected further negotiations on adjustments to the current version of the withdrawal agreement, emphasizing that there will be no “third chance”. By 23rd May, when the EU elections begin, the Kingdom shall have left the EU.

The vote on “how” and “when” of the Brexit will be taken in the next few days, starting tonight at 8 p.m. CET. If the withdrawal agreement will be rejected again today, the parliament will vote on a no-deal Brexit tomorrow (the UK would then be a third country in the sense of the GDPR as of 30th March). In case this will also be rejected, on 14th March the parliament will eventually vote on a delay of the Brexit date. A postponement could then lead to a new referendum and thus to a renewed decision on the question of “whether” a Brexit will actually take place.

Category: EU · GDPR · General · UK
Tags:

Dutch DPA: Cookie walls do not comply with GDPR

11. March 2019

The Dutch data protection authority, Autoriteit Persoonsgegevens, clarified on 7th of March 2019 that the use of websites must remain accessible when tracking cookies are not accepted. Websites that allow users to access only if they agree to the use of tracking cookies or other similar means to track and record their behavior do not comply with the General Data Protection Regulation, GDPR.

The Dutch DPA’s decision was prompted by numerous complaints from website users who no longer had access to the websites after refusing the usage of tracking cookies.

The Dutch DPA noted that the use of tracking software is generally allowed. Tracking the behaviour of website users, however, must be based on sufficient consent. In order to be compliant with the GDPR, permission must be given freely. In the case of so-called cookie walls the user has no access to the website if he does not agree to the setting of cookies. In this way, pressure is exerted on the user to disclose his personal data. Nevertheless, according to the GDPR a consent has not been given voluntarily if no free or no real choice exists.

With publication of the explanation the Dutch DPA demands organizations to make their practice compliant with the GDPR. The DPA has already written to those organisations about which the users have complained the most. In addition, it announced that it would intensify its monitoring in the near future in order to examine whether the standard is applied correctly in the interest of data protection.

EDPB publishes information note on data transfer in the event of a no-deal Brexit

25. February 2019

The European Data Protection Board has published an information note to explain data transfer to organisations and facilitate preparation in the event that no agreement is reached between the EEA and the UK. In case of a no-deal Brexit, the UK becomes a third country for which – as things stand at present – no adequacy decision exists.

EDPB recommends that organisations transferring data to the UK carry out the following five preparation steps:

• Identify what processing activities will imply a personal data transfer to the UK
• Determine the appropriate data transfer instrument for your situation
• Implement the chosen data transfer instrument to be ready for 30 March 2019
• Indicate in your internal documentation that transfers will be made to the UK
• Update your privacy notice accordingly to inform individuals

In addition, EDPB explains which instruments can be used to transfer data to the UK:
– Standard or ad hoc Data Protection Clauses approved by the European Commission can be used.
– Binding Corporate Rules for data processing can be defined.
– A code of conduct or certification mechanism can be established.

Derogations are possible in the cases mentioned by article 49 GDPR. However, they are interpreted very restrictively and mainly relate to processing activities that are occasional and non-repetitive. Further explanations on available derogations and how to apply them can be found in the EDPB Guidelines on Article 49 of GDPR.

The French data protection authority CNIL has published an FAQ based on the information note of the EDPB, explaining the consequences of a no-deal Brexit for the data transfer to the UK and which preparations should be made.

Brexit: Authorities will enforce unlawful data transfers

It seems very likely that the UK will leave the EU under a “no-deal” Scenario and become a third country in terms of data protection. Beside the fact that in the absence of an adequacy decision each transfer of personal data between the EU and the UK will need to be appropriately safeguarded, UK companies making business in the EU may have to designate an EU representative. In addition, according to the GDPR, companies concerned with the cross-border transfer of personal data obtained within the area of the EU will need to consider specific documentation and information obligations.

As the UK and the EU could not even agree on a transition period yet, all these data protection obligations are required to be in place as of the 30th March, 00:00 h (CET). The data protection authorities of the EU already announced that they will not grant a transition period regarding the required data protection measures and actions pursuant to the GDPR that need to be taken. The unlawful transfer or processing of personal data to or within the UK will thus not be tolerated by the EU supervisory authorities as of day one after BREXIT. Bearing this in mind, first and foremost, the EU Commission’s Standard Contractual Clauses should be in place if there is no other appropriate safeguard, e.g. Binding Corporate Rules (BCR), existent to ensure the lawfulness of the transfer of EU personal data.

If not yet done, now is the time to think about the required steps and develop a “BREXIT data protection strategy” in order to be compliant with the GDPR when the UK leaves the EU under a “no-deal” BREXIT.

Category: General

Massive data breach in Sweden: Millions of Health Hotline Calls exposed online

22. February 2019

Recently around 2.7 million sensitive phone calls were uncovered by Swedish technology news site Computer Sweden. In total, 170,000 hours of conversation were available online on an unencrypted web server. The server had no login mechanism so the recorded calls could be accessed freely.

Sweden operates a national health advice line (1177), which is run by Swedish company Medhelp. For out-of-hour calls they subcontract with a Thailand-based firm called Medicall. According to repords, most of the uncovered calls were made outside the regular times and therefore answered by Medicall. A request from the BBC left Medicall unanswered.

The uncovered data is extremely private as People usually call 1177 seeking medical advice, talking about their symptoms, their kids’ illnesses and giving out their social security number.
The Swedish Data Protection Authority is currently investigating the case.

Australia: Parliament and Parties hacked

18. February 2019

Prime Minister Scott Morrison reports that the governing Liberal Party of Australia and the governing National Party of Australia as well as the strongest opposition party, Labor Party were the target of an cyber attack on Parliament’s server. It is assumed that the server was attacked by a foreign government. Not affected by the breach were the ministers an their offices because they operate on different computer servers.

The attack was discovered on the 8th of February 2019 during an investigation of a breach of Parliament House’s computer. According to the statement of the nation’s chief cyber security adviser, Alistair MacGibbon, who is the head of the Australian Cyber Security Centre, it is too early to tell whether and what information the hackers had accessed.

At the moment, election influences of the upcoming nationwide elections can be excluded.

As a first measure the security agency reset passwords after detecting the breach so that the politicians and their staff lost access to their emails.

 

The European Data Protection Board presents Work Program for 2019/2020

14. February 2019

On February 12, 2019 the European Data Protection Board (EDPB) released on their website a document containing a two-year Work Program.

The EDPB acts as an independent European body and is established by the General Data Protection Regulation (GDPR). The board is formed of representatives of the national EU and EEA EFTA data protection supervisory authorities, and the European Data Protection Supervisor (EDPS).

The tasks of the EDPB are to issue guidelines on the interpretation of key ideas of the GDPR as well as the ruling by binding decisions on disputes regarding cross-border processing activities. Its objective is to ensure a consistent application of EU rules to avoid the same case potentially being dealt with differently across various jurisdictions. It promotes cooperation between EEA EFTA and the EU data protection supervisory authorities.

The EDPB work program is based on the needs identified by the members as priority for individuals, stakeholders, as well as the EU legislator- planned activities. It contains Guidelines, Consistency opinions, other types of activities, recurrent activities and possible topics.

Furthermore, the EDPB released an information note about data transfers if a no-deal Brexit occurs. As discussed earlier, in this case the UK will become a so-called “third country” for EU member countries beginning from March 30. According to the UK Government, the transfer of data from the UK to the EEA will remain unaffected, permitting personal data to flow freely in the future.

Apple advises app developer to reveal or remove code for screen recording

12. February 2019

After TechCrunch initiated investigations that revealed that numerous apps were recording screen usage, Apple called on app developers to remove or at least disclose the screen recording code.

TechCrunch’s investigation revealed that many large companies commission Glassbox, a customer experience analytics firm, to be able to view their users’ screens and thus follow and track keyboard entries and understand in which way the user uses the app. It turned out that during the replay of the session some fields that should have been masked were not masked, so that certain sensitive data, like passport numbers and credit card numbers, could be seen. Furthermore, none of the apps examined informed their users that the screen was being recorded while using the app. Therefore, no specific consent was obtained nor was any reference made to screen recording in the apps’ privacy policy.

Based on these findings, Apple immediately asked the app developers to remove or properly disclose the analytics code that enables them to record screen usage. Apples App Store Review Guidelines require that apps request explicit user consent and provide a clear visual indication when recording, logging, or otherwise making a record of user activity. In addition, Apple expressly prohibits the covert recording without the consent of the app users.

According to TechCrunch, Apple has already pointed out to some app developers that they have broken Apple’s rules. One was even explicitly asked to remove the code from the app, pointing to the Apple Store Guidelines. The developer was given less than a day to do so. Otherwise, Apple would remove the app from the App Store.

 

620 million accounts available for sale on dark web

According to the British news website The Register, 620 million accounts from hacked websites are for sale on dark web. For less than $20.000 in Bitcoin, people can buy the stolen accounts on Dream Market, located in the Tor network. Criminals should also be able to buy the copied user data individually. The data comes from hacks from the years 2016 to 2018. Some were already known others now became acquianted.

Among the sixteen hacked websites are the video messaging application Dubsmash (162 million accounts), the diet and exercise app MyFitnessPal (151 million accounts) and the family-tree-tracking service MyHeritage (92million accounts).

As reported by The Register, the account records appear to be legit. The data leak contains e-mail addresses, names and passwords but it does not contain any bank or credit card information and the passwords are encrypted and must therefore be decoded before they can be used.

Depending on the affected side, there are also a few other categories of personal information such as social media authentication tokens. It can be expected that the vendees will use the data for credential stuffing attacks. In such attacks, attackers try out lists with email password pairs at various online services to hack accounts. These attacks are made possible because many users reuse the same password across many websites.

The seller told The Register that they possess one billion accounts in total and that their aim is to make “life easier” for hackers. The seller said “I don’t think I am deeply evil, I need the money. I need the leaks to be disclosed […] I’m just a tool used by the system. We all know measures are taken to prevent cyber attacks, but with these upcoming dumps, I’ll make hacking easier than ever.”

 

Update: 127 million more stolen accounts appeared a few days ago. Affected sites include architecture, interior and designe website Houzz (57 million records), live-video streaming site YouNow (40 million records) and travel booking site Ixigo (18 million records). This data is sold by the hacker for a total of $14,500 in Bitcoin.

Austria: Deletion does not necessarily mean destruction

Article 17 of the General Data Protection Regulation (GDPR) stipulates the data subject the right to erasure, also called right to be forgotten. The Austrian Data Protection Authority decided that the right to erasure not necessarily mean destruction of the stored data. According to the Authority anonymization may be sufficient.

The decision is based on a complaint of an Austrian who request his former insurance company to delete all stored data. The insurance company deleted his e-mail address and phone number as well as insurance offers and stopped all advertising. However, name and address of the data subject were anonymized and the insurance company told the data subject that the data would be destructed in March 2019.

The Austrian Data Protection Authority proved the company right. According to Art. 4 Nr. 2 GDPR the company can choose whether it deletes or destructs the stored data, it only had to “be ensured that neither the person responsible himself nor a third party can restore a personal reference without disproportionate effort”, explained the Authority.

Pages: Prev 1 2 3 4 5 6 7 8 9 10 ... 32 33 34 Next
1 2 3 4 5 34