7. November 2017
The EU-US Privacy Shield is intended to protect the data of EU citizens from the US scouting device. Critics, however, have serious doubts as to whether this is currently the case. The transatlantic data package has been in operation for over a year and has now undergone a first review. The Privacy Shield is the successor to the Safe Harbor Agreement, which was repealed in a sensational ruling by the European Court of Justice.
The purpose of the Privacy Shield is to achieve a similar level of data protection in the US as in the EU, so that the data of the EU citizens in the US are just as protected as here on land. In particular, it should be achieved:
– the data should be safe from excessive mass surveillance by US authorities (eg the NSA),
– an ombudsperson established in the State Department that EU citizens can contact directly,
– no indefinite storage of personal data of EU citizens by companies.
2400 companies have been certified for the Privacy Shield since its introduction. These include industry giants like Amazon, Tesla, Facebook and Google. Therefore, the importance of the Privacy Shield as a data protection regulation can not be denied. In addition to the certification remain as a legal basis only standard contractual clauses.
The first review shows, however, that the Privacy Shield is still controversial and the central demands, such as the Ombudsman, have not yet been implemented by the US government. In addition, US President Trump has already shortly after taking office, the privacy of non-Americans by way of a decree.
Nevertheless, responsible EU Justice Commissioner Vera Journová is not dissatisfied with the first year. While it is warned that the Ombudsperson should be appointed as soon as possible, she is confident that the US is now taking the concerns of Europeans seriously.
However, critics continue to complain that too little is done to enforce existing claims and that the Privacy Shield does not meet the requirements set out in the Safe Harbor ruling.
30. October 2017
Google released its Advanced Protection Program. The program is meant to make stealing passwords pointless. With help of two inexpensive physical keys it is possible to log in into the Google account on computer and smartphone.
Because of this two-factor authentication the account is secured. Even if the password is stolen in a data breach or successfully phished, the hackers cannot login, because they don’t have the keys as well. The minimal and cost effective effort has a big impact.
Google’s development of a two-factor authentication relies on a Chinese hacker attack in 2010. Since then Google’s motto is “Never ever”.
Addressees of the Program are according to Google people who have a high risk of online attacks, like journalists, victims of stalking and dissidents inside authoritarian countries. The idea of the program is to provide people with a physical device that is harder to steal than a text message or other two-factor authentication tools.
Except these people with a high risk, anyone with a Google account can sign up for the security program. Google has an Advanced Protection webpage for the sign up. In addition to the Advanced Protection Program to be able to use two physical keys are necessary. Each one costs about $20.
19. October 2017
The Article 29 Data Protection Working Party (WP29) adopted a guideline for the automated individual decision-making and profiling which are addressed by the General Data Protection Regulation (GDPR). The GDPR will be applicable from the 25th May 2018. WP29 acknowledges that “profiling and automated decision-making can be useful for individuals and organisations as well as for the economy and society as a whole”. “Increased efficiencies” and “resource savings” are two examples that were named.
However, it was also stated that “profiling and automated decision-making can pose significant risks for individuals’ rights and freedoms which require appropriate safeguards”. One risk could be that profiling may “perpetuate existing stereotypes and social segregation”.
The Guideline covers inter alia definitions of profiling and automated decision-making as well as the general approach of the GDPR to these. It is addressed that the GDPR introduces provisions to ensure that the use of profiling and automated decision-making does not have an “unjustified impact on individuals’ rights” and names examples, such as “specific transparency and fairness requirements” and “greater accountability obligations”.
13. October 2017
The Information Commissioner’s Office (ICO) has fined Vanquis Bank and advertising firm Xerpla £125,000 in total.
Vanquis Bank had sent over a million spam text messages and spam emails promoting its credit card. As the recipients had not given consent for such messages, Vanquis Bank’s marketing campaign was deemed illegal and a fine of £75,000 was imposed on the Bradford based bank.
Ad firm Xerpla had sent over a million spam emails promoting various products. The ad firm was fined £50,000 for not having the right consent of the recipients as it was not clear and specific enough.
“People need to be properly informed about what they are consenting to. Telling them their details could be passed to ‘similar organisations’ or ‘selected third parties’ cannot be relied upon as specific consent,” ICO Head of Enforcement Steve Eckersley said, adding, “these firms should have taken responsibility for ensuring they had obtained clear and specific consent for the sending of the messages. They didn’t and that is unacceptable.”
The UK government introduced the Data Protection Bill to implement the General Data Protection Regulation (GDPR – 2016/679).
The GDPR enters into force on 25th May 2018 in the European Union. After the brexit, until now it was unclear if the UK would implement the GDPR into UK domestic law. The Data Protection Bill implements not only the legal requirements of the GDPR. The Law Enforcement Directive (2016/680) and the standards of the Council of Europe’s draft modernized Convention 108 on processing of personal data carried out by the intelligence services will also be adopted in the new Data Protection Law of the UK.
The new Law will replace the existing UK Data Protection Act 1998.
Currently the bill is at the beginning of the parliamentary process. The first reading in the House of Lords was held on 13th September, the second on 10th October. The bill consist of seven parts and 18 Schedules.
The data flow between European countries and the UK will not cause those problems that caused concerns after the Brexit, because the data protection level in Europe and the UK will be equal.
6. October 2017
On October 3rd 2017, the Irish High Court publicised it will refer the Facebook case to the Court of Justice of the European Union (CJEU). The lawsuit is based on a complaint to the Irish Data Protection Commissioner filed by Max Schrems, an Austrian lawyer and privacy activist. Schrems was also involved in the case against Facebook resulting in the CJEU’s landmark decision declaring the Commission’s US Safe Harbour Decision invalid.
In his new complaint, Schrems is challenging the data transfers of Faceook to the US on the basis of the “Model Contracts for the transfer of personal data to third countries”, also known as standard contractual clauses (SCCs). Schrems himself said, “In simple terms, US law requires Facebook to help the NSA with mass surveillance and EU law prohibits just that.”
In contrast to Schrems, the Irish Data Protection Commissioner challenged the validity of the SCCs in general and not only in matters of Facebook. Due to the importance of the case, the Irish High Court referred it to the CJEU. The CJEU will now have to decide whether data transfers to the US are valid on the basis of the Commission’s Model Contracts. It remains to be seen what the CJEU will decide and if its decision will have an impact on the Privacy Shield framework.
2. October 2017
Moscow adds facial recognition to its network of 170.000 surveillance cameras across the city to be able to identify criminals and boost security, Bloomberg reports. The camera surveillance started in 2012. The recordings of the camera surveillance system have been held for five days after they are captured, with an amount of 20 million hours of video material stored at any one time. “We soon found it impossible to process such volumes of data by police officers alone,” Artem Ermolaev, who is Head of the Department of Information Technology in Moscow, said according to Bloomberg. “We needed an artificial intelligence to help find what we are looking for.”, he further said.
A Russian start-up, named N-Tech.Lab Ltd designed the facial recognition technology. The start-up is known for its mobile app FindFace which was released last year. With FindFace it is possible to search for users of the Russian social network VKontakte by making a picture of a person’s face and match it against the user profiles of VKontakte.
However, due to high costs the face recognition technology should not be deployed to every camera and therefore only be installed selectively within specific districts where it is needed the most. To maintain the camera surveillance, the Moscow government already should spend about $ 86 million a year and this amount would triple if every camera would use the new facial recognition technology.
The new technology is used to cross-reference images captured by the cameras with those from the Interior Ministry’s database.
27. September 2017
On September 13, 2017 a joint communication to the European Parliament and the Council of the European Union on “Resilience, Deterrence and Defence: Building strong cybersecurity for the EU” was published. This should strengthen the EU regarding the response of cyber attacks.
The joint communication includes:
- Greater EU resilience to cyber attacks
- Better detect cyber attacks
- Strengthen international cooperation on cybersecurity
and is part of a package of EU documents.
13. September 2017
The Spanish Data Protection Authority imposes a fine of €1,2m against Facebook. The social media network collects Personal Data of the users without a permission for this.
The responsible Data Protection Authority considers that Facebook collects personal information like gender, religious attitudes, personal preferences and personal beliefs without informing the persons concerned about the concrete use of this data.
The Data Protection Authority criticizes the unclear wording of Facebooks privacy policy. Moreover Facebook uses the personal data for advertising purposes without a permission. This constitutes a breach against Spanish Data Protection law.
Furthermore Facebook recognizes as well third party pages the user is referred if he clicks on links and illegally tracks visitors who are not Facebook users.
Finally is criticized that Facebook does not remove data, if a user unsubscribe the network. The collected information is stored for month even if the user terminates its account.
Not only Spain started an investigation against Facebook and imposes a fine as well as Spain also Belgium, France, Germany and the Netherlands are investigating against Facebook due to breaches against the local Data Protection law.
11. September 2017
The consumer credit reporting agency Equifax has been hacked in the middle of May. The operators have noticed the breach much later, on 29th July. The public has learned about the breach just last week on Thursday, 7th September.
The breach potentially affects the sensitive data of approximately 143 million consumers. Data concerned are the consumer’s name, social security numbers, birth dates, addresses and in some cases driver’s license numbers. As well as credit card numbers for 209.000 U.S. consumers and other dispute documents that contained identifying information for 182.000 consumers.
Not only the US is concerned. A hired third-party cybersecurity company also found some residents of the U.K. and Canada.
The Equifax Chairman and CEO Rick Smith announced steps Equifax is taking at the moment to respond on the breach and is working with authorities.
Pages: Prev 1 2 3 ... 46 47 48 49 50 51 52 ... 67 68 69 Next 
