Uber hid massive data breach

22. November 2017

Uber just admitted that hackers stole personal data of 50 million Uber customers and 7 million drivers. The data breach happened in October 2016, over a year ago, but was only published this week.

The data include names, e-mail addresses, phone numbers and the license numbers of 600.000 drivers. According to Uber neither social security numbers, nor credit card information, or trip location details were taken.

Uber did not disclose the data breach to public, as required by data protection law, but paid the hackers 100.000,00 $ to delete the information. Uber assumes that the data was not used.

Referring to Uber the hackers came in through a badly protected database in a cloud service to the data. Uber security Chief Joe Sullivan and another manager lost their jobs.

This data breach wasn’t the first incident that happened to Uber. Uber has a well-documented history of abusing consumer privacy.

Uber said it has hired Matt Olsen, former general counsel at the National Security Agency and director of the National Counterterrorism Center, as an adviser.  He will help the company restructure its security teams.

Category: Cyber security · Data breach · USA
Tags:

Vast majority of European businesses unprepared for GDPR

20. November 2017

According to a study only 8 % of businesses are ready for the EU General Data Protection Regulation (GDPR) and nearly one third of the companies are even unaware of the GDPR, coming into effect on 25. May 2018.

Although the new Regulation is considered too complex especially for small and medium-sized businesses, the majority of businesses agree that new rules in the field of personal data protection are necessary.

Infringements of GDPR provisions could lead to fines of up to €20 million or 4 % of the total worldwide annual turnover for the preceding financial year, whichever is higher.

Category: GDPR

One year Privacy Shield

7. November 2017

The EU-US Privacy Shield is intended to protect the data of EU citizens from the US scouting device. Critics, however, have serious doubts as to whether this is currently the case. The transatlantic data package has been in operation for over a year and has now undergone a first review. The Privacy Shield is the successor to the Safe Harbor Agreement, which was repealed in a sensational ruling by the European Court of Justice.

The purpose of the Privacy Shield is to achieve a similar level of data protection in the US as in the EU, so that the data of the EU citizens in the US are just as protected as here on land. In particular, it should be achieved:

the data should be safe from excessive mass surveillance by US authorities (eg the NSA),
an ombudsperson established in the State Department that EU citizens can contact directly,
no indefinite storage of personal data of EU citizens by companies.

2400 companies have been certified for the Privacy Shield since its introduction. These include industry giants like Amazon, Tesla, Facebook and Google. Therefore, the importance of the Privacy Shield as a data protection regulation can not be denied. In addition to the certification remain as a legal basis only standard contractual clauses.

The first review shows, however, that the Privacy Shield is still controversial and the central demands, such as the Ombudsman, have not yet been implemented by the US government. In addition, US President Trump has already shortly after taking office, the privacy of non-Americans by way of a decree.

Nevertheless, responsible EU Justice Commissioner Vera Journová is not dissatisfied with the first year. While it is warned that the Ombudsperson should be appointed as soon as possible, she is confident that the US is now taking the concerns of Europeans seriously.

However, critics continue to complain that too little is done to enforce existing claims and that the Privacy Shield does not meet the requirements set out in the Safe Harbor ruling.

Google: Advanced Protection Program released

30. October 2017

Google released its Advanced Protection Program. The program is meant to make stealing passwords pointless. With help of two inexpensive physical keys it is possible to log in into the Google account on computer and smartphone.
Because of this two-factor authentication the account is secured. Even if the password is stolen in a data breach or successfully phished, the hackers cannot login, because they don’t have the keys as well. The minimal and cost effective effort has a big impact.
Google’s development of a two-factor authentication relies on a Chinese hacker attack in 2010. Since then Google’s motto is “Never ever”.
Addressees of the Program are according to Google people who have a high risk of online attacks, like journalists, victims of stalking and dissidents inside authoritarian countries. The idea of the program is to provide people with a physical device that is harder to steal than a text message or other two-factor authentication tools.
Except these people with a high risk, anyone with a Google account can sign up for the security program. Google has an Advanced Protection webpage for the sign up. In addition to the Advanced Protection Program to be able to use two physical keys are necessary. Each one costs about $20.

WP29: Guideline for profiling and automated decision-making

19. October 2017

The Article 29 Data Protection Working Party (WP29) adopted a guideline for the automated individual decision-making and profiling which are addressed by the General Data Protection Regulation (GDPR). The GDPR will be applicable from the 25th May 2018. WP29 acknowledges that “profiling and automated decision-making can be useful for individuals and organisations as well as for the economy and society as a whole”. “Increased efficiencies” and “resource savings” are two examples that were named.

However, it was also stated that “profiling and automated decision-making can pose significant risks for individuals’ rights and freedoms which require appropriate safeguards”. One risk could be that profiling may “perpetuate existing stereotypes and social segregation”.

The Guideline covers inter alia definitions of profiling and automated decision-making as well as the general approach of the GDPR to these. It is addressed that the GDPR introduces provisions to ensure that the use of profiling and automated decision-making does not have an “unjustified impact on individuals’ rights” and names examples, such as “specific transparency and fairness requirements” and “greater accountability obligations”.

ICO fines bank and ad firm for illegal marketing

13. October 2017

The Information Commissioner’s Office (ICO) has fined Vanquis Bank and advertising firm Xerpla £125,000 in total.

Vanquis Bank had sent over a million spam text messages and spam emails promoting its credit card. As the recipients had not given consent for such messages, Vanquis Bank’s marketing campaign was deemed illegal and a fine of £75,000 was imposed on the Bradford based bank.

Ad firm Xerpla had sent over a million spam emails promoting various products. The ad firm was fined £50,000 for not having the right consent of the recipients as it was not clear and specific enough.

“People need to be properly informed about what they are consenting to. Telling them their details could be passed to ‘similar organisations’ or ‘selected third parties’ cannot be relied upon as specific consent,” ICO Head of Enforcement Steve Eckersley said, adding, “these firms should have taken responsibility for ensuring they had obtained clear and specific consent for the sending of the messages. They didn’t and that is unacceptable.”

UK government introduced Data Protection Bill

The UK government introduced the Data Protection Bill to implement the General Data Protection Regulation (GDPR – 2016/679).

The GDPR enters into force on 25th May 2018 in the European Union. After the brexit, until now it was unclear if the UK would implement the GDPR into UK domestic law. The Data Protection Bill implements not only the legal requirements of the GDPR. The Law Enforcement Directive (2016/680) and the standards of the Council of Europe’s draft modernized Convention 108 on processing of personal data carried out by the intelligence services will also be adopted in the new Data Protection Law of the UK.

The new Law will replace the existing UK Data Protection Act 1998.

Currently the bill is at the beginning of the parliamentary process. The first reading in the House of Lords was held on 13th September, the second on 10th October. The bill consist of seven parts and 18 Schedules.

The data flow between European countries and the UK will not cause those problems that caused concerns after the Brexit, because the data protection level in Europe and the UK will be equal.

Irish High Court refers Facebook case to the CJEU

6. October 2017

On October 3rd 2017, the Irish High Court publicised it will refer the Facebook case to the Court of Justice of the European Union (CJEU). The lawsuit is based on a complaint to the Irish Data Protection Commissioner filed by Max Schrems, an Austrian lawyer and privacy activist. Schrems was also involved in the case against Facebook resulting in the CJEU’s landmark decision declaring the Commission’s US Safe Harbour Decision invalid.

In his new complaint, Schrems is challenging the data transfers of Faceook to the US on the basis of the “Model Contracts for the transfer of personal data to third countries”, also known as standard contractual clauses (SCCs). Schrems himself said, “In simple terms, US law requires Facebook to help the NSA with mass surveillance and EU law prohibits just that.”

In contrast to Schrems, the Irish Data Protection Commissioner challenged the validity of the SCCs in general and not only in matters of Facebook. Due to the importance of the case, the Irish High Court referred it to the CJEU. The CJEU will now have to decide whether data transfers to the US are valid on the basis of the Commission’s Model Contracts. It remains to be seen what the CJEU will decide and if its decision will have an impact on the Privacy Shield framework.

Moscow adds facial recognition to its network of surveillance cameras

2. October 2017

Moscow adds facial recognition to its network of 170.000 surveillance cameras across the city to be able to identify criminals and boost security, Bloomberg reports. The camera surveillance started in 2012. The recordings of the camera surveillance system have been held for five days after they are captured, with an amount of 20 million hours of video material stored at any one time. “We soon found it impossible to process such volumes of data by police officers alone,” Artem Ermolaev, who is Head of the Department of Information Technology in Moscow, said according to Bloomberg. “We needed an artificial intelligence to help find what we are looking for.”, he further said.

A Russian start-up, named N-Tech.Lab Ltd designed the facial recognition technology. The start-up is known for its mobile app FindFace which was released last year. With FindFace it is possible to search for users of the Russian social network VKontakte by making a picture of a person’s face and match it against the user profiles of VKontakte.

However, due to high costs the face recognition technology should not be deployed to every camera and therefore only be installed selectively within specific districts where it is needed the most. To maintain the camera surveillance, the Moscow government already should spend about $ 86 million a year and this amount would triple if every camera would use the new facial recognition technology.

The new technology is used to cross-reference images captured by the cameras with those from the Interior Ministry’s database.

Measures to strengthen the EU cybersecurity published

27. September 2017

On September 13, 2017 a joint communication to the European Parliament and the Council of the European Union on “Resilience, Deterrence and Defence: Building strong cybersecurity for the EU” was published. This should strengthen the EU regarding the response of cyber attacks.

The joint communication includes:

  • Greater EU resilience to cyber attacks
  • Better detect cyber attacks
  • Strengthen international cooperation on cybersecurity

and is part of a package of EU documents.

Pages: Prev 1 2 3 4 5 6 7 8 9 10 ... 23 24 25 Next
1 3 4 5 6 7 25