GDPR: A simple explainer

guest · Feb 4, 2020

Guess What? GDPR Enforcement Is On Fire!
January 28, 2020
https://go.forrester.com/blogs/guess-what-gdpr-enforcement-is-on-fire/

You read that right: GDPR enforcement is on fire! While fines are not always particularly high, our analysis shows that, in terms of volume, data protection authorities (DPAs) are rapidly increasing their GDPR enforcement activities. Some interesting trends are also emerging:

• DPAs have levied 190 fines and penalties to date. With 43 enforcement decisions made so far, Spain leads the pack as Europe’s most active regulator, followed by Romania (21) and Germany (18). [...]
• Failures of data governance — not security — trigger the most fines and penalties. DPAs have primarily acted against the infringement of Article 5 (principles of processing of personal data) and Article 6 (lawfulness of processing). [...]
• Breaches get the enforcement ball rolling but are just a starting point. Many security and risk (S&R) and privacy pros expected security infringements and missed breach notifications to be the main triggers of GDPR enforcement [...]
Click to expand...

guest · Feb 21, 2020

72 hours and counting: Reporting data protection breaches under the GDPR
February 21, 2020
https://www.itgovernance.co.uk/blog/how-long-do-you-have-to-report-a-data-breach

The first 72 hours after you discover a data breach are critical.
Why? The GDPR (General Data Protection Regulation) requires all organisations to report certain types of personal data breach to the relevant supervisory authority

More specifically, Article 33 says that, in the event of a personal data breach, data controllers should notify the appropriate supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it.
But how do you report a data breach, and what are the pitfalls when it comes to meeting this requirement?

In this post, we explain everything you need to know.
Click to expand...

guest · Mar 6, 2020

Polish school hit with GDPR fine for using fingerprints to verify students’ lunch payments
March 6, 2020
https://venturebeat.com/2020/03/06/...ngerprints-to-verify-students-lunch-payments/

A school in Poland has been fined €4,600 ($5,200) for breaching Europe’s General Data Protection Regulation (GDPR) after it was found to be processing students’ fingerprint data to verify whether they had paid for school lunch.
The unidentified school in Gdansk, a city in northern Poland, processed the fingerprints of hundreds of children “without a legal basis,” according to a statement by Jan Nowak, pesident of Poland’s Personal Data Protection Office (UODO).
The GDPR factor
The final decision cited numerous facets of GDPR, including recital 38, which refers to specific provisions made for data protection of children. “It should be emphasized that children require special protection of personal data, as they may be less aware of the risks, consequences, safeguards, and rights they have in connection with the processing of personal data,” the report found.

This includes fingerprints, iris scans, hand geometry, voice recognition, and facial scans. Indeed, the latest GDPR privacy fallout comes shortly after a Swedish school was fined €20,000 ($23,000) under GDPR for conducting a facial recognition pilot program that tracked students’ attendance.
Click to expand...

guest · Mar 13, 2020

GDPR: lawful bases for processing, with examples
First published June 2018. Last updated March 2020
https://www.itgovernance.co.uk/blog/gdpr-lawful-bases-for-processing-with-examples

Under the EU GDPR (General Data Protection Regulation), you need to identify a lawful basis before processing personal data. But what is a lawful basis for processing? Do you always need individuals’ consent to process their data? And what exactly are ‘legitimate interests’?

The GDPR defines processing as “any operation or set of operations that is performed on personal data, whether by automated means or not, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, erasure, or destruction”.

Before you do any of these things, you need to identify a lawful basis for doing so, according to Article 6. [...]
Click to expand...

guest · Mar 23, 2020

Peter Parker and Nick Dunn: Seven myths of the GDPR
March 23, 2020
https://www.civilsociety.co.uk/finance/peter-parker-and-nick-dunn-seven-myths-of-the-gdpr.html

The biggest change in data protection law for 20 years is now firmly in place. We now live in the GDPR world in which personal information has gained added value, given the level of fines which organisations face should they fail to adequately protect the information they hold.

However, many myths surrounding the GDPR persist, whether through misinformation, lack of awareness or snake oil solutions being offered by some advisers. In advising charities and social enterprises, we come across many of these myths. In this article, we look to debunk some of the most common misunderstandings we see when advising charities and social enterprises on their responsibilities when it comes to data protection.
Click to expand...

guest · Mar 24, 2020

GDPR data subject access requests (DSARs): How to respond – free guide
March 23, 2020
https://www.itgovernance.co.uk/blog/how-to-respond-to-a-data-subject-access-request

The GDPR (General Data Protection Regulation) grants data subjects the right to access their personal data. This is known as a DSAR (data subject access request).
This is not a new concept, but the GDPR introduced several changes that make responding to them more challenging.

Organisations now have less time to respond and can only charge a fee to complete a request under certain circumstances.
Let’s take a look at everything you need to know about DSARs, including how to respond to them in line with the GDPR’s requirements.
Click to expand...

Minimalist · Apr 6, 2020

British Airways and Marriott UK data protection fines deferred again as coronavirus shutdown hits business

The UK Information Commissioner's Office has yet again postponed its £280m in fines against British Airways and Marriott Hotels for data leaks.
Click to expand...

https://www.theregister.co.uk/2020/04/06/ico_data_protection_fines_ba_marriott_hack_postponed/

guest · Apr 30, 2020

Europe’s GDPR Regulators Woefully Under-Resourced
April 30, 2020
https://www.infosecurity-magazine.com/news/europes-gdpr-regulators-woefully/

Europe’s data protection regulators are woefully under-staffed with technology experts and financial resources, meaning they can’t adequately enforce the GDPR against Big Tech’s legal firepower, according to new data from Brave.

The web browser company claimed in a new report this week that Europe’s governments have failed to arm their data protection authorities (DPAs) with the tools they need to enforce the GDPR — which is an obligation under Article 52(4) of the regulation.
As a result, it has filed a complaint with the European Commission against 27 member states, requesting it launch an infringement procedure against them.

“If the GDPR is at risk of failing, the fault lies with national governments, not with the data protection authorities,” said Brave chief policy officer, Johnny Ryan.
Brave argued that this lack of resources mean infringements by tech giants are either not investigated or limited because the DPAs don’t have the capacity to defend their decisions in court.
Click to expand...

Brave: New data on GDPR enforcement agencies reveal why the GDPR is failing

New data from Brave show that European governments have not equipped their national authorities to enforce the GDPR
Click to expand...

guest · May 16, 2020

ICO’s BA and Marriott Fines Likely to Be Pushed Back Again
May 15, 2020
https://www.infosecurity-magazine.com/news/icos-ba-and-marriott-fines-pushed/

Legal experts have warned of more potential delays to the official GDPR fines set to be handed down to British Airways and Marriott International, potentially undermining the authority of the UK regulator.

The initial six-month period from notice of intent to fine was extended to May 2020, according to BA’s recent annual report.
However, experts at Cordery Compliance now believe the deadline will be pushed back again due to COVID-19, to around August-September time.

“Our understanding is that whilst still emphasizing the seriousness of the breaches, the ICO will apply a lenient approach to the amount of the fines due to the financial impact of COVID-19,” the compliance firm added in an alert.
“Although the impact of COVID-19 may explain some of the current continued delay, quite why what may end up being over a year to resolve these matters since the ICO announced its intentions to fine may leave some wondering whether GDPR enforcement is going as quickly as it should,” said Cordery.
Click to expand...

guest · May 18, 2020

The hidden cost of GDPR data access requests
May 18, 2020
https://betanews.com/2020/05/18/gdpr-data-access-costs/

UK businesses are spending £1.59 million and 24 person-years annually on processing data subject access requests in compliance with Article 15 of GDPR, according to a new study commissioned by privacy specialist Guardum.
Data Subject Access Requests (DSARs) require data controllers to provide data subjects with a copy of their personal data within 30 days, or risk a fine of €20 million or four percent of turnover.

The study, conducted by Sapio Research among 100 data protection officers DPOs from companies with 250 or more employees, also highlights the challenges of maintaining compliance during lockdown. 75 percent of DPOs polled admit struggling to meet data compliance obligations while working remotely and ercent fear they will be overwhelmed by a post-pandemic DSAR storm fuelled by requests from furloughed or sacked employees.

This research graphically illustrates the huge burden that data privacy professionals are shouldering to maintain data compliance," says Rob Westmacott, co-founder of Guardum.
Click to expand...

Guardum: Guardum DPO survey results

Below are the results of independent research, conducted by Sapio Research among 100 DPOs from companies with 250 or more employees between 29th April and 5th May 2020.
Click to expand...

guest · May 20, 2020

Tusla fined €75,000 for three GDPR violations
May 20, 2020
https://itgovernance.eu/blog/en/tusla-fined-e75000-for-three-gdpr-violations

Tusla, Ireland’s child and family agency, has been fined €75,000 for three breaches of the GDPR (General Data Protection Regulation).

It was found to have disclosed the personal information of children to unauthorised parties on three occasions.
In one instance, the contact and location data of a mother and child was disclosed to an alleged abuser. The other cases related to personal data about children in foster care being disclosed to blood relatives.
Tusla takes responsibility
A spokesperson for Tusla said the organisation didn’t intend to contest the fine and will accept and respect the DPC’s (Data Protection Commission) decision.

“Tusla is acutely aware of its responsibilities in relation to the very sensitive data we work with on a daily basis,” she said.
Click to expand...

ronjor · May 21, 2020

Grandmother ordered to delete Facebook photos under GDPR

BBC 20 May 2020
A woman must delete photographs of her grandchildren that she posted on Facebook and Pinterest without their parents' permission, a court in the Netherlands has ruled.
It ended up in court after a falling-out between the woman and her daughter.
Click to expand...

guest · May 25, 2020

GDPR: 2 Years On, Is It Time To Relax The Rules In The Midst Of The Current Pandemic?
May 24, 2020
https://www.informationsecuritybuzz...e-rules-in-the-midst-of-the-current-pandemic/

Over the past two years, the majority of us have become much more aware of who we are giving our data to, and how it is used because of the General Data Protection Regulation (GDPR). Put into place two years ago to protect our security and privacy, the GDPR has heightened our awareness of how our data is being used and given us a chance to execute our right to be forgotten.

Given the debate, GDPR has never been more important than it is right now. People on both sides of the argument are taking increasingly extreme positions. In times of crisis, regulations like the GDPR can help to maintain a feeling of trust and safety within the world that we live in.
Challenges of implementing GDPR
Whilst it is not time to relax the rules around the GDPR, it is time to make sure businesses have the support they need to manage such rapid change and increased data challenges. [...]
Click to expand...

None of us expected that we’d be navigating the data management and regulation during a pandemic, but regulations like the GDPR provide stability and confidence in times of crisis. There are many things to consider right now, but we cannot forget the importance of data privacy. As we approach the two year anniversary of the GDPR, let’s not debate the value of privacy.
Click to expand...

guest · May 25, 2020

Two years later, has GDPR fulfilled its promise?
Has the landmark law helped build a culture of privacy in organizations and have consumers become more wary of sharing their personal data?
May 25, 2020
https://www.welivesecurity.com/2020/05/25/two-years-later-has-gdpr-fulfilled-its-promise/

Any individual who has the slightest engagement in the privacy of their personal data online will likely be sympathetic to Barlow’s quote. It’s been 2 years since the implementation of the General Data Protection Regulation (GDPR), the EU’s data protection and privacy regulation which aimed to give control to individuals over their personal data and to simplify the requirements on businesses.

Are there fewer data breaches? Are companies taking privacy and consent more seriously? Do individuals engage in the protection of their personal information more?
[...]
The GDPR has legitimized privacy advocates across the globe having a voice and for their concerns to be considered and listened too. The big question, though, remains: ‘Have citizens become the owners of their personal data?’
Click to expand...

Observing a Privacy Milestone: Expert Thoughts on GDPR’s 2nd Anniversary
May 24, 2020
https://www.tripwire.com/state-of-s...estone-expert-thoughts-gdprs-2nd-anniversary/

May 25, 2020 marks the second anniversary of when the European Union’s General Data Protection Regulation (GDPR) took full effect. Undoubtedly, many organizations have succeeded in achieving compliance with the Regulation by now. But that raises some important questions.

To find out, we asked experts in the infosec field to weigh in on the first two years of GDPR’s implementation. Their responses help to illuminate all the progress that organizations have made and all the work they could yet complete in the name of safeguarding consumers’ privacy.
Click to expand...

guest · May 29, 2020

Belgian DPA Releases Report for Second Anniversary of the GDPR
May 26, 2020
https://www.huntonprivacyblog.com/2...es-report-for-second-anniversary-of-the-gdpr/

On the second anniversary of the EU General Data Protection Regulation (the “GDPR”), the Belgian Data Protection Authority (the “Belgian DPA”) published a Statement with some key GDPR-related numbers (the “Statement”).

Since May 2019, the Investigation Service of the Belgian DPA has led more than 100 investigations.
In the Statement, the Belgian DPA indicated that the Investigation Service had previously adopted a more reactive approach consisting of following up on complaints. From now on, the Investigation Service of the Belgian DPA intends to take a proactive approach and launch large-scale investigations relating to specific sectors or topics.
Click to expand...

Furthermore, David Stevens, President of the Belgian DPA, also stressed the importance of the Belgian DPA finding the right balance between monitoring the correct implementation of the rules and offering guidance to organizations on how to implement those rules
Click to expand...

guest · Jun 24, 2020

EU judges GDPR an overall success, but changes still needed
June 24, 2020
https://www.computerweekly.com/news...R-an-overall-success-but-changes-still-needed

The European Union (EU) General Data Protection Regulation (GDPR) has been assessed as an overall success in terms of meeting expectations and objectives, but more time is needed to smooth out some early issues identified by stakeholders, according to a two-year progress report issued by Brussels.

The European Commission (EC) said it would be premature to draw definite conclusions as to the application of the GDPR, and to provide for proposals for any revisions, but said it had identified a number of areas where improvements could eventually be made.
Click to expand...

It said that the GDPR had made EU citizens feel more empowered and aware of their enforceable rights and protections – according to the EU Fundamental Rights Agency, 69% of those aged over 16 have heard of the GDPR, and 71% have heard about their national data protection agency. In general, it said, people feel they can play an active role in controlling their data.

“To be truly effective, the EU needs to give clearer instructions on how to be compliant that are consistent across each country, while giving local DPAs more resources to pursue heavy penalties against companies that are intentionally putting their customers’ data at risk.”
Click to expand...

guest · Jul 3, 2020

GDPR for small business: the ultimate guide
July 2, 2020
https://www.itgovernance.co.uk/blog/gdpr-for-small-business-the-ultimate-guide

What is the GDPR? A quick overview
The Regulation came into effect on 25 May 2018, and was designed to strengthen the rights of EU residents regarding the way organisations process and use their personal data.
Does the GDPR apply to small businesses?
When the GDPR came into effect, there was a misconception that it only applied to multinationals, and that small business owners didn’t need to bother with it.

The truth is that the Regulation applies to all organisations that process EU residents’ personal data, whether they are sole traders, small businesses or conglomerates.
However, there is an exemption for organisations that employ fewer than 250 people
What does the GDPR mean for my business?
Let’s now turn our attention to the GDPR and the specific effects on small businesses.
Click to expand...

guest · Jul 9, 2020

Dutch DPA Issues Record Fine for Violating GDPR Data Subject Rights
July 7, 2020
https://www.hldataprotection.com/20...-fine-for-violating-gdpr-data-subject-rights/

The Dutch Data Protection Authority (DPA) issued a EUR 830,000 (approximately USD 937,000) fine against the Dutch Credit Registration Bureau (BKR) for violating data subject rights.
The fine stems from BKR’s practice of charging fees and discouraging individuals who wanted to access their personal data.

The Dutch DPA states that access requests may only be denied where requests from an individual are manifestly unfounded or excessive, in particular because of their repetitive character. This however, should be assessed on a case-by-case basis, which should be done at the moment the request is submitted, prior to the handling of the request.
Click to expand...

In consideration of the Dutch DPA’s fining structure, the EUR 830,000 fine consists of a fine of EUR 385,000 for violation of article 12(5) GDPR and a fine of EUR 650,000 for violation of article 12(2) GDPR. As the violations are both linked to the transparency principle aimed at giving individuals control over their personal data, the total fine is mitigated with 20% to EUR 830,000.
Click to expand...

guest · Jul 16, 2020

340 GDPR fines for a total of €158,135,806 issued since May 2018
July 16, 2020
https://www.helpnetsecurity.com/2020/07/16/gdpr-fines/

Since rolling out in May 2018, there have been 340 GDPR fines issued by European data protection authorities. Every one of the 28 EU nations, plus the United Kingdom, has issued at least one GDPR fine, Privacy Affairs finds.
Whilst GDPR sets out the regulatory framework that all EU countries must follow, each member state legislates independently and is permitted to interpret the regulations differently and impose their own penalties to organizations that break the law.

The second-highest number of fines comes from Hungary. The National Authority for Data Protection and Freedom of Information has issued 32 fines to date. The largest being €288,000 issued to an ISP for improper and non-secure storage of customers’ personal data.
The largest and highest GDPR fines
The largest GDPR fine to date was issued by French authorities to Google in January 2019. The €50 million was issued on the basis of “lack of transparency, inadequate information and lack of valid consent regarding ads personalization.” [...]
Click to expand...

guest · Aug 5, 2020

mood said: ↑

ICO’s BA and Marriott Fines Likely to Be Pushed Back Again
May 15, 2020
https://www.infosecurity-magazine.com/news/icos-ba-and-marriott-fines-pushed/
Click to expand...

UK data watchdog having a hard time making GDPR fines stick:
Marriott scores another extension, BA prepares to pay 11% of original £183m penalty
August 5, 2020
https://www.theregister.com/2020/08/05/marriott_starwood_gdpr_fine_british_airways/

Updated British Airways expects the fine for its 2018 credit card data leak to be just 10.8 per cent of the original £183m proposed by the UK data watchdog – while US hotel chain Marriott has both halved and kicked its own data protection fine into the long grass once again, The Register can reveal.

Updated to add
A Marriott mouthpiece sent us the following statement: "Marriott and the ICO have mutually agreed to an extension of the regulatory process until September 30, 2020. The regulatory process is ongoing and we will not be commenting further at this time."
Click to expand...

guest · Aug 7, 2020

The CNIL sanctions the Spartoo site for not having complied with the general data protection regulations
August 5, 2020
https://www.archyde.com/the-cnil-sa...with-the-general-data-protection-regulations/

The National Commission for Informatics and Liberties (CNIL) has just imposed a sanction of 250,000 euros to Spartoo, a company specializing in the online sale of shoes. The CNIL accuses him of several breaches of the GDPR, the general data protection regulation, which entered into force in May 2018.

Among the various problems observed and sanctioned, the CNIL reports “A breach of the principle of data minimization”, considering in particular that “The full and permanent recording of telephone calls received by customer service employees is excessive”.
It also questions the retention period of personal information of Spartoo customers.

In addition, it indicates that the scans of bank cards were kept “For six months and in the clear”, which, she emphasizes, “Does not guarantee the security of customer banking data”.
Click to expand...

ronjor · Aug 14, 2020

Oracle and Salesforce hit with GDPR class action lawsuits over cookie tracking consent

Natasha Lomas@riptari August 14, 2020
The use of third party cookies for ad tracking and targeting by data broker giants Oracle and Salesforce is the focus of class action style litigation announced today in the UK and the Netherlands.
The suits will argue that mass surveillance of Internet users to carry out real-time bidding ad auctions cannot possibly be compatible with strict EU laws around consent to process personal data.
Click to expand...

guest · Aug 14, 2020

Oracle hits back at "meritless" GDPR lawsuit
August 16, 2020
https://www.itpro.co.uk/data-insights/big-data/356775/oracle-hits-back-at-meritless-gdpr-lawsuit

Oracle's EVP and general counsel Dorian Daley hit back at The Privacy Collective with a strong statement that called the lawsuit "meritless action based on deliberate misrepresentations of the facts".

"As Oracle previously informed the Privacy Collective, Oracle has no direct role in the real-time bidding process (RTB), has a minimal data footprint in the EU, and has a comprehensive GDPR compliance program," Daley said in a statement.
"Despite Oracle's fulsome explanation, the Privacy Collective has decided to pursue its shake-down through litigation filed in bad faith. Oracle will vigorously defend against these baseless claims."
Click to expand...

guest · Aug 21, 2020

EU regulators wrangle over Twitter data privacy penalty
August 21, 2020
https://www.thestar.com.my/tech/tec...ors-wrangle-over-twitter-data-privacy-penalty

European Union privacy regulators are wrangling over the penalty Ireland's data privacy watchdog was set to issue Twitter for a data breach, pushing back the case's long awaited conclusion under the bloc's tough new data privacy rules.

The Irish Data Privacy Commission was expected to issue its decision in the Twitter case, which would be its first involving a US technology company since the new privacy law, known as GDPR, took effect in 2018, allowing for hefty fines.
But it said on Aug 20 that its counterparts in other countries – so-called concerned supervisory authorities – challenged a draft decision it circulated in May.
Click to expand...

The Irish regulator said in a June report it was investigating the company for failure to report the breach within 72 hours.
Under GDPR, companies that don't make such timely disclosures can be fined up to €10mil (RM49.43mil) or 2% of a company’s annual revenue, whichever is higher. In 2019 Twitter's revenue reached US$3.46bil, making a potential fine worth up to US$69mil (RM288.03mil).
Click to expand...

guest · Aug 25, 2020

Italy tops GDPR penalty list with €46m worth of fines this year
Companies still struggle to provide sufficient legal basis for processing personal data
August 25, 2020
https://www.itpro.co.uk/policy-legi...gdpr/356872/italy-tops-gdpr-penalty-list-with

Businesses operating within the European Union have been hit with a total of €68 million (£61.5m) in fines relating to GDPR breaches so far in 2020.
Over €45 million of that came from Italian-owned companies, according to financial experts Finbold, which compiled a top 20 using data collected from the GDPR's enforcement tracker website.

From 1 January to 17 August, Italy came out on top, having been issued with €45.6 million in fines as a result of 13 separate investigations. Sweden came in second, with €7.3 million in fines from 4 cases, while the Netherlands were ranked third with €2.8 million worth of penalties.
Germany has only received one GDPR-related fine since the start of the year, however that particular case, involving health insurance firm Allgemeine Ortskrankekasse (AOK), resulted in a €1.2 million fine in June, placing the country 5th on the list.

There are also a handful of significant fines that have been proposed but not yet levied, many of which could be enforced before the end of the year.
Click to expand...

Log in or Sign up

GDPR: A simple explainer

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Log in or Sign up

GDPR: A simple explainer

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

Useful Searches