GDPR: A simple explainer

guest · Oct 31, 2018

mood said: ↑

Vote Leave Analytics Firm Hit with GDPR Notice
September 21, 2018
https://www.infosecurity-magazine.com/news/vote-leave-analytics-firm-hit-with/
Click to expand...

UK Regulator Issues Second GDPR Enforcement Notice on Canadian Firm
October 31, 2018
https://www.securityweek.com/uk-regulator-issues-second-gdpr-enforcement-notice-canadian-firm

On 6 July 2018, the UK's data protection regulator (ICO) issued the first GDPR-related enforcement notice. It was delivered on Canadian firm Aggregate IQ.

The ICO has now issued a new enforcement notice (PDF) that "varies and replaces the Notice served on AIQ dated 6 July 2018. The Notice clarifies the steps to be taken by AIQ..."

The requirements of the new notice (two short paragraphs replacing one short paragraph) are effectively the only difference between the two notices.
[...] In short, he adds, "the October Notice may provide some "clarification" but really raises as many questions as it answers."
Click to expand...

Minimalist · Nov 2, 2018

GDPR’s First 150 Days Impact on the U.S.

Apple CEO Tim Cook publicly entered the data privacy fray earlier this month, praising the European Union’s General Data Protection Regulation (GDPR). At the International Conference of Data Protection and Privacy Commissioners Conference (ICDPPC), Cook advocated for GDPR rules to have a far-reaching impact on privacy beyond the European Union and even here in the United States.

“In many jurisdictions, regulators are asking tough questions. It is time for the rest of the world, including my home country, to follow your lead,” he said.
Click to expand...

https://threatpost.com/gdprs-first-150-days-impact-on-the-u-s/

Minimalist · Nov 2, 2018

'GDPR is one of the best things to happen for data security,' says CIO roundtable

The EU's General Data Protection Regulation is one of the best things to happen for data security in recent year. That's the consensus of a recent roundtable of UK-based CIOs, which took place at Computing's IT Leaders Summit.

The group went on to say that the GDPR, and the threat of its fines, has raised security to be a board-level concern.
Click to expand...

https://www.computing.co.uk/ctg/new...-happen-for-data-security-says-cio-roundtable

Minimalist · Nov 6, 2018

Post implementation, GDPR costs higher than expected

A Versasec survey examining the global impact of the General Data Protection Regulation (GDPR) nearly six months after its roll-out shows the privacy regulation costs more to implement than many had anticipated, and that non-EU companies are adopting similar regulations in anticipation of stronger customer privacy rules in their own locations.
Click to expand...

https://www.helpnetsecurity.com/2018/11/06/gdpr-costs/

Minimalist · Nov 8, 2018

GDPR a challenge to AI black boxes

Most artificial intelligence “black boxes” do not comply with EU data protection laws and will have to be re-engineered, warns security researcher and consultant
Click to expand...

https://www.computerweekly.com/news/252452183/GDPR-a-challenge-to-AI-black-boxes

Minimalist · Nov 8, 2018

Forget Facebook, mysterious data brokers are facing GDPR trouble

You’ve probably never heard of Acxiom, but it knows a lot about you. The marketing company has a rich database of information about more than 700 million individuals, and claims to cover 90 per cent of UK households. Acxiom knows about people’s income and marital status. It claims to be able to tell advertisers what someone’s interests are, what supermarket they go to, and whether their boiler needs replacing.
Click to expand...

https://www.wired.co.uk/article/gdpr-acxiom-experian-privacy-international-data-brokers

guest · Nov 12, 2018

mood said: ↑

While everyone was focused on GDPR, the NIS Directive snuck in through the back door
July 7, 2018
https://venturebeat.com/2018/07/07/...nis-directive-snuck-in-through-the-back-door/
Click to expand...

NIS Directive Gets Real After OES Deadline
November 12, 2018
https://www.infosecurity-magazine.com/news/nis-directive-gets-real-after-oes/

The implementation of major EU-wide security legislation took a major leap forward on Friday as the government officially identified the organizations that will be required to comply with the NIS Directive.

Known in full as the directive on the security of network and information systems, the law will be applied slightly differently by each member state.

A key driver for the directive is to improve baseline security among providers of critical infrastructure, known as “operators of essential services” (OES). It will help to do this with GDPR-like maximum fines of £17m or 4% of global annual turnover, and mandatory 72-hour notifications of serious incidents.
Click to expand...

ronjor · Nov 19, 2018

Washington Post offers invalid cookie consent under EU rules – ICO

By Rebecca Hill 19 Nov 2018
UK watchdog waves fist in paper’s general direction, asks it to stop forcing people to accept tracking
Click to expand...

Minimalist · Nov 23, 2018

'Cuddly' German chat app slacking on hashing given a good whacking under GDPR: €20k fine

German chat platform Knuddels.de ("Cuddles") has been fined €20,000 for storing user passwords in plain text (no hash at all? Come on, people, it's 201.
Click to expand...

https://www.theregister.co.uk/2018/11/23/knuddels_fined_for_plain_text_passwords/

Minimalist · Nov 26, 2018

GDPR’s impact: The first six months

GDPR is now six months old – it’s time to take an assessment of the regulation’s impact so far. At first blush it would appear very little has changed. There are no well-publicized actions being taken against offenders. No large fines levied. So does this mean its yet another regulation that will be ignored? Actually nothing could be farther from the truth.
Click to expand...

https://www.helpnetsecurity.com/2018/11/26/gdpr-impact/

guest · Nov 27, 2018

Google accused of GDPR privacy violations by seven countries
Google faces its first challenge under Europe’s strict new data protection rules
November 27, 2018
https://www.theverge.com/2018/11/27...on-tracking-gdpr-challenge-european-deceptive

Consumer groups across seven European countries have filed GDPR complaints against Google’s location tracking (via Reuters).

The European Consumer Organisation (BEUC), of which each of the groups are a member, claims that Google’s “deceptive practices” around location tracking don’t give users a real choice about whether to enable it, and that Google doesn’t properly inform them about what this tracking entails.

If upheld, the complaints could mean a hefty fine for the search giant.
Click to expand...

guest · Nov 27, 2018

Domain name 'admin' role eyed up as latest victim in Whois system's GDPRmeggdon
Plus anonymous email and all personal info to be redacted
November 27, 2018
https://www.theregister.co.uk/2018/11/27/gdpr_icann_whois/

The long-standing but outdated "admin" role associated with every internet domain name [...] and make it complaint with European data privacy rules.
In addition, the "tech" role may be made voluntary, email addresses associated with domain owners will have to be anonymized and all personal data beyond someone's country and state will have to be removed from the public domain name database.

That's the upshot of a report [PDF] from a special working group charged with coming up with changes to the Whois service that bring it in line with the General Data Protection Regulation (GDPR).

That recommendation will also embarrass DNS overseer ICANN, which has made the retention of those contact details the central point in a legal fight over Whois in Germany.
Click to expand...

Report (PDF): https://gnso.icann.org/sites/default/files/file/field-file-attach/epdp-gtld-registration-data-specs-initial-21nov18-en.pdf

guest · Nov 29, 2018

UK's ICO fines 100 firms that failed to pay data protection fee
Enforcing GDPR is expensive work, says watchdog
November 29, 2018
https://www.theregister.co.uk/2018/...mpanies_that_havent_paid_data_protection_fee/

Since May, data controllers – orgs that define how and why personal data is processed – have been required to pay higher fees to the Information Commissioner's Office.
If they don’t, the ICO can fine them up to £4,000, and they are able to levy an extra £350 on the most egregious cases.

Today it announced it was issuing 100 of these bad apples, in the business services, construction and finance sectors, with monetary penalties.
"The ICO has grown over the last two years to meet its wider data protection remit and responsibilities following GDPR. It now employs 670 staff," it said, pointedly.

The fees [...] organisations with fewer than 10 staff pay £40, SMEs pay £60 and those with more than 250 staff or a £36m-plus turnover have to pay £2,900. The fines are tiered too, up to £400, £600 and £4,000, respectively.
Click to expand...

guest · Dec 21, 2018

EU debates GDPR joint liability ruling for websites using social widgets
December 20, 2018
https://www.itpro.co.uk/data-protec...lity-ruling-for-websites-using-social-widgets

An embedded Facebook Like button, among other commonly implemented widgets, can gather data such as IP addresses and browser identification strings just by the user loading the web page.
Facebook is already considered a data controller but the result of a fresh case could wrangle the hosting website into sharing data protection responsibilities under GDPR.

Advocate General (AG) Michal Bobek argued on Wednesday that hosting websites should be considered as joint data controllers with the companies that own widgets.
He believes that both website and widget owner appear to voluntarily cause the collection and transmission of the data for the purpose of processing.

In a regional court in Dusseldorf, Fashion ID lost the original case in 2016 but it has since appealed, with Facebook's backing, to a German higher court. That court has now sought advice on key questions from the CJEU.
Click to expand...

"Advocate General Bobek: the operator of a website embedding a third party plugin such as the Facebook Like button, which causes the collection and transmission of the users’ personal data, is jointly responsible for that stage of the data processing" (PDF):
https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-12/cp180206en.pdf

guest · Dec 26, 2018

How The GDPR Nearly Ruined Christmas
German town keeps Christmas tradition after privacy law nearly scrapped it
December 26, 2018
https://edition.cnn.com/2018/11/21/europe/germany-christmas-gdpr-grm-scli-intl/index.html

In previous years up to 4,000 wishes to Father Christmas were placed on a tree at a Christmas market in the southern town of Roth, according to German newspaper Die Welt.
protection woes
But the popular activity had to stop in 2016 because of Germany's data privacy legislation, Die Welt reports.
Roth found a workaround -- putting the wishes in a locked box -- but that was made redundant in May when the European Union's General Data Protection Regulation (GDPR) came into force.
Consent needed
Local radio station Antenne Bayern found a solution.
It created a wish list, which included a parental consent disclaimer, which can be printed from their website and put in the wishing box at the Christmas market, which opens on Thursday.
Click to expand...

Minimalist · Jan 18, 2019

GDPR Suit Filed Against Amazon, Apple

An Austrian non-profit, led by privacy activist and attorney Max Schrems, has filed suit against 8 tech giants for non-compliance with the EU General Data Protection Regulation.
Click to expand...

https://www.darkreading.com/privacy/gdpr-suit-filed-against-amazon-apple/d/d-id/1333690

ronjor · Jan 25, 2019

Irish data protection body says it is investigating Twitter GDPR breach

January 25, 2019 Reporting by Graham Fahy; Editing by Toby Chopra and Jane Merriman
Ireland's Data Protection Commission is investigating Twitter's compliance with GDPR obligations to implement measures to ensure the safety and safeguarding of the personal data it processes, the commission said on Friday.
Click to expand...

guest · Jan 26, 2019

GDPR-ready organizations see lowest incidence of data breaches
January 25, 2019
https://www.helpnetsecurity.com/2019/01/25/gdpr-ready-organizations/

The study validates the link between good privacy practice and business benefits as respondents report shorter sales delays as well as fewer and less costly data breaches.

Within the study, 59 percent of organizations reported meeting all or most requirements, 29 percent expect to do so within a year, and 9 percent will take more than a year.
GDPR-ready organizations cited a lower incidence of data breaches, fewer records impacted in security incidents, and shorter system downtimes. They also were much less likely to have a significant financial loss from a data breach.

More than 3,200 global security and privacy professionals in 18 countries across major industries responded to the Cisco survey about their organizations’ privacy practices.
Click to expand...

Study (PDF): https://www.cisco.com/c/dam/en_us/about/doing_business/trust-center/docs/dpbs-2019.pdf

Minimalist · Jan 28, 2019

Suspected GDPR violations prompt over 95,000 complaints

National data protection watchdogs in the European Union (EU) have received 95,180 complaints from citizens alleging the mishandling of personal data since the General Data Protection Regulation (GDPR) came into effect in May 2018, a joint statement by four senior European Commission officials reveals.
Click to expand...

https://www.welivesecurity.com/2019/01/28/suspected-gdpr-violations-prompt-95000-complaints/

Minimalist · Jan 28, 2019

3 Ways Companies Mess Up GDPR Compliance the Most

The best way to conform to the EU's new privacy regulation is to assume that you don't need to hold on to personal data, versus the opposite.
Click to expand...

https://www.darkreading.com/vulnera...ss-up-gdpr-compliance-the-most/a/d-id/1333734

guest · Jan 31, 2019

Report: Majority of Small UK Businesses ‘Ignoring GDPR Risks
January 31, 2019
https://www.infosecurity-magazine.com/news/75-small-uk-businesses-gdpr/

The Under Attack: Assessing the struggle of UK SMBs against cyber criminals report assessed the views of 500 IT bosses at small UK companies and revealed the majority are ignoring GDPR risks seven months after the new rules were officially introduced.

Three quarters of those polled said their company is yet to take any action to improve how they store data, with a quarter of businesses having no plans to do so at all.

Paul Rosenthal, CEO of Appstractor, said: “Small businesses have long been in denial about the threat they face from cyber-criminals and it seems this denial has carried over into the risk GDPR carries.
“Unfortunately, it seems many are not taking GDPR seriously enough which could have serious consequences.”
Click to expand...

Minimalist · Feb 3, 2019

Interview: Privacy ops connects security and privacy teams

According to the GDPR regulations enacted in 2018, all organizations that handle data on European customers must now retain a data protection officer (DPO). While this help, what’s needed is an expert in Privacy Operations.

While there is a requirement to employ a DPO, many companies are struggling to recruit the right person for the job. With this process many candidates are privacy experts with deep knowledge of regulatory matters, however they usually come from legal backgrounds and thus have no experience with technology and security, which is a skill lacking for enterprise data protection.
Click to expand...

http://www.digitaljournal.com/busin...cts-security-and-privacy-teams/article/542370

guest · Feb 6, 2019

Data Breach Reports in Europe Under GDPR Exceed 59,000
Netherlands, Germany and UK Have Logged the Most Data Breach Reports
February 6, 2019
https://www.databreachtoday.com/data-breach-reports-in-europe-under-gdpr-exceed-59000-a-12006

Eight months after the EU's General Data Protection Regulation came into full effect, European data protection authorities have received more than 59,000 data breach reports, according to the law firm DLA Piper.

The firm analyzed data breach reports that have been filed by 23 of the 28 EU member states since GDPR came into full force on May 25, 2018.
"The Netherlands, Germany and the United Kingdom came top of the table with the largest number of data breaches notified to supervisory authorities with approximately 15,400, 12,600 and 10,600 breaches notified respectively."

Weighting the breach reports based on country population, DLA Piper found that the Netherlands logged the most data breach reports per capita, followed by Ireland and Denmark.
Click to expand...

ronjor · Feb 21, 2019

Insurer Offers GDPR-Specific Coverage for SMBs

Jai Vijayan 2/20/2019
Companies covered under the EU mandate can get policies for up to $10 million for fines, penalties, and other costs
Click to expand...

guest · Feb 28, 2019

DPC publishes Annual Report 25 May - 31 December 2018
February 28, 2019
https://www.dataprotection.ie/en/ne...blishes-annual-report-25-may-31-december-2018

Commissioner for Data Protection, Helen Dixon, today launched the first annual report of the new Data Protection Commission (DPC) covering the period 25 May to 31 December 2018, detailing the work of the Irish data protection authority following the introduction of the General Data Protection Regulation (GDPR) on 25 May 2018.

The Data Protection Commissioner, Helen Dixon, in publishing this report commented: “The rise in the number of complaints and queries demonstrates a new level of mobilisation to action on the part of individuals to tackle what they see as misuse or failure to adequately explain what is being done with their data.”
Click to expand...

DPC Annual Report 25 May - 31 December 2018 (PDF - 2.24 MB): https://www.dataprotection.ie/sites/default/files/uploads/2019-02/DPC%20Annual%20Report%2025%20May%20-%2031%20December%202018.pdf

Log in or Sign up

GDPR: A simple explainer

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

ronjor Global Moderator

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

Log in or Sign up

GDPR: A simple explainer

guest Guest

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

ronjor Global Moderator

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

Useful Searches