Upload
marco-de-santis
View
13
Download
0
Embed Size (px)
Citation preview
eu-LISA PUBLIC
The path for the adoption of
the Privacy Shield is becom-
ing more and more difficult.
After the negative Opinions
of the Parliament and of the
Article 29 Working party, now
also the European Data Pro-
tection Supervisor (EDPS) has
expressed all its concerns
about the robustness of the
privacy guarantees contained
EU-US signs deal on police data exchange
On 2 June 2016, the European
Union and the United States
of America signed the so-
called "Umbrella agreement"
which puts in place a compre-
hensive data protection
framework for criminal law
enforcement cooperation.
The Agreement covers all
personal data (e.g., names,
addresses, criminal records,
etc.) exchanged between
police and criminal justice
authorities of the EU
Member States and the
U.S. federal authorities
for preventing, investi-
gating, detecting and
prosecuting criminal
offenses, including terror-
ism. The Umbrella Agree-
ment will provide safe-
guards and guarantees of
lawfulness for data trans-
fers, including provisions on
clear limitations on data use,
the obligation to seek prior
consent before any onward
transfer of data, the obliga-
tion to define appropriate
retention periods, and the
right to access and rectifica-
tion. Read the Umbrella
Agreement factsheet
Read the EC press release
April 2016 Issue nr. 15
DATA PROTECTION DATA PROTECTION NEWSLETTER
Issue Nr.10
HIGHLIGHTS Troubles for the Privacy
Shield
EU-US signs Umbrella
Agreement
SECURITY AND SURVEILLANCE
Myspace Data Breach
Snooper’s charter: the
remaining stages for ap-
proval
Canada: Face recognition
technology to identify
passports frauds
NEW TECHNOLOGIES EC drafts Code of Con-
duct for mobile health
app
EVENTS Data Protection Aware-
ness sessions: the out-
comes
Connect the citizens
summit in Amsterdam
SPEECHES AND PUBLICATIONS
HIGHLIGHTS
June 2016, Issue Nr.19
in the Agreement. In fact,
the Opinion on the EU-
U.S. Privacy Shield Draft
Adequacy Decision re-
leased by the EDPS on 30
May expresses mistrust
about the data transfer
framework’s ability to
protect EU citizens’ per-
sonal data in accordance
with EU law. Read the
press release.
The EDPS recognized
that the European Com-
mission’s draft adequacy
decision is an improve-
ment respect to the U.S.-EU
Safe Harbor Framework,
which was invalidated by the
Court of Justice for the Euro-
pean Union last October.
However, Mr Buttarelli cau-
tioned that “progress com-
pared to the earlier Safe
Harbor … is not itself suffi-
cient...since the Privacy
Shield “as currently designed
does not adequately include
… all appropriate safeguards”
to protect EU citizens’ priva-
cy “robust improvements are
needed” he said.
Troubles for the Privacy Shield
DID YOU KNOW
The EU-US Privacy Shield Agreement was designed to replace the Safe harbour which was struck down by the Court of Justice of the European Union (CJEU) following a complaint by privacy activist Max Schrems. The new agreement is aimed at restoring the trust of individuals in the transatlantic data transfers.
eu-LISA PUBLIC
On 31 May, Time Inc., own-
er of Myspace, confirmed
that the once-popular social
media site was hacked.
The leaked database con-
tained about 360 million
accounts with 427 mil-
lion passwords, according
to a Motherboard report.
This might be the biggest
data breach of all time. It’s
much bigger than the 117
LinkedIn passwords and
emails that leaked last
month from the 2012
LinkedIn hack and more
than the 2013 Target hack
that affected 70-110 million
customers.
MySpace has announced
that it is in the process of
notifying all affected users
and working proactively
with law enforcement au-
thorities to resolve this
issue. The data breach
countermeasures taken
includes the invalidation of
the passwords of all known
affected users and the
monitoring for suspicious
activity that might occur
on Myspace accounts.
The hack is being attribut-
ed to the Russian cyber-
hacker who goes by the
name “Peace.” This is the
same person responsible
for the LinkedIn and Tum-
blr attack too.
Read more here
MySpace Data Breach: 427 millions passwords leaked
Snooper's charter: the remaining stages for approval
The Snooper’s charter, has
been widely criticized ever
since it was proposed by
Home Minister Theresa
May in 2015, because it pro-
vides investigative agencies
the authority to conduct
mass surveillance over
citizens .
It is likely that Mrs Theresa
May will have to make
some privacy concessions in
order to see her bill ap-
proved by the Parliament.
There is a lot at stake. If
the Snooper Charter will
pass the scrutiny of the
British MPs, the public
trust in UK tech services
will be undermined and this
could determine the loss of
trust in freedom of expres-
sion and privacy online –
trust that would be impos-
sible to regain.
Read more here
On Monday 6 and Tuesday
7 June, British MPs will de-
bate in the House of Com-
mons the remaining stages
for the approval of the con-
troversial Investigatory
Powers Bill. The Bill, nick-
named Snooper Char-
ter, will provide a new
framework to govern the
use and oversight of investi-
gatory powers by law en-
forcement and the security
and intelligence agencies.
Page 2
SECURITY and SURVEILLANCE
“ 360 million accounts
with 427
million passwords
stolen”
SECURITY and SURVEILLANCE
DID YOU KNOW That if you want to check if you have an account that has been compromised in a data breach, visit the website haveibeenpwned.com The website is run by Troy Hunt, a web securi-ty expert, who had the idea of creating an open source tool including huge amount of hacked data. In the era of data breaches, a great busi-ness idea.
DID YOU KNOW That the Investigatory Pow-er Bill (nicknamed Snooper Charter) requires web and phone companies to store records of websites visited by every British citizen for 12 months for access by po-lice, security services and other public bodies. Moreo-ver, Makes explicit in law for the first time the powers of the security services and police to hack into and bug computers and phones. Read more here
DID YOU KNOW That when you choose your password you should follow the tips of the Guide to pass-word security. Ideally, each of your passwords would be at least 16 characters, and contain a combination of numbers, symbols, upper-case letters, lowercase let-ters. How Secure is my Password? To see if your password is secure enough click here. The website tells you how many seconds, days or years an hacker might take to crack your credentials.
eu-LISA PUBLIC
Canada: Face recognition technology to identify passports frauds
mendations, on 7 June 2016,
the European Commission
has drafted its Code of Con-
duct on privacy for mobile
health apps and submitted
for comments to the Art 29
Data Protection Working Par-
ty. Once approved by the
independent EU advisory
group, the Code will be ap-
plied in practice: App devel-
opers will be able to voluntar-
ily commit to follow its rules,
which are based on EU data
protection legislation.
The EC said the Code was
developed with all par-
ties in mind, including
SMEs and individual
developers who may
not have access to legal
expertise. It is expected
to raise awareness of
the data protection
rules in relation to
mHealth apps, and
facilitate and increase
compliance at the EU.
Read more here.
New apps are being devel-
oped at the speed of light
and legislators around the
world are busy revising ex-
isting, or drafting new, data
privacy legal frameworks.
Last February the Article 29
Working Party stressed the
need to create an intelligi-
ble legal framework for da-
ta processing apps, in par-
ticular for those collecting
and processing health data
(“mHealth apps”).
Following the WP29 recom-
Page 3
SECURITY and SURVEILLANCE SECURITY and SURVEILLANCE
NEW TECHNOLOGY
EC drafts Code of Conduct for mobile health apps
using biometrics — physical The photo-matching idea
emerged from concerns that people wanted by the Canada
Border Services Agency might use fake names to obtain
genuine Canadian travel documents from the Immigration
Department's passport program, say internal memos re-
leased under the Access to Information Act.
"Genuine Canadian passports and other travel documents
are of high value to persons who seek to establish false
identities," says a memorandum of understanding between
the border and immi-
gration agencies.
Read more here.
On 8 June, the Canada’s
Federal government offi-
cials revealed they used
facial recognition technol-
ogy to identify 15 suspects
wanted on immigration
warrants, who all used false
identities to apply for travel
documents.
The Liberal government
might make the facial-
recognition scheme perma-
nent to help find and arrest
people ineligible to remain
in Canada due to involve-
ment with terrorism, orga-
nized crime or human rights
violations. It's just the latest
example of federal efforts
to zero in on lawbreakers
DID YOU KNOW That Axl Rose, the Guns N’ Roses front-man, demands Google remove 'fat' photos from the web. The pho-to in question was tak-en at a concert back in 2010 and users poked fun at the singer’s weight gain through the years. Read more here Read Axl Rose open letter
DID YOU KNOW That the Article 29 Work-ing Party is composed of representatives of the national data protection authorities (DPA), the EDPS and the EC. The Group provides the Com-mission with expertize on data protection.
eu-LISA PUBLIC
On 7 and 8 June, the eu-
LISA Data Protection
Officer, Mr Fernando Silva,
held in eu-LISA Tallinn 2
Privacy Awareness Session:
Data Protection at eu-
LISA and Personal Data
Breach. While the first was
aimed at informing the staff
about the privacy principles
and data protection obliga-
tions and how they are be-
ing enforced and applied in
practice in eu-LISA, the sec-
ond was targeted at in-
structing the staff on how
to react in case of a data
breach. During the sessions
the DPO gave practical ex-
ample to show how the da-
ta protection legal and
compliance requirements
have an impact on the eu-
LISA staff professional envi-
ronment. The same Aware-
ness session are scheduled
for eu-LISA Strasbourg this
week.
ernments and businesses to
refine their policies and ser-
vices. Boosting connectivity
for EU citizens is therefore a
key priority for the Juncker
Commission, with the 2020
Digital Agendaand Digital
Single Market Strategy set
to boost innovation, eco-
nomic growth and jobs in
the EU.
Read more here
POLITICO’s Connected
Citizens Summit in Am-
sterdam on June 21 2016
will examine the challenges
and opportunities govern-
ments and the private sec-
tor face as they adapt their
policies and services to bet-
ter connect with citizens.
Connectivity helps patients
track their health, commut-
ers optimize their trips,
households manage their
consumption and citizens
engage in the democratic
process. Data allows gov-
Data Protection Awareness Sessions: the outcomes
Connected Citizens Summit, Amsterdam 21 June 2016
Page 4
EVENTS EVENTS
DID YOU KNOW That the Digital Single Market strategy, adopted by the European Commission on the 6 May 2015, creates opportunities for new startups and allows existing companies in a market of over 500 mln people. Completing a Digital Single Market could contribute € 415 billion per year to Europe's econo-my, create jobs and transform the public services. Read the Digital Single Market Factsheet.
DID YOU KNOW That on 9 November eu-LISA adopted the Policy and Procedure on Personal Data Breach Handling. The Policy is available here
eu-LISA PUBLIC
SPEECHES AND PUBLICATIONS
07 June 2016 The EDPS launches the Accountability Initiative. Read the latest blogpost. 06 June 2016 Videos of the first EDPS-Ethics Advisory Group Workshop are available here. 31 May 2016 Big Brother, Big Data and Ethics. Read the latest blogpost by Giovanni Buttarelli.
The Newsletter goes on holiday see you next August!
SPEECHES and PUBLICATIONS
This newsletter is issued by the eu-LISA Data Protection Officer appointed in 2014 in order to:
ensure eu-LISA compliance with data protection legal framework
provide eu-LISA with guidance in data protection compli-ance
register of the data processing operations available under the share drive: \\nas-tll\Common\Data protection
notify the EDPS the risky data processing operations
cooperate with the EDPS
AUTHORS Fernando Silva Data Protection Officer Marco De Santis Assistant
CONTACTS [email protected] + 372 604 2005
SOURCES EDPS website EDEN – Europol Data Protection Experts Network
LEGAL DISCLAIMER The content herein is drafted by the DPO and is provided for
general information purposes only. The newsletter may contain links to websites that are creat-ed and maintained by other organisations. The DPO does not necessarily endorse the views expressed on these websites. Pictures: © eu-LISA
About this Newsletter