By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

On 25 and 28 May 2018, the National Data Protection Commission (CNIL) received group complaints from the association's None Of Your Business (“NOYB”) and La Quadrature du Net (“LQDN”). LQDN was mandated by 10 000 people to refer the matter to the CNIL. In the two complaints, the associations reproach GOOGLE for not having a valid legal basis to process the personal data of the users of its services, particularly for ads personalization purposes. The CNIL immediately started investigating the complaints. On 1st June 2018, in accordance with the provisions on European cooperation as defined in the General Data Protection Regulation (“GDPR”), the CNIL sent these two complaints to its European counterparts to assess if it was competent to deal with them. Indeed, the GDPR establishes a “one-stop-shop mechanism” which provides that an organization set up in the European Union shall have only one interlocutor, which is the Data Protection Authority (“DPA”) of the country where its “main establishment” is located. This authority serves as “lead authority”. It must, therefore, coordinate the cooperation between the other Data Protection Authorities before taking any decision about a cross-border processing carried out by the company. In this case, the discussions with the other authorities, in particular with the Irish DPA, where GOOGLE’s European headquarters are situated, did not allow to consider that GOOGLE had a main establishment in the European Union. More details can be found on OUR FORUM.

Cybercriminals are increasingly recognizing that smaller businesses can be lucrative targets as they are able to devote fewer resources to security. Phishing defense specialist Cofense is launching a new Managed Security Service Provider (MSSP) program aimed at providing SMBs with human-driven solutions designed to stop an active phishing attack. Cofense has partnered with a targeted group of service providers to provide their customers the dedicated resources required to strengthen defenses, build attack resiliency and ultimately stop real attacks in progress. "Phishing remains the top cause of security breaches, and when it comes to leveraging humans to help stop those threats in their tracks, SMBs can face a significant disadvantage compared to enterprises with more resources," says Robert Iannicello, VP of global channel sales at Cofense. "Our MSSP program will arm more small and mid-sized organizations with the necessary tools to build attack resiliency and most importantly, report, respond to and stop active phishing threats. Also, our programs will offer key incentives and pricing designed exclusively for our MSSP partners to ensure their go-to-market success. We look forward to enabling more partners and their customer organizations with the resources needed to thwart phishing attacks across the globe, regardless of company size and scope." Learn more by visiting OUR FORUM.

noyb, a European privacy enforcement non-profit organization which focuses on commercial privacy issues on a European level, has filed ten GDPR complaints with the Austrian Data Protection Authority, on behalf of ten users which it represents, against eight online streaming companies for violations of Article 15. "As GDPR foresees € 20 million or 4% of the worldwide turnover as a penalty, the theoretical maximum penalty across the 10 complaints could be €18.8 billion," says noyb. According to Max Schrems, noyb's Director, all those companies (i.e., Amazon, Apple, DAZN, Spotify, SoundCloud, YouTube, Flimmit, Netflix) have been tested to check their compliance of the General Data Protection Regulation (GDPR) "right to access" provision described in the EU regulation's Article 15. The "right to access" grants all EU citizens the "right to get a copy of all raw data that a company holds about the user, as well as additional information about the sources and recipients of the data, the purpose for which the data is processed or information about the countries in which the data is stored and how long it is stored." After testing the eight companies "right to access" compliance, noyb found out that none of the eight streaming companies were fully compliant with Schrems going as far as to say that they were all engaging in "structural violation" of the EU data protection legislation. There's more to this post on OUR FORUM.