Microsoft pledges to store European cloud data in Europe

Yahoo – AFP, May 6, 2021 

Microsoft's European clients have long been concerned over the legal status
of data they store with US companies in the cloud and the extent to which
they could be scrutinised by US authorities. 

US tech giant Microsoft on Thursday pledged to store all European cloud-based client data in Europe amid unease on the continent over the reach of US legislation on personal data collection. 

Microsoft's European clients have long been concerned over the legal status of data they store with US companies in the cloud and the extent to which they could be scrutinised by US authorities. 

Those worries came to a head last July when the European Court of Justice struck down the EU-US Privacy Shield, a framework allowing firms to transfer personal data to the United States in compliance with Brussels' General Data Protection Regulation. 

The court found the mechanism did not adequately protect EU data from US authorities over which Europe has neither control nor right of redress. 

In a blog post on Thursday, Microsoft president Brad Smith said: "If you are a commercial or public sector customer in the EU, we will go beyond our existing data storage commitments and enable you to process and store all your data in the EU. 

"In other words, we will not need to move your data outside the EU." 

He said the commitment -- dubbed the EU Data Boundary for the Microsoft Cloud -- would apply across all of Microsoft's core cloud services -– Azure, Microsoft 365, and Dynamics 365 and would take effect by the end of next year.

Private psychotherapy notes leaked in major Finnish hack

Yahoo – AFP, 26 October 2020

The confidential treatment records of tens of thousands of psychotherapy patients in Finland have been hacked and some leaked online, in what the interior minister said Monday was "a shocking act." 

Many victims of the hack reported receiving emails with a demand for 200 euros
($236) in bitcoin to prevent the contents of their discussions with therapists
being made public. (Nicolas Asfouri)

Distressed patients flooded victim support services over the weekend as Finnish police revealed hackers accessed records belonging to private company Vastaamo, which runs 25 therapy centres across Finland. 

Thousands have filed police complaints over the breach, they added. 

Many patients reported receiving emails with a demand for 200 euros ($236) in bitcoin to prevent the contents of their discussions with therapists being made public. 

"The Vastaamo data breach is a shocking act which hits all of us deep down," Interior Minister Maria Ohisalo wrote on her website on Monday. 

Finland must be a country where "help for mental health issues is available and it can be accessed without fear." 

Ministers met for crisis talks this weekend, with further emergency discussions tabled for the coming week over the unprecedented data breach. 

"We are investigating an aggravated security breach and aggravated extortion, among other charges," Robin Lardot, the director of Finland's National Bureau of Investigation, told a news conference at the weekend. 

Lardot added that they believed the number of patients whose records had been compromised numbered in the tens of thousands. 

On Monday evening, Vastaamo said it had fired its CEO, Ville Tapio, after an internal enquiry discovered that he had concealed a March 2019 data breach from the board and the firm's parent company. 

The firm admitted flaws in the security of its customer data, "which allowed criminals to break into the database up until March 2019," Vastaamo said in a statement. 

The company's owner, PTK Midco Oy, on Monday launched court proceedings "in relation to its May 2019 purchase of Vastaamo," the statement added. 

'Justifiably worried' 

Security experts reported that a 10-gigabyte data file containing private notes between at least 2,000 patients and their therapists had appeared on websites on the so-called dark web. 

The hack, which targeted some of society's most vulnerable including children, has caused widespread shock in the Nordic country of 5.5 million, with ministers gathering on Sunday to discuss how to support the patients whose sensitive data had been leaked. 

"It is absolutely clear that people are justifiably worried not only about their own security and health but that of their close ones, too," Ohisalo told reporters late on Sunday. 

On Monday, authorities launched a website for victims of the cyberattack, offering advice and telling them not to pay the ransom demand. 

"Do not communicate with the extortionist, the data have most likely already been leaked elsewhere," the "Data Leak Help" site said. 

Mental health and victim support charities reported being overwhelmed with calls from distressed people fearing that their intimate conversations with their therapists would be publicly released. 

Nothing 'to be ashamed of' 

One of the recipients of a blackmail threat, the former MP Kirsi Piha, tweeted a screenshot of the ransom message along with a defiant reply to the hackers. 

"Up yours! Seeking help is never something to be ashamed of," Piha wrote. 

"I've seen a lot, but I haven't seen this," Mikko Hypponen, chief research officer at data security firm F-Secure said in a statement. 

"I don't think there's a crime in our criminal history which would have more victims than this one." 

Hypponen, an internationally renowned cybersecurity specialist, said the perpetrator used the alias "ransom_man", and said he was only aware of one other patient blackmail case, where a cosmetic surgery clinic in Florida had a smaller amount of data stolen in 2019. 

On Monday, Finland's social care regulator said in a statement it was investigating Vastaamo's practices, including how well patients were kept informed of the breach. 

Meanwhile, the head of the state digital services agency DVV, Kimmo Rousku, said that the cyberattack could have been avoided if Vastaamo had used better encryption. 

DVV published a checklist on Monday for firms to make sure their digital security is in order. 

"Management needs to wake up," Rousku told public broadcaster Yle. 

A phone line offering legal advice had also been set up, the country's consumer authority announced.

Dutch tennis association fined €525,000 for selling members’ information

DutchNews, March 3, 2020 

Photo: Depositphotos.com

The Dutch tennis association KNLTB has been fined €525,000 by the Dutch privacy watchdog Autoriteit Persoonsgevens for infringing on the privacy of its members. 

The complaint dates back to 2018 when dozens of the organisation’s members complained about being emailed and phoned by companies with links to the KNLTB even though they had never agreed that their information should be sold. 

Under EU privacy legislation (GDPR), everyone should have been asked to agree. Nevertheless one sponsor was given the names and addresses of 50,000 members, another at least 300,000, the AP said in its ruling. 

The KNLTB, which says it plans to appeal against the fine, said it is extremely careful about what it does with members’ private information. 

In addition, the organisation says the size of the fine will have a major impact on its finances.

US probe finds Cambridge Analytica misled Facebook users on data

Yahoo – AFP, December 6, 2019

Alexander Nix, seen in a 2018 photo taken in London, was CEO of Cambridge
Analytica, a consulting firm that US officials say deceived Facebook users
when it harvested data for voter profiles (AFP Photo/Tolga AKMEN)

Washington (AFP) - US regulators concluded Friday that British consultancy Cambridge Analytica -- at the center of a massive scandal on hijacking of Facebook data -- deceived users of the social network about how it collected and handled their personal information.

The Federal Trade Commission said its investigation launched in March 2018 concluded that the now-defunct political consulting firm "engaged in deceptive practices to harvest personal information from tens of millions of Facebook users for voter profiling and targeting."

The FTC said the British firm, which worked on Donald Trump's 2016 presidential campaign, made "false and misleading" claims when it offered Facebook users a "personality quiz" -- stating it would not download names or any personally identifiable information.

The case created a firestorm over data protection when it was disclosed that Cambridge Analytica was able to create psychological profiles using data from millions of Facebook users through the harvesting of the data.

The personality prediction app was downloaded by 270,000 people but also scooped up data from their friends, and fed into an effort by the firm to predict the behavior of individual US voters.

It was not immediately clear what impact the FTC findings would have.

The FTC issued an order which prohibits Cambridge Analytica -- which closed in 2018 -- from making false misrepresentations on how it handles personal data, and requires compliance with a US-EU privacy agreement.

The FTC reached a settlement earlier this year with Cambridge Analytica's former CEO Alexander Nix and app developer Aleksandr Kogan that requires them to delete or destroy any personal information they collected.

The company claimed in 2018 it had been ruined by "numerous unfounded accusations" that made it impossible to keep the business afloat.

Facebook's own investigation found that some data from 87 million users in the US and elsewhere had been compromised by the firm, and claimed the practices violated the social network's terms of service.

Facebook, which did not immediately respond to a query on the FTC decision, paid a record $5 billion penalty early this year in a settlement with the regulator over mishandling users' private data.

Vopak goes digital, but staff are unhappy about their movements being monitored

DutchNews, November 20, 2019

The Vopak terminal in Eemshaven. Wutsje via Wikimedia Commons

Workers at chemical storage company Vopak are concerned about a new electronic pass card that all workers will have to carry from next year, which will monitor everything they do, the Financieele Dagblad said on Wednesday. 


The card will record where people are, if they are standing up or sitting down and even if they have a work permit, the paper said.

‘We have our real doubts about this,’ Cees den Breejen, of the company works council, told the paper. ‘We have no problem if this is about safety but this is very privacy-sensitive. Where someone walks, if he has gone to the loo… what is the company going to do with all this data?’ 

Vopak argues that the new system will boost safety and will, for example, send out a signal if the wearer is lying on the ground. ‘If someone is horizontal for some time, then the other badges in the neighbourhood will get a signal,’ CIO Leo Brand said. 

The pass cards will first be tested in January and will also get an update allowing sound to be recorded, the FD said. Visitors to Vopak storage facilities will also be given such a card to wear. 

The personnel monitoring is part of the company’s plans to implement the use of digital technology across all aspects of its operations, including the placement of robots in tanks to monitor for leaks and sensors to check if pumps and taps are working properly. 

‘I think it will be very hard to prove that this monitoring falls within the bounds of privacy legislation,’ lawyer Thomas van Essen told the paper. ‘I’ve not come across a system which goes this far.’

Google to pay out $150-200m over YouTube privacy claims: reports

Yahoo – AFP, August 31, 2019

The allegations against YouTube were made by privacy groups who said the platform
had violated laws protecting children's privacy by gathering data on users under
the age of 13 (AFP Photo/LIONEL BONAVENTURE)

Washington (AFP) - Google will pay $150-200 million to settle allegations YouTube violated a children's privacy law while gathering data to better target its adverts, US media reports said Friday.

The US Federal Trade Commission agreed the amount of the settlement against YouTube parent Google, which if approved by the Justice Department would be the largest settlement in a case involving children's privacy, the New York Times reported.

The allegations against YouTube were made by privacy groups who said the platform had violated laws protecting children's privacy by gathering data on users under the age of 13 without obtaining permission from parents, Politico reported.

The FTC is expected to announce its decision on the settlement in September, the New York Times said.

US regulators have long argued Google fails to protect children from harmful content and data collection on its YouTube platform.

Advocacy group The Center for Digital Democracy said in a statement that the proposed settlement would be "woefully low" given Google's size and revenue, and called on the FTC to "enjoin Google from committing further violations" of children's privacy law.

Google remains the money-making engine for parent company Alphabet, with most of its revenue coming from digital ads, which accounted for $116 billion of the $136 billion the Silicon Valley-based company took in last year.

In January, France's CNIL data watchdog slapped Google with a record 50-million-euro fine for failing to meet the EU's tough General Data Protection Regulation (GDPR), which came into force early last year.

Google is appealing the fine.

Fellow US tech giant Facebook recently settled a record $5 billion fine with the US Federal Trade Commission for misusing users' private data.

Instagram begins letting users report misinformation

France24 –AFP, 15 August 2019

San Francisco (AFP) - Instagram on Thursday added a way for users to easily report deceptive posts at the photo and video-oriented social network owned by Facebook.

A new tool being rolled out out lets Instagram users tap a "report" option on-screen when they see a post they deem dubious, then tap a "false information" tag to prompt review by third-party fact-checkers, according to Facebook spokeswoman Stephanie Otway.

The option was expected to be available to all Instagram users by the end of this month.

Such prompts will be one of several "signals" used to determine whether content should be scrutinized by fact-checkers, who will determine their veracity.

"Starting today, people can let us know if they see posts on Instagram they believe may be false," Otway said.

"We're investing heavily in limiting the spread of misinformation across our apps, and we plan to share more updates in the coming months."

The world's biggest social network has been cracking down on fraudulent influence campaigns and bogus posts as pressure has mounted for online platforms to defend against efforts to manipulate online conversations.

User-reported Instagram posts found to be bogus but not in violation of the service's policies will not be deleted, but won't appear when users use "explore" or hashtag searches to discover content.

"Explore and hashtags allow people on Instagram to find content they haven?t already chosen to follow, and by filtering misinformation from these places, we can significantly limit its reach," Otway said.

Feedback from the new tool will be used to train artificial intelligence software to scan for, and rate, fake posts without waiting for them to be reported, according to Facebook.

Twitter reveals unauthorized data use

France24 – AFP, 7 August 2019

Twitter said the error had been corrected and that it was "taking steps to make
sure we don?t make a mistake like this again" AFP/File

Paris (AFP) - The social network Twitter said overnight that user's personal data had been used for advertising purposes, without their consent and despite dedicated settings to counteract such events.

A Twitter statement said the fault was corrected Monday and that an investigation was being conducted to determine how many people had been affected, while advising users to verify their data sharing settings.

The situation involved two cases, the first one arising if users clicked or viewed an advertisement for a mobile application and then interacted with it since May 2018.

"In that case, we may have shared certain data (e.g., country code, if you engaged with the ad and when, information about the ad, etc) with trusted measurement and advertising partners, even if you didn't give us permission to do so," the statement said.

The second case involved Twitter showing people ads "based on inferences we made about the devices you use, even if you did not give us permission to do so," it added.

In that case, data was not used outside the company and did not contain personal information such as passwords or e-mail accounts, according to Twitter.

Twitter apologised for not respecting users' choices, and insisted that it was "taking steps to make sure we don?t make a mistake like this again."

"What is there for you to do? Aside from checking your settings, we don't believe there is anything for you to do," the statement said.

It provided a link to a form that allows users to contact its office of data protection for more information.

The problems arose after Europe's General Data Protection Regulation (GDPR) took effect in May 2018.

The GDPR binds social media platforms and websites to ensuring they have user's explicit consent to collect personal data for advertising purposes or on behalf of third-party enterprises.

It also obliges companies that have been a victim of personal data loss to alert competent authorities in the country where their European headquarters are located, in this case Ireland, within 48 hours of their discovery, and the people affected as soon as possible.

Equifax to pay up to $700 mn over data breach: US

Yahoo – AFP, Rob Lever, July 22, 2019

The data breach at credit monitoring firm Equifax exposed highly sensitive data
from tens of millions of consumers (AFP Photo/Kirill KUDRYAVTSEV)

Washington (AFP) - US credit monitoring agency Equifax agreed to pay up to $700 million in a settlement stemming from a data breach that affected nearly 150 million customers, regulators said Monday.

The biggest-ever penalty in a data breach case was announced by the Federal Trade Commission and state regulators following revelations that hackers had stolen the personal details of millions, including names, dates of birth and social security numbers.

"Companies that profit from personal information have an extra responsibility to protect and secure that data," FTC chairman Joe Simons said in a statement announcing the settlement.

"Equifax failed to take basic steps that may have prevented the breach that affected approximately 147 million consumers," he added.

The settlement, subject to court approval, calls for at least $300 million of the penalty to go to affected consumers, and to provide extra credit monitoring beyond what the company has already offered.

Additional money will be added to this consumer fund based on the number of claims filed, officials said.

"As part of our settlement, Equifax will provide every American who had their highly sensitive information accessed with the tools they need to battle identity theft in the future," said New York state Attorney General Letitia James, one of the state regulators in the case.

Federal Trade Commission chairman Joe Simons, seen at a hearing in Congress 

this year, announced a settlement with credit monitoring firm Equifax over a 

massive 2017 data breach that exposed personal and financial information (AFP 

Photo/CHIP SOMODEVILLA)

"Equifax put profits over privacy and greed over people, and must be held accountable to the millions of people they put at risk."

Some $175 million will be paid to states joining the litigation and $100 million in civil penalties to the federal government to settle charges of unfair and deceptive practices.

According to documents filed in court, Equifax will offer affected consumers "cash compensation, credit monitoring, and help with identity restoration" and must spend at least $1 billion to improve its data security.

Consumers may receive up to 10 years of free credit monitoring or $125 cash to cover their own monitoring costs, the FTC said. Those who experienced identity theft may receive up to $20,000 in compensation.

'Equifax chose us'

While Equifax does not deal directly with consumers, it handles sensitive information on them to help lenders determine borrowers' creditworthiness in the United States and some other countries including Britain. It is one of three large credit-reporting agencies in the United States.

Maryland state attorney general Brian Frosh said the breach was troublesome because most consumers did not know their data was being collected or consent to it.

The worst thefts of personal data by number of victims (AFP Photo/

Thomas SAINT-CRICQ)

"We did not choose Equifax, Equifax chose us," he told a news conference in Washington with FTC and other officials.

"It collected our personal information... and it sold the product and some of the raw data to other people."

The FTC said that Equifax learned of a vulnerability in its network in March 2017 but failed to patch its network or notify consumers until later in the year.

Origin remains unclear

While not the largest breach -- attacks on Yahoo leaked data on as many as three billion accounts -- the Equifax incident could be the most damaging because of the nature of the data collected: bank and social security numbers and personal information of value to hackers and others.

It remains unclear who was behind the Equifax hack, but some experts said it appeared to be the work of a state-sponsored actor.

Equifax chief executive Mark Begor said in a statement: "This comprehensive settlement is a positive step for US consumers and Equifax as we move forward from the 2017 cybersecurity incident and focus on our transformation investments in technology and security as a leading data, analytics, and technology company."

Hospital fined €460,000 for privacy breaches after Barbie case

DutchNews, July 16, 2019 

The Haga hospital in The Hague has been fined €460,000 for poor patient file security, after it emerged a tv reality soap star’s medical records had been accessed by dozens of unauthorised members of staff. 

The Dutch privacy watchdog Authoriteit Persoonsgegevens said its research showed patient records at the hospital are still not properly secure. 

‘The relationship between a healthcare provider and patient must be completely confidential,’ chairman Aleid Wolfsen said. ‘This should be the same within the walls of a hospital. It does not matter who you are.’ 

The hospital gave 85 members of staff an official warning for looking at the medical files of Samantha de Jong, better known as Barbie, when she was hospitalised after a suicide attempt last year. 

The members of staff were not involved in treating the tv reality star and were therefore not entitled to check her files, the hospital said. 

Concerns about privacy have been one of the major brakes on developing a nationwide digital medical record system in the Netherlands. In 2011 the upper house of parliament pulled the plug on a €300m project to introduce such a system due to privacy concerns. 

The government is now planning to introduce a system allowing patients to ‘manage’ their own medical records on their computer or mobile phone and decide who should have access to what information.

One year on, EU's GDPR sets global standard for data protection

Yahoo – AFP, May 24, 2019

European Union (UE) Justice Commissioner Vera Jourova addresses a press
conference taking stock of the General Data Protection Regulation (GDPR)

The EU's strict data laws have set the global benchmark for protecting personal information online since coming into force a year ago, but some worry that many users have barely noticed the change.

The "General Data Protection Regulation" (GDPR), launched on May 25 last year, enhances the rights of internet users and imposes a wide range of obligations on companies, including that they request explicit consent to use personal data collected or processed in the European Union.

The EU has billed it as the biggest shake-up of data privacy regulations since the birth of the web, saying it sets new high standards as the world seeks closer scrutiny of tech giants like Facebook, Google and Amazon.

It has also prompted other authorities around the world to strengthen their own data laws.

The US state of California, home to global tech haven Silicon Valley, last year adopted stringent data legislation largely inspired by the GDPR.

Japan meanwhile has worked with the EU to finalise common rules to offer its citizens an equivalent level of data protection as the GDPR.

And Australia plans to significantly strengthen sanctions against companies that breach data privacy rules, following the EU's lead -- the GDPR allows fines of up to four percent of a firm's turnover.

Companies slow to implement

But the transition has not always been easy -- companies inside and outside the EU have spent a total of hundreds of millions of euros to comply with the regulations.

Much of this has gone to upgrading how firms handle the vast amounts of data streaming in every day.

"Many companies face a major problem: their IT system was designed around providing services, but not around the data, which is constantly duplicated in all directions, sent to multitudes of providers and suppliers," said Gerome Billois, an expert at the IT service management company Wavestone.

He added that 31 percent of companies fail to implement the GDPR's "right to be forgotten" -- which allows people to have their personal data deleted -- because "they don't know precisely where the data is".

But Jean-Michel Franco of the French software company Talend says the industry is now "starting to get up and running" in implementing the GDPR.

Users ignoring rights?

However several campaign groups that defend the rights of internet users say that the GDPR's lofty goals are still a long way from being reached.

The main difference that most EU internet users notice under the GDPR are consent banners that pop up as they access a website.

Many users simply give their consent in the quickest way possible rather than asking for "more information" and being led into a maze of dense information and further questions.

A recent study of one urban transport website found that nearly 80 percent of users simply clicked the "accept all" button to move onto the site as quickly as possible.

Only around 10 percent of users chose to read the information detailing their rights -- if the explanations were short -- while another 10 percent read them thoroughly, according to the study of more than 280,000 people conducted in February by mobile marketing firm Ogury.

145,000 complaints

But while many internet users may pay the changes little heed, the GDPR has empowered some to take action against tech giants.

So far nearly 145,000 complaints and questions have been registered with the EU's national authorities in charge of enforcing the GDPR, an initial assessment revealed this week.

The complaints have also triggered severe penalties, including France's record 50 million euros ($56 million) fine on US giant Google for not doing enough to inform users on how their data is used.

EU Justice and Consumer Affairs Commissioner Vera Jourova has said the regulation is like "a one-year-old baby who has an appetite and is very agile".

There was widespread criticism in the months leading up to the regulation coming into force, but now voices "around the world are calling for comprehensive data protection rules similar to GDPR", she added.

Probe after 117,000 job seekers’ CVs are skimmed from UWV website

DutchNews, May 6, 2019

An investigation has been ordered after 100,000 CVs have been illegally downloaded from the website of the employees’ insurance agency UWV. 

Social affairs minister Wouter Koolmees said the 117,000 resumes had been accessed over a period of two weeks from the website werk.nl using the account of a UWV staff member. The employee in question claimed to have been unaware of the activity. 

The national cybersecurity centre NCSC and the privacy watchdog Autoriteit Persoonsgevevens have been informed and the incident has been reported to the police. All those involved have been contacted by the UWV to warn them to watch out for phishing scams and other online fraud. 

IT experts said the episode highlighted weak security at the UWV, which uses the werk.nl website to share the CVs of jobseekers with employers. Jobseekers have the option of uploading ‘open’ CVs, which are freely available, or ‘closed’, meaning they are available on request.

‘Every company that has an account with werk.nl can see job seekers’ details,’ René Veldwijk told Trouw. ‘All that’s happened now is that somebody spent two weeks trawling al those details with a computer programme. It could be criminals, but it could also be a company that wants to use the data to connect job seekers with employees.’ 

He added: ‘The fact that it took two weeks for the UWV to notice that so many CVs were being downloaded shows they’re not looking out for it properly. It was all done through one account. If the perpetrators had been a bit more professional in their approach and used several accounts, the UWV probably still wouldn’t have noticed anything.’

Singapore Airlines denies snooping with seatback cameras

Yahoo – AFP, 21 February 2019

Singapore Airlines says the cameras on its latest inflight entertainment systems
have been disabled

Singapore Airlines insisted Thursday that cameras on its planes' entertainment systems had been disabled after an outcry online from worried passengers who spotted the tiny lenses peering at them.

Travellers took to Twitter and other social media to raise the alarm over the cameras at the bottom of seatback screens on a number of the Singapore flag carrier's newer aircraft.

"Just found this interesting sensor looking at me from the seat back on board of Singapore Airlines. Any expert opinion of whether is a camera?" passenger Vitaly Kamluk tweeted.

His tweet was accompanied by photos of the monitor with the embedded camera.

Another passenger urged the airline in a tweet to "notify all your passengers and get their consent, particularly EU residents, that you are doing this, why, what are you doing with the data and how long you keep it".

The airline confirmed that some of its latest inflight entertainment systems did have fixed cameras -- but assured passengers that they had been disabled.

"These cameras have been intended by the manufacturers for future developments. These cameras have been permanently disabled on our aircraft and cannot be activated on board," the airline said in a statement.

"We have no plans to enable or develop any features using the cameras."

Almost 10,000 people complain about privacy being breached

DutchNews, December 13, 2018

Photo: Depositphotos.com

The Dutch privacy regulator Autoriteit Persoonsgegevens said on Thursday it had received almost 10,000 complaints since the introduction of new European privacy legislation (GDPR) in May this year.

In addition, 11 companies and organisations are being investigated for non-compliance after dozens of complaints were made about their operations, the AP said. 

Many complaints centred on companies which did not want to give people insight into the information they kept about them – which they are now required to do by law. Others focused on companies collecting too much information or companies selling or passing on private information to third parties. 

Service companies such as online retailers and public utilities were by far the most often complained about, followed by the IT sector and government departments, financial companies and healthcare.

‘I’m encouraged by just how many people are standing up for their right to privacy by making a complaint,’ chairman Aleid Wolfsen said in a statement. ‘They are giving a serious signal to a company, so that others do not end up in the same position.’

Dutch privacy watchdog fines Uber for keeping quiet about hack

DutchNews, November 27, 2018

Photo: DutchNews.nl

The Dutch data protection agency (DPA) has fined taxi company Uber €600,000 for failing to report a data leak which took place in 2016. 

Uber was hacked in 2016 and the email addresses, names and phone numbers of 57 million users came into the hands of hackers. In the Netherlands, 174,000 clients and drivers were affected. 

Uber paid the hackers €100,000 to keep quiet about the hack and did not go public with the news, which only emerged a year later. By law the company should have informed the DPA within 72 hours. 

The taxi company reached an out of court settlement in the US equivalent to some €130m and was also fined €434,000 in Britain.

Heightened debate in US as EU privacy rules take effect

Yahoo – AFP, Rob Lever, May 25, 2018

New EU privacy rules require online services such as Facebook to get consent
for how personal data is accessed and shared (AFP Photo/Mladen ANTONOV)

Washington (AFP) - Amid a global scramble to comply with new EU data protections laws, the debate on privacy has intensified in the United States with some calling for similar measures for Americans, and others warning the rules could fracture the global internet.

US tech firms, and virtually all companies with online operations, will need to comply with the rules if their sites are used in the European Union, or face hefty financial penalties.

Some American firms, including news sites like the Los Angeles Times and New York Daily News, blocked access in the EU because they were unable to comply with the General Data Protection Regulation, which took effect Friday.

Other US websites have shut down entirely, and some have hired consultants to help shut off access for any users in Europe.

Large US tech firms have pledged compliance with the EU rules, and have in many cases promised to extend the same protections worldwide.

But legal challenges filed in Europe accused Google and Facebook of failing to abide by the new law.

Why not in US?

Some US activists argue that the implementation offers an opportunity to give more privacy and data protection benefits to Americans.

New EU data protection rules are likely to radically change how websites use
and share personal information and track users (AFP Photo/Pau Barrena)

"We see no reason why US companies, as they strive to comply with the new European policies, cannot extend the GDPR standard to American consumers," said Katharina Kopp of the Center for Digital Democracy, one of 28 activist groups endorsing a letter in that vein to major US and global companies.

Senator Ed Markey and three fellow lawmakers introduced a resolution this week that would call on firms to offer the same protections of the European law in the US.

"The American people are going to wonder why they are getting second-class privacy protections," said Markey.

The law establishes the key principle that individuals must explicitly grant permission for their data to be used, and give consumers a right to know who is accessing their information and what it will be used for.

Companies can be fined up to 20 million euros ($24 million) or four percent of annual global turnover for violations.

Cumbersome, confusing

GDPR critics argue the law is confusing and cumbersome, and could lead to unintended effects on both sides of the Atlantic.

Daniel Castro of the Information Technology and Innovation Foundation, a Washington think tank, called GDPR "a confusing and impractical set of rules" that offers consumers little benefit.

Some analysts fear that news organizations unable to comply with EU data 

rules will cut off some users, resulting in a "splinternet" where different information 

is available depending on one's region (AFP Photo/Karen BLEIER)

"Instead of hiring engineers, companies are hiring privacy lawyers," Castro said in a blog post with researcher Alan McQuinn.

Ryan Radia of the Competitive Enterprise Institute said that although GDPR was aimed at Big Tech, it is likely to strengthen the grip of large internet firms.

"This will result in greater market concentration, as small firms and startups will find it difficult to comply with the increased regulatory cost burden," Radia said.

Amy Webb, a fellow at Harvard's Nieman Foundation and founder of the Future Today Institute, warned the new law could lead to a "splinternet" with different kinds of data available in various regions of the world, and could be particularly cumbersome for news organizations.

"It's plausible within a decade, we could find ourselves stuck in a new digital divide, where many disparate splinternets behave and function differently, depending on where in the world the net is being accessed," she said in a blog post this week.

Webb said news organizations could find it especially difficult to comply because of the need for consent in organizing feeds and promoting content.

"The business model for news, already tenuous, could be further weakened," she said.

Henry Farrell, a George Washington University professor who follows transatlantic relations, said the entire business model of the tech sector could be at risk from GDPR.

"This is a fundamental attack on the 'two sided market' profit model that e-commerce companies have pioneered of providing services to individuals, while watching their behavior and feeding up access or data to advertisers," Farrell said in a tweet Friday.