Australia admits cyber defences 'inadequate' as medical hack hits millions

France24 – AFP, 26 October 2022 

Hackers have accessed millions of medical records at Medibank, one of Australia's
largest private insurers SAEED KHAN AFP/File

Sydney (AFP) – Hackers accessed millions of medical records at one of Australia's largest private health insurers, the company said Wednesday, prompting the government to admit the nation's cyber safeguards were "inadequate". 

This was the latest in a series of hacks targeting millions of people that have brought Australian companies' lax approach to cyber security into sharp relief. 

Medibank chief executive David Koczkar said information about each of the company's 3.9 million policy holders -- some 15 percent of Australia's population -- had been compromised. 

"Our investigation has now established that this criminal has accessed all our private health insurance customers' personal data and significant amounts of their health claims data," he said in a statement to the Australian stock exchange. 

"This is a terrible crime. This is a crime designed to cause maximum harm to the most vulnerable members of our community." 

The cyber attack was revealed last week, but it was not known until now how many people were impacted. 

The hackers have previously threatened to leak the data, starting with 1,000 famous Australians, unless Medibank pays a ransom. 

Medibank on Wednesday also confirmed it was not insured against cyber attacks, estimating the hack could cost the company as much as Au$35 million (US$22 million). 

The Medibank hack followed an attack on telecom company Optus last month that exposed the personal information of some nine million Australians -- almost a third of the population. 

The Optus attack was one of the largest data breaches in Australian history. 

'Inadequate'

Australia's Attorney-General Mark Dreyfus has previously accused companies of stockpiling sensitive customer data they did not need. 

Firms currently face paltry fines -- Au$2.2 million -- for failing to protect customer data. 

Dreyfus last week said these fines would be ratcheted up to Au$50 million. 

"Unfortunately, significant privacy breaches in recent weeks have shown existing safeguards are inadequate," he said. 

"It's not enough for a penalty for a major data breach to be seen as the cost of doing business." 

Home Affairs Minister Clare O'Neil on Tuesday said the fallout from the Medibank hack was "potentially irreparable". 

"One of the reasons why the government is so worried about this is because of the nature of the data," she told Australia's parliament. 

"When it comes to the personal health information of Australians, the damage here is potentially irreparable." 

O'Neil has previously described hacking as a "dog act" -- an Australian phrase reserved for something especially shameful or despicable.

Microsoft pledges to store European cloud data in Europe

Yahoo – AFP, May 6, 2021 

Microsoft's European clients have long been concerned over the legal status
of data they store with US companies in the cloud and the extent to which
they could be scrutinised by US authorities. 

US tech giant Microsoft on Thursday pledged to store all European cloud-based client data in Europe amid unease on the continent over the reach of US legislation on personal data collection. 

Microsoft's European clients have long been concerned over the legal status of data they store with US companies in the cloud and the extent to which they could be scrutinised by US authorities. 

Those worries came to a head last July when the European Court of Justice struck down the EU-US Privacy Shield, a framework allowing firms to transfer personal data to the United States in compliance with Brussels' General Data Protection Regulation. 

The court found the mechanism did not adequately protect EU data from US authorities over which Europe has neither control nor right of redress. 

In a blog post on Thursday, Microsoft president Brad Smith said: "If you are a commercial or public sector customer in the EU, we will go beyond our existing data storage commitments and enable you to process and store all your data in the EU. 

"In other words, we will not need to move your data outside the EU." 

He said the commitment -- dubbed the EU Data Boundary for the Microsoft Cloud -- would apply across all of Microsoft's core cloud services -– Azure, Microsoft 365, and Dynamics 365 and would take effect by the end of next year.

Private psychotherapy notes leaked in major Finnish hack

Yahoo – AFP, 26 October 2020

The confidential treatment records of tens of thousands of psychotherapy patients in Finland have been hacked and some leaked online, in what the interior minister said Monday was "a shocking act." 

Many victims of the hack reported receiving emails with a demand for 200 euros
($236) in bitcoin to prevent the contents of their discussions with therapists
being made public. (Nicolas Asfouri)

Distressed patients flooded victim support services over the weekend as Finnish police revealed hackers accessed records belonging to private company Vastaamo, which runs 25 therapy centres across Finland. 

Thousands have filed police complaints over the breach, they added. 

Many patients reported receiving emails with a demand for 200 euros ($236) in bitcoin to prevent the contents of their discussions with therapists being made public. 

"The Vastaamo data breach is a shocking act which hits all of us deep down," Interior Minister Maria Ohisalo wrote on her website on Monday. 

Finland must be a country where "help for mental health issues is available and it can be accessed without fear." 

Ministers met for crisis talks this weekend, with further emergency discussions tabled for the coming week over the unprecedented data breach. 

"We are investigating an aggravated security breach and aggravated extortion, among other charges," Robin Lardot, the director of Finland's National Bureau of Investigation, told a news conference at the weekend. 

Lardot added that they believed the number of patients whose records had been compromised numbered in the tens of thousands. 

On Monday evening, Vastaamo said it had fired its CEO, Ville Tapio, after an internal enquiry discovered that he had concealed a March 2019 data breach from the board and the firm's parent company. 

The firm admitted flaws in the security of its customer data, "which allowed criminals to break into the database up until March 2019," Vastaamo said in a statement. 

The company's owner, PTK Midco Oy, on Monday launched court proceedings "in relation to its May 2019 purchase of Vastaamo," the statement added. 

'Justifiably worried' 

Security experts reported that a 10-gigabyte data file containing private notes between at least 2,000 patients and their therapists had appeared on websites on the so-called dark web. 

The hack, which targeted some of society's most vulnerable including children, has caused widespread shock in the Nordic country of 5.5 million, with ministers gathering on Sunday to discuss how to support the patients whose sensitive data had been leaked. 

"It is absolutely clear that people are justifiably worried not only about their own security and health but that of their close ones, too," Ohisalo told reporters late on Sunday. 

On Monday, authorities launched a website for victims of the cyberattack, offering advice and telling them not to pay the ransom demand. 

"Do not communicate with the extortionist, the data have most likely already been leaked elsewhere," the "Data Leak Help" site said. 

Mental health and victim support charities reported being overwhelmed with calls from distressed people fearing that their intimate conversations with their therapists would be publicly released. 

Nothing 'to be ashamed of' 

One of the recipients of a blackmail threat, the former MP Kirsi Piha, tweeted a screenshot of the ransom message along with a defiant reply to the hackers. 

"Up yours! Seeking help is never something to be ashamed of," Piha wrote. 

"I've seen a lot, but I haven't seen this," Mikko Hypponen, chief research officer at data security firm F-Secure said in a statement. 

"I don't think there's a crime in our criminal history which would have more victims than this one." 

Hypponen, an internationally renowned cybersecurity specialist, said the perpetrator used the alias "ransom_man", and said he was only aware of one other patient blackmail case, where a cosmetic surgery clinic in Florida had a smaller amount of data stolen in 2019. 

On Monday, Finland's social care regulator said in a statement it was investigating Vastaamo's practices, including how well patients were kept informed of the breach. 

Meanwhile, the head of the state digital services agency DVV, Kimmo Rousku, said that the cyberattack could have been avoided if Vastaamo had used better encryption. 

DVV published a checklist on Monday for firms to make sure their digital security is in order. 

"Management needs to wake up," Rousku told public broadcaster Yle. 

A phone line offering legal advice had also been set up, the country's consumer authority announced.

Dutch tennis association fined €525,000 for selling members’ information

DutchNews, March 3, 2020 

Photo: Depositphotos.com

The Dutch tennis association KNLTB has been fined €525,000 by the Dutch privacy watchdog Autoriteit Persoonsgevens for infringing on the privacy of its members. 

The complaint dates back to 2018 when dozens of the organisation’s members complained about being emailed and phoned by companies with links to the KNLTB even though they had never agreed that their information should be sold. 

Under EU privacy legislation (GDPR), everyone should have been asked to agree. Nevertheless one sponsor was given the names and addresses of 50,000 members, another at least 300,000, the AP said in its ruling. 

The KNLTB, which says it plans to appeal against the fine, said it is extremely careful about what it does with members’ private information. 

In addition, the organisation says the size of the fine will have a major impact on its finances.

Google says it will phase out web-tracking 'cookies'

Yahoo – AFP, January 14, 2020

Google says it i s on track to phase out 'cookies' used to track people's online activities
while still offering ways to deliver targeted advertising (AFP Photo/LOIC VENANCE)

San Francisco (AFP) - Google on Tuesday said is making progress in its quest to vanquish third-party "cookies" on its popular browser used to track people's online activities, a focus of many privacy activists.

The online giant said its "Sandbox" program would still allow advertisers the ability to deliver targeted messages, while also sparing people from being tracked by snippets of code called "cookies" when they use its Chrome web browser.

"We are confident that with continued iteration and feedback, privacy-preserving and open-standard mechanisms like the Privacy Sandbox can sustain a healthy, ad-supported web in a way that will render third-party cookies obsolete," Chrome director of engineering Justin Schuh said in a post.

"Our intention is to do this within two years."

The use of cookies to track where people go, what they do, and what they buy online has raised concerns about privacy violations but has also been defended as integral to supporting free online services that survive on advertising revenue.

"Our goal for this open source initiative is to make the web more private and secure for users, while also supporting publishers," Schuh said.

Schuh offered no specifics on what Google would use to replace cookies but said "we are working actively across the ecosystem so that browsers, publishers, developers, and advertisers have the opportunity to experiment with these new mechanisms."

Google said simply blocking cookies was not a good solution because it has encouraged the use of "fingerprinting" techniques to track people which some say are more insidious than cookies.

But it remained unclear if eliminating third-party cookies may give the California-based company more control of online advertising, which it dominates along with Facebook.

Swiss minister says Facebook's Libra has 'failed' in current form

Yahoo – AFP, Julie JAMMOT, December 28, 2019

Swiss president and finance minister Ueli Maurer, pictured September 2019, has
called Facebook's planned Libra cryptocurrency a "failed" project (AFP Photo/
Johannes EISELE)

San Francisco (AFP) - The Swiss president and finance minister has delivered the latest blow to Facebook's planned Libra cryptocurrency, saying it has "failed in its current form," Swiss network SRF reported Friday.

"The central banks are not going to accept the basket of currencies" that Libra is supposed to be based on, Ueli Maurer, who is in his final days in the rotating presidency of the Swiss Confederation, Switzerland's federal council, told SRF.

Libra, a high-profile project of social network giant Facebook, is tentatively scheduled for a 2020 launch but has faced months of severe criticism from some of the world's most influential financial authorities.

In theory, Libra will be managed by a Geneva-based independent association linking several companies and non-profit groups.

But since early October, the online payment companies PayPal and Stripe, as well as Visa, Mastercard and others, have withdrawn from the project amid growing pressure from American and other regulators.

They have cited the potential for illicit uses of the currency and have underscored the battered reputation of California-based Facebook in matters of privacy and data protection.

French Finance Minister Bruno Le Maire, pictured October 2019, has expressed 

serious concerns about Facebook's Libra project (AFP Photo/Andrew 

CABALLERO-REYNOLDS)

Loss of 'sovereignty'

Countries and central banks -- for now the only entities legally permitted to issue currency -- have also expressed concern about a blow to their sovereignty.

In October, French Economy Minister Bruno Le Maire bluntly expressed his concerns, saying, "Libra is not welcome on European soil."

"We will take steps with the Italians and Germans, because our sovereignty is at stake," he said, speaking in Washington on the sidelines of the fall meeting of the World Bank and International Monetary Fund.

Earlier this month, a US Federal Reserve official expressed American reservations.

"Without requisite safeguards, stablecoin networks at global scale may put consumers at risk," Fed Governor Lael Brainard said in a speech in Frankfurt.

Cryptocurrencies to date have suffered from "staggering" losses due to fraud and theft, Brainard said.

Facebook chairman Mark Zuckerberg, pictured October 2019, has said the Libra 

cryptocurrency will not be launched until it receives all needed approvals (AFP Photo/

MANDEL NGAN)

'Serious concerns'

Stablecoins are a type of cryptocurrency designed to provide stability -- avoiding the wild swings of bitcoin and other cryptocurrencies -- by being pegged to relatively stable assets or currencies.

Libra is designed to make it easy for users of WhatsApp, a Facebook-owned messaging platform, to instantly send funds to friends or family.

The size of Facebook -- 2.2 billion people worldwide connect on at least one of its platforms, which also include Instagram, WhatsApp and Messenger -- would give it the potential to disrupt the global financial system, making it far harder for central banks to manage, Fed chairman Jerome Powell told US lawmakers in July. He expressed "serious concerns."

The Libra association declined to comment when contacted by AFP.

But in October, Facebook CEO Mark Zuckerberg testified before a congressional committee that Libra would not be launched until it received all necessary authorizations from the authorities.

In response to regulators' resistance, Zuckerberg last month opened the door to scaling back plans for Libra if it cannot win the needed approvals.

US probe finds Cambridge Analytica misled Facebook users on data

Yahoo – AFP, December 6, 2019

Alexander Nix, seen in a 2018 photo taken in London, was CEO of Cambridge
Analytica, a consulting firm that US officials say deceived Facebook users
when it harvested data for voter profiles (AFP Photo/Tolga AKMEN)

Washington (AFP) - US regulators concluded Friday that British consultancy Cambridge Analytica -- at the center of a massive scandal on hijacking of Facebook data -- deceived users of the social network about how it collected and handled their personal information.

The Federal Trade Commission said its investigation launched in March 2018 concluded that the now-defunct political consulting firm "engaged in deceptive practices to harvest personal information from tens of millions of Facebook users for voter profiling and targeting."

The FTC said the British firm, which worked on Donald Trump's 2016 presidential campaign, made "false and misleading" claims when it offered Facebook users a "personality quiz" -- stating it would not download names or any personally identifiable information.

The case created a firestorm over data protection when it was disclosed that Cambridge Analytica was able to create psychological profiles using data from millions of Facebook users through the harvesting of the data.

The personality prediction app was downloaded by 270,000 people but also scooped up data from their friends, and fed into an effort by the firm to predict the behavior of individual US voters.

It was not immediately clear what impact the FTC findings would have.

The FTC issued an order which prohibits Cambridge Analytica -- which closed in 2018 -- from making false misrepresentations on how it handles personal data, and requires compliance with a US-EU privacy agreement.

The FTC reached a settlement earlier this year with Cambridge Analytica's former CEO Alexander Nix and app developer Aleksandr Kogan that requires them to delete or destroy any personal information they collected.

The company claimed in 2018 it had been ruined by "numerous unfounded accusations" that made it impossible to keep the business afloat.

Facebook's own investigation found that some data from 87 million users in the US and elsewhere had been compromised by the firm, and claimed the practices violated the social network's terms of service.

Facebook, which did not immediately respond to a query on the FTC decision, paid a record $5 billion penalty early this year in a settlement with the regulator over mishandling users' private data.

China introduces mandatory face scans for phone users

Yahoo – AFP, December 1, 2019

In September, China's information technology ministry said telecom operators
should use 'technical means' to verify phone users' identities (AFP Photo/WANG ZHAO)

China will require telecom operators to collect face scans when registering new phone users at offline outlets starting Sunday, according to the country's information technology authority, as Beijing continues to tighten cyberspace controls.

In September, China's industry and information technology ministry issued a notice on "safeguarding the legitimate rights and interests of citizens online", which laid out rules for enforcing real-name registration.

The notice said telecom operators should use "artificial intelligence and other technical means" to verify people's identities when they take a new phone number.

A China Unicom customer service representative told AFP that the December 1 "portrait matching" requirement means customers registering for a new phone number may have to record themselves turning their head and blinking.

"In next steps, our ministry will continue to...increase supervision and inspection...and strictly promote the management of real-name registration for phone users," said the September notice.

Though the Chinese government has pushed for real-name registration for phone users since at least 2013 -- meaning ID cards are linked to new phone numbers -- the move to leverage AI comes as facial recognition technology gains traction across China where the tech is used for everything from supermarket checkouts to surveillance.

Online, Chinese social media users reacted with a mix of support and worry over the December 1 facial verification notice, with some voicing concerns their biometric data could be leaked or sold.

"This is a bit too much," wrote one user on Twitter-like Weibo, commenting under an article about the new rules.

"Control, and then more control," posted another.

While researchers have warned of the privacy risks associated with gathering facial recognition data, consumers have widely embraced the technology -- though China saw one of its first lawsuits on facial recognition last month.

In early November, a Chinese professor filed a claim against a safari park in Hangzhou, eastern Zhejiang province for requiring face scans for entry, according to the local court.

In addition to mobile users, Chinese social media site Weibo was forced to roll out real-name registration in 2012.

Oversight of social media has ramped up in recent years as part of the Chinese government's push to "promote the healthy, orderly development of the Internet, protect state security and public interest".

Vopak goes digital, but staff are unhappy about their movements being monitored

DutchNews, November 20, 2019

The Vopak terminal in Eemshaven. Wutsje via Wikimedia Commons

Workers at chemical storage company Vopak are concerned about a new electronic pass card that all workers will have to carry from next year, which will monitor everything they do, the Financieele Dagblad said on Wednesday. 


The card will record where people are, if they are standing up or sitting down and even if they have a work permit, the paper said.

‘We have our real doubts about this,’ Cees den Breejen, of the company works council, told the paper. ‘We have no problem if this is about safety but this is very privacy-sensitive. Where someone walks, if he has gone to the loo… what is the company going to do with all this data?’ 

Vopak argues that the new system will boost safety and will, for example, send out a signal if the wearer is lying on the ground. ‘If someone is horizontal for some time, then the other badges in the neighbourhood will get a signal,’ CIO Leo Brand said. 

The pass cards will first be tested in January and will also get an update allowing sound to be recorded, the FD said. Visitors to Vopak storage facilities will also be given such a card to wear. 

The personnel monitoring is part of the company’s plans to implement the use of digital technology across all aspects of its operations, including the placement of robots in tanks to monitor for leaks and sensors to check if pumps and taps are working properly. 

‘I think it will be very hard to prove that this monitoring falls within the bounds of privacy legislation,’ lawyer Thomas van Essen told the paper. ‘I’ve not come across a system which goes this far.’

China's blacklisted AI firms: what you should know

Yahoo  - AFP, Eva Xiao and Danni Zhu, October 13, 2019

China's AI technology companies are rising stars -- here people have their faces
scanned at the World Artificial Intelligence Conference in Shanghai (AFP Photo/
HECTOR RETAMAL)

Beijing (AFP) - The Chinese high-tech companies blacklisted by Washington over alleged ties to rights abuses are rising stars in China's ambitious drive to overtake the United States in the technology sector.

They make surveillance cameras, facial recognition software and other technology that has become ubiquitous in Xinjiang, the heavily policed northwestern region where an estimated one million mostly Muslim minorities, like ethnic Uighurs, are held in internment camps.

The eight firms were added on Monday to a list of 28 entities that US companies are barred from selling components to without government approval.

Here is a look at the companies targeted:

Hikvision

One of the world's largest suppliers of surveillance equipment, Hikvision is the poster child of Chinese tech firms benefiting from Xinjiang's booming security apparatus.

In 2017, it won at least five security-related contracts totalling 1.85 billion yuan ($260 million) in Xinjiang -- including a "social prevention and control system" featuring tens of thousands of cameras.

But the company also has a global presence, with nearly 30 percent of its revenue last year coming from outside China.

Hikvision has said the US listing lacks "factual basis", and downplayed its impact in a conference call aimed at investors and media on Wednesday.

"Currently, the majority of US components can all be directly replaced or replaced with new designs," said board secretary Huang Fanghong.

"If it's necessary, we will design our own chips."

Hikvision is one of the world's largest suppliers of surveillance equipment

(AFP Photo/FRED DUFOUR)

Megvii

An AI company backed by e-commerce giant Alibaba, Megvii's facial recognition technology is used across a broad range of applications in China, from "smile to pay" mobile payments to identifying individuals for law enforcement.

The firm plans to launch an initial public offering (IPO) in Hong Kong but one of its joint sponsors, Goldman Sachs, said it was "evaluating" its role in the wake of the blacklisting.

Megvii said the US move "reflects a misunderstanding of our company".

Only one percent of its 2018 revenue was from projects in Xinjiang, and no revenue was generated from the region in the first six months of 2019, it added.

In April, the New York Times reported that several Chinese AI firms, including Megvii, Yitu, and SenseTime, were behind software used to racially profile and track Uighurs.

According to media reports, former US vice president and presidential candidate Joe Biden's son Hunter, who has been accused by President Donald Trump of corruption, is a director at BHR Partners, a fund that invested in Megvii.

SenseTime

SenseTime is backed by an illustrious list of investors, including SoftBank, Alibaba, and US chipmaker Qualcomm.

Founded by MIT alumnus Tang Xiao'ou –- a professor at the Chinese University of Hong Kong -- the AI company develops facial and image recognition applications, such as crowd monitoring and identity verification for lending apps.

The firm has a research lab in Silicon Valley and is partnering with universities around the world, including MIT, on AI research.

In an emailed statement, MIT said it would "review all existing relationships" with organisations added to Washington's entity list, and "modify any interactions, as necessary".

According to Dahua's 2018 financial report, about 36 percent of the 

Shenzhen-listed company's revenue came from abroad (AFP Photo/STR)

SenseTime said it was "deeply disappointed" by the blacklisting and would "work closely with all relevant authorities to fully understand and resolve the situation".

Dahua

Dahua Technology is another leading video surveillance equipment provider with an increasing footprint overseas and has projects in Brazil, Italy, and other countries.

According to its 2018 financial report, about 36 percent of the Shenzhen-listed company's revenue came from abroad.

In August, the US also formally banned Dahua and Hikvision, along with telecom giant Huawei and other firms, from obtaining government contracts.

Meiya Pico

Meiya Pico, a digital forensics company, drew scrutiny from rights groups after security researchers said the firm was behind "MFSocket" -- an app that enables police to extract contacts, messages, and other personal data from smartphones.

Yitu

Yitu Technology has developed apps for facial and speech recognition, such as identity authentication at banks, cancer screening, and monitoring transport hubs to assist law enforcement.

iFlytek

Shenzhen-listed AI firm iFlytek is one of the top speech recognition companies in China.

In 2017, Human Rights Watch said iFlytek was working with China's public security ministry to collect "voice pattern" samples and develop a surveillance system that could identify targeted voices in phone conversations.

Yixin

Yixin Science and Technology Co. Ltd is a Beijing-based security firm that sells video surveillance, facial recognition, and counter-terrorism products.

During the 2008 Beijing Olympics, the company provided wireless surveillance systems at bus stops to monitor for terrorist attacks.

Google wins EU fight against worldwide 'right to be forgotten'

Yahoo – AFP, Catherine KURZAWA, 24 September 2019

Google hailed the ruling, saying it has worked Google has worked "to strike a
sensible balance between people’s rights of access to information and privacy"

Google is not required to apply an EU "right to be forgotten" to its search engine domains outside Europe, the EU's top court ruled Tuesday in a landmark decision.

The European Court of Justice handed victory to Google in the case, seen as crucial in determining whether EU online regulation should apply beyond Europe's borders or not.

The US internet giant had argued that the removal of search results required under EU law should not extend to its google.com domain or its other non-EU sites.

The court ruled that, while a search engine operator such as Google must carry out "de-referencing" of links as demanded by a regulator or court in an EU state to all European versions of its sites, that "right to be forgotten" did not need to go further.

"There is no obligation under EU law" for search engine operators such as Google "to carry out such a de-referencing on all the versions of its search engine," the court said.

But it did stress that de-referencing on EU sites must include measures to "seriously discourage" a European internet user being able to get around the "right to be forgotten" by accessing unrestricted results from a search engine on a non-EU domain.

That demands "geo-blocking", which Google says it already uses effectively in Europe.

Savvy internet users, however, can get around that measure with a VPN that masks the user's location, or by going to some non-Google search engines.

Google hails win

The EU court case, seen as pitting individuals' rights to privacy online against freedom of information, stemmed from a legal battle waged by France since 2014 to have Google apply the "right to be forgotten" to all its search domains.

If France had won, it could have deepened a rift between Europe and the United States, which is home to most of the internet's behemoths and whose President Donald Trump has railed against what he sees as EU meddling in US business.

In the end, though, the court found that EU law on the issue did not seek to have the "right to be forgotten" extend beyond its borders.

Google hailed Tuesday's decision by the EU court.

"It's good to see that the court agreed with our arguments," its lawyer, Peter Fleischer, said in a statement, adding that Google has worked "to strike a sensible balance between people's rights of access to information and privacy".

The US company and other stakeholders had warned that authoritarian countries outside Europe could abuse global de-referencing requests to cover up rights violations.

"It's a balanced decision. You can't impose extraterritorial effects when it comes to de-referencing a person," said Yann Padova, a data privacy lawyer with the Baker McKenzie firm in Paris who was not involved in arguing the case.

"What would we say if China started demanding de-referencing of content accessible to French users?" he asked.

Closely watched case

Google's position was bolstered in January by a non-binding opinion from the EU court's top legal advisor, advocate general Maciej Szpunar, who recommended judges "should limit the scope of the de-referencing that search engine operators are required to carry out, to the EU".

The case had been closely watched, especially as Europe has also already emerged as a global rule-setter in terms of data protection on the internet.

A 2016 General Data Protection Regulation it enacted that covers all EU citizens and residents has forced many sites and companies around the globe to comply with its measures.

In terms of the "right to be forgotten" legal fight, France's data regulator, the Commission Nationale de l'Informatique et des Libertes (CNIL), had argued that, for de-referencing to be effective, it must apply to all domains wherever they are.

In 2016, CNIL fined Google 100,000 euros ($110,000) for non-compliance. Google appealed to France's highest court, which in turn referred to the European Court of Justice, ending up with Tuesday's ruling.

Albert Heijn experiments with cash-register free supermarket

DutchNews, September 5, 2019 

Photo: DutchNews.nl

Dutch supermarket chain Albert Heijn is experimenting with a new form of shopping in which ‘buying groceries is just like taking something out of the fridge’. 

The testing ground, a 14 square meter purpose-built store at the company’s Zaandam HQ, has no cash registers and shoppers do not have to scan the products they are buying either. 

Instead, customers open the door to the shop by scanning their bank card.  As they leave, the grocery bill will appear on a screen and the money they owe will automatically be deducted from their bank account. 

The Dutch market leader says it is the first company in Europe to try out such a system, which is currently only being used by company staff. Later this year the company aims to place its laboratory supermarket at a different location where it can be used by anyone.

‘We have cameras in store which register where you walk and what you are standing in front of,’ spokesman Jasper Hoogers said. ‘And this is only a trial. We are testing out lots of different scenarios to see if works.’ 

The cameras do not use facial recognition and work together with special shelving which registers if a product is removed or put back, Hoogers said. 

The company has not yet researched what customers think of the idea, but the underlying thought is to make things easier for clients, Hoogers said. ‘This would allow us to develop a store which can be located anywhere and is open 24 hours a day,’ he said.