Cybersecurity guide published by CNIL of France

The CNIL, in collaboration with the French government, has recently published a cybersecurity guide for French municipalities. 

 

In recent times, cybersecurity has posed major difficulties for several communities in France. As a result, a study was conducted by Cybermalveillance.gouv.fr, a government-sponsored cybersecurity initiative, toward the end of 2021. This study was focused on communities with less than 3,500 inhabitants across France, which represents roughly 91% of municipalities in France. According to this report by the CNIL, the aim of this initiative was to understand digital uses, identify the risks/barriers and understand the needs in this type of structure, in order to provide useful and concrete responses. Based on the results of this study, CNIL has published a cybersecurity guide, to help individuals better understand the legal framework for cybersecurity in France. 

 

Individuals in these municipalities are largely unaware of legal frameworks, and in many cases found them to be complex. 

 

One of the most significant lessons of this study was that audiences are largely uninformed or unaware. Based on the study’s results, it was revealed that the majority of respondents are indeed unaware of the current legal framework, with the exception of the GDPR. The framework for responsibilities in terms of digital security are scarcely, or not at all known to local elected officials and territorial agents. These individuals largely consider the regulations relating to cybersecurity particularly complex.

 

The CNIL and Cybermalveillance.gouv.fr have collaborated to tackle this issue by composing a cybersecurity guide. 

 

In order to ameliorate the issue of lack of knowledge and understanding of the legal frameworks within the municipalities, Cybermalveillance.gouv.fr and CNIL collaborated to compose a cybersecurity guide. This guide relates to the obligations and responsibilities of local authorities and their public establishments where cybersecurity is concerned. It is meant to serve as a source of education for local elected officials as well as territorial agents, on the obligations of authorities regarding various aspects of cybersecurity. These include the protection of personal data, the implementation of local teleservices, and hosting health data. In addition, the guide recalls the various types of legal liability to which local authorities and their public establishments are exposed in the event of cyberattacks and/or damage related to administrative responsibility. civil liability and criminal liability. 

 

Does your company have all of the mandated safeguards in place to ensure the safety of the personal data you collect or process? Aphaia can help. Aphaia also provides both GDPR and Data Protection Act 2018 consultancy services, including data protection impact assessments, and Data Protection Officer outsourcing. We can help your company get on track towards full compliance. Contact us today. 

The ICO preaches vigilance in the face of possible cyber attacks

The ICO preaches vigilance in the face of possible cyber attacks as a result of the Russia Ukraine conflict.

 

The ICO preaches vigilance, as the likelihood of cyber attacks increases amid the Russia- Ukraine war. The Commissioner, John Edwards, when questioned on the possibility of Russia- Ukraine cyber attacks spreading to the UK, says that the ICO thought it necessary to remind businesses of the importance of data security and that the conflict has brought with it an increased cyber security threat. According to this article from the Guardian, the Commissioner said that the ICO had yet to see warnings of Russian cyber retaliation for UK support of Ukraine come to fruition, but companies should check their cybersecurity, including reminding employees to report suspicious emails rather than just deleting them.

 

The ICO advises that firms should step up their vigilance in the face of increased potential for cyber attacks. 

 

Due to the imposition of sanctions on Moscow by London, cyber security experts, including the UK’s cyber security agency, warn that hackers could target Britain. Edwards said: “We have picked up on that heightened threat environment and we think it’s really important to take the opportunity to remind businesses of the importance of security over the data that they hold. This is a different era from blacking out the windows and keeping the lights off. The threats are going to come in through your inbox.” The ICO recorded a total of 1,345 “cybersecurity incidents” in the second half of 2021, including ransomware attacks, where assailants demand payment in cryptocurrency to decrypt the target’s computers, as well as phishing attacks, where the victim is tricked, often via email, into downloading malware or handing over their login details. Compared to the very same period in 2019, this statistic is up by 20%. 

 

Companies risk being fined if they do not take adequate measures to safeguard against cyber attacks. 

 

The ICO has now warned that companies which fail to take adequate measures against cyber attacks risk penalties, which can include multi million-pound fines. The ICO aims to help ensure organisations protect people’s data while enforcing data protection regulation. Other regulators in Europe have taken a similar stance of cautioning companies and organisations. The Norwegian DPA, for example, has released a statement urging all companies that export personal data from Norway to recipients in Ukraine and Russia to reconsider the legal basis for the data transfers. In addition, the Norwegian DPA sought to remind these organizations that Article 24 of the Privacy Regulation emphasises that appropriate technical and organizational measures shall be taken to protect personal data in accordance with the requirements of the Privacy Regulation, and that such measures shall be reviewed and updated as necessary. Overall, authorities are urging organizations to take the necessary measures to protect user data in this current climate, bearing in mind that the increased instability in these countries is more likely to lead to cyber security issues. 

Does your company have all of the mandated safeguards in place to ensure the safety of the personal data you collect or process? Aphaia can help. Aphaia also provides both GDPR and Data Protection Act 2018 consultancy services, including data protection impact assessments, and Data Protection Officer outsourcing. We can help your company get on track towards full compliance. Contact us today.

Facebook View sunglasses questioned by Irish and Italian authorities

Facebook View sunglasses questioned by the Irish and Italian authorities, regarding whether they effectively notify data subjects that they are being recorded.

 

 

A new product by Facebook in collaboration with Ray Ban, is now coming under question by European data protection authorities. The product, called “Facebook View” was introduced to the general public with a short promotional video of Mark Zuckerberg speaking about these innovative glasses, which can take photos and record video. In the video, Mr. Zuckerberg made an attempt to appease possible qualms from the public on the privacy of this technology, citing that an LED light goes on, on the frame of these sunglasses, to notify those around when the glasses are recording. However this feature is now being called into question by the Irish and Italian regulators: the Irish DPC, and Garante respectively. Their main question: is a light on the frame enough to significantly notify people that they are being recorded?

 

 

Facebook View sunglasses are seen as much less conspicuous than a camera or cell phone, in communicating that recording is in progress.

 

It is important that when people are being recorded that they have a sense that this is happening. When someone pulls out a camera or a cell phone for example, the general assumption is that recording is in progress or a photo is being taken. People are not assuming automatically that they are being recorded when they see someone wearing a pair of Ray Bans. Most people are also not looking for a light on a pair of glasses under regular circumstances. The Irish and Italian authorities, according to this joint statement recently issued, do not believe that a pair of sunglasses can adequately give notice that recording is in progress.

 

 

The relevant authorities call on Facebook to demonstrate the effectiveness of the LED light to inform people that recording is in progress, as well as run an information campaign.

 

The Irish DPC and Garante claim that it has not been demonstrated to them that comprehensive testing was done by Facebook, to ensure that an LED light would effectively communicate to people that they are being recorded. Facebook is now being called to demonstrate the effectiveness of the LED light to inform people that they are being recorded. In addition, the authorities are asking Facebook to run an information campaign to adequately alert the public on how this new product may result in much less obvious recording of their images.

 

“Facebook should also explain whether there are any plans to combine the information recorded using the Facebook View sunglasses with Facebook existing databases. This scenario seems likely considering that Facebook core product consist on users sharing photos and videos on the social network, where they can tag their friends and contacts” points out Cristina Contero Almagro, Partner in Aphaia.

 

 

Does your company have all of the mandated safeguards in place to ensure compliance with the GDPR, Law Enforcement Directive and Data Protection Act 2018? Aphaia provides both GDPR and Data Protection Act 2018 consultancy services, including data protection impact assessments, and Data Protection Officer outsourcing. We can help your company get on track towards full compliance. Contact us today

Guidance on cookie consent requirements from Malta DPA

The guidance on cookie consent requirements from the Malta DPA gives insight on the applicable legal framework for their use.

 

The Data Protection Authority of Malta has just published guidance cookie consent requirements to aid businesses and organizations in setting them up correctly on their web pages and apps. Cookies are alphanumeric files which are stored on a user’s device for later use. These later uses may include memorising preferences, storing session information or identifying a data subject through a unique identifier. Some cookies, known as tracking cookies, are used for the purpose of behavioral advertising. 

 

The guidance on cookie consent requirements from the Malta DPA heavily emphasizes the notion of consent. 

 

The application of cookieson a website or app is allowed under the applicable laws once they meet certain requirements. The guidance from the Malta DPA focuses on tracking cookies, understood as those used for commercial purposes to deliver behavioural advertising. According to the guidance, for tracking cookies to be lawfully installed on a user’s device, a valid consent mechanism which allows users to take affirmative action giving prior informed consent to the cookies must be implemented. Originally under the ePrivacy Directive, and now also under the GDPR, the notion of consent is very relevant to lawfully obtaining and storing information on data subjects. 

 

The notion of consent in the ePrivacy Directive is linked to that of the GDPR. As a result, in order for stakeholders to obtain valid consent within the scope of the ePrivacy Directive provisions, the elements of valid consent as upheld by Article 4(11) GDPRare applicable in a cumulative manner. This means that consent must  be freely given, specific, informed, and must result from an “unambiguous indication of the data subject’s wishes, by a statement or by a clear affirmative action” and this is what  would signify agreement to the processing of personal data relating to them. This consent must also be withdrawable.

 

According to Regulation 5(1) of the “Processing of Personal Data (Electronic Communications Sector) Regulations” (Subsidiary Legislation 586.01), which transposes article 5(3) of the ePrivacy Directive, the “storing of information or the gaining of access to information stored in the terminal equipment of a subscriber or user shall only be allowed on condition that the subscriber or user concerned has given his consent”.

 

Transparency is necessary in all matters to ensure that the rights and freedoms of data subjects remain protected. 

 

The GDPR maintains that data subjects must be informed, and have at the very least, a basic understanding of the state of play, allowing them to decide whether or not to give consent and how to exercise the right to withdraw consent. Pursuant to article 7(3) of the GDPR, data subjects should be able to withdraw their consent at any time and it should be as easy to withdraw their consent as it is to give it. With regards to cookies, transparency refers to the provision of adequate information regarding the processing operation, including how data subjects can exercise their rights. Accordingly, the GDPR stipulates that individuals must also be informed on how to withdraw their consent before it is given. The failure to provide data subjects with a permanent withdrawal option, including the relevant information on withdrawal, infringes several articles of the GDPR.

 

According to the guidance on cookie consent, cookie walls, pre-ticked boxes and scrolling infringe on the regulations governing cookie consent. 

 

In order to fairly and transparently obtain informed consent from users, there are some features which must be avoided as they compromise the rights and freedoms of users. The Malta DPA, in their non-exhaustive list of practices deemed non-compliant, makes mention of cookie walls, pre-ticked boxes and necessary scrolling. 

 

Cookie Walls

 

Cookie walls are banners linked with a website or a mobile app which only allow users to access the site or app after the user grants consent to the use of all cookies and to the purposes for which they are processed. In these cases, access to the website or mobile app is not possible by other means. Indiscriminately collecting personal data through this approach, essentially denies users a  genuine choice, falls foul of the consent requirements as set out in the applicable laws and it is considered to be an unlawful practice. In these cases, consent is in fact not “freely given”. For consent to be freely given, access to services and functionalities should not be made conditional upon the user’s consent for storing information, or gaining access to information already stored, in the device. 

 

Pre-ticked Boxes

In some cases, users’ consent for installing exempt cookies on their devices is sought by using pre-ticked opt-in boxes. According to  recital 32 of the GDPR, “silence, pre-ticked boxes or inactivity should not […] constitute consent”.  As a result, pre-ticked boxes are not a valid tool to obtain consent under the GDPR, specifically with regard to cookies. The approach of using pre-ticked boxes is considered unlawful. 

 

Scrolling  

 

The practice of obtaining consent through a user’s action, such as scrolling or swiping through a web page or pages, does not count as “clear and affirmative”, in terms of the requirements of article 7 of the GDPR and as well as recital 32. As a result, this approach does not satisfy one of the core requirements of valid consent. In addition, this practice makes it extremely difficult to inform, as well as provide the user with his right to withdraw their consent, as easily as it was initially obtained.

 

Does your company want to collect cookies through a website or app? Does your company have all of the mandated safeguards in place to ensure compliance with the GDPR, Law Enforcement Directive and Data Protection Act 2018? Aphaia provides both GDPR and Data Protection Act 2018 consultancy services, including data protection impact assessments, and Data Protection Officer outsourcing. We can help your company get on track towards full compliance. Contact us today