Paul Steiner

✈️ Does Ryanair’s biometric verification process violate GDPR principles like lawfulness, fairness, and transparency and also “introduce risks including data breaches, identity theft, and unwarranted surveillance”? 👀 A complaint filed against Ryanair centres around changes to Ryanair’s identity verification process introduced in December 2023. 👣 The airline uses an identity verification process using facial recognition for all users without a Ryanair account, purportedly to “protect customers from internet scams”. 📱 Even customers “booking through online travel agencies (OTAs) undergo biometric verification,” said EU Travel Tech. ⚖️“Ryanair’s biometric verification process violates the principles of lawfulness, fairness and transparency required by the GDPR,” the press release said. A European travel tech industry group filed two separate complaints on Tuesday (21 May) to French and Belgian data protection authorities over Ryanair’s use of biometric data, according to a press release shared with Euractiv. 🚷It called for a fine & an immediate halt to Ryanair’s biometric data processing until data protection authorities rule on their complaints. “We urge the data protection authorities to […] take immediate provisional measures” to halt Ryanair’s biometric verification process and impose “an effective, proportionate and dissuasive fine”, the EU Travel Tech press release said. The European Center for Digital Rights (Noyb), an Austrian non-profit, also filed a complaint with the Spanish data protection authority in July 2023 over Ryanair’s biometric verification process. Under GDPR, there is no justification for Ryanair to use facial recognition when users book flights through an online travel agent and not directly on Ryanair’s website, said Nyob.

17

3 comentarios

EDPB launches French and German versions of its Data Protection Guide for small business: The EDPB Data Protection Guide for small business is now available in French and German The Guide provides practical information to SMEs about GDPR compliance and benefits in an accessible and easily understandable language. The development of tools providing practical, easily understandable and accessible data protection guidance is key to reaching a non-expert audience and a strategic objective for the EDPB. The EDPB Data Protection Guide for small business covers various aspects of the GDPR, from data protection basics, to data subject rights and measures to secure personal data. It contains videos, infographics, interactive flowcharts, and other practical materials to help SMEs on their way to become GDPR compliant In the near future, the Guide will become available in 15 more European languages. #dataprotection #dataprivacy #privacy

2

EDPB: Report of the work undertaken by the ChatGPT Taskforce. The report outlines the common denominator agreed upon by the EU SAs in interpreting the GDPR regarding OpenAI's ChatGPT. It also contains a questionnaire that different SAs used when interacting with OpenAI. Key takeaways: - One of the most crucial takeaways is that companies should not rely on technical impossibility when implementing GDPR requirements. The EDPB here mentions data protection by design requirements, which state that the GDPR requirements should be considered when determining the means for processing and at the time of the processing itself. That said, the recently raised issues of the possibility of addressing the data rectification requests by LLMs or other concerns like using anonymization as something that might make the data useless for improving services should be considered from the beginning of building a model and service; - When relying on the legitimate interest legal basis, remember that adequate safeguards play a special role in reducing the undue impact on data subjects and can, therefore, change the balancing test in favor of the controller (e.g., define precise collection criteria; ensure that certain data categories like special categories of data are not collected or removed after data collection; delete or anonymize personal data that has been collected via web scraping before the training stage, etc.); also, when you use prompts for training purposes, a sufficient level of transparency to users about this is another crucial factor when performing LIA; - Do not transfer the responsibility of complying with the GDPR to your users by stating in your Terms or other user-facing documents that users are responsible for their inputs in prompts (data put in your system is your responsibility). For example, here's how Google Gemini puts it here: https://lnkd.in/gjkxwjgF: Please don't enter confidential information in your conversations or any data you wouldn't want a reviewer to see or Google to use to improve our products, services, and machine-learning technologies; - To comply with the transparency requirements, the user should be informed that the generated text, although syntactically correct, may be biased or made up. Still, it doesn't mean this should become an argument of not complying with the data accuracy principle (the report says you must abide by it in any case); - It will also be helpful to check the questionnaire at the end of the report and understand where the gaps might be (e.g., have your DPIAs, LIAs, and purpose compatibility assessments in good shape); also, check your contracts with the processors or joint controllers, as you might need to show [if you are the sole controller] how you ensured that no other party (for example, another company) decides the purposes and means regarding the processing of personal data in the context of the LLM and software infrastructure. #GDPR #AI #privacy

30

Dutch DPA's Guidelines on Data Scraping. Key takeaways: - Legitimate interest is probably the only legal basis a company can use to scrape data (even if the data is publicly available and you remove it right after the collection); - Data scraping cannot be considered a compatible purpose for further data collection and processing, but new processing, so you need to think about a valid legal basis; - If your interest is purely commercial ("non-legally protected" commercial interest, which is unclear, but probably something the DPA earlier stated in the VoetbalTV case: "legitimate interest must follow from the law but cannot be purely commercial", which was considered as unfounded), or you don't have other non-commercial purposes (e.g., fraud prevention, improving the security of your computer systems, etc.), you cannot rely on the legitimate interest as a legal basis (e.g., if your goal is to train GenAI models or to create profiles of involved individuals and then resell them, you'll likely not rely on the LI, but if your scrape public online forums about information security to visualize security risks to one's organization, is OK to use LI); - Before scraping the data, consider the consequences and potential harms of the planned processing and whether the individuals whose data is involved will have reasonable expectations for that. For example, scraping the data to determine whether or not new employees should be hired based on their expressions on social media creates a significant impact; - Remember to add sufficient transparency about the processing you perform; deleting, pseudonymizing, or anonymizing the data as soon as possible; honor data erasure requests; use robots exclusion protocol; When dealing with special categories of data and considering whether the "manifest disclosure" exception to the data processing prohibition applies, consider whether the individual actively took action to make the data public (e.g., if the default settings in a social media platform are private and the data is publicly available, then you can consider it an exception). #privacy #GDPR

93

3 comentarios

Delete it? Destroy it? Anonymise it? Data protection law tells us we must not keep personal data for longer than necessary for the purposes it was collected for. Sounds easy doesn't it? But in practice one of the more challenging principles to uphold. First we need a policy, and most importantly retention schedules which set out how long different datasets should, or must be kept for. Then we actually need to have a robust plan and the technical capability to get rid of data or anonymise it. Simon Blanchard delves into how organisations can approach this... ☛ https://lnkd.in/d94ba64

2

The average consent rate in Spain went from 89.8% in December 2023 to 84.8% in January 2024, a 5% drop following new updates from the country's data protection authority, the AEPD. But the data tells a bigger story 📈 The AEPD's new guidelines introduced stronger requirements for consent collection, including the obligation to include a "Reject" button in the first layer of the consent banner. While the AEPD's new guidelines may have initially impacted organizations' consent rates, they have also led to a positive outcome. Our dataset shows a significant decrease in the percentage of banners with no option to refuse consent, from 39% to only 10% between December 2023 and March 2024, indicating an increase in the adoption of privacy best practices. Our Country Manager in Iberia/LATAM, Sergio G., has been able to witness this phenomenon with his team on the ground: "Our team at Didomi has seen the profound change driven by the latest guidelines from the AEPD on the Spanish market firsthand. Regulatory changes have the potential to have an impact almost overnight on organizations' and publishers' business models" After offering an overview of consent collection in Europe in our comprehensive data privacy benchmark (downloadable here: https://lnkd.in/eHvJSUSY) earlier this year, we're happy to share more detailed, country-specific observations on Spain: 📊 Consent rate per industry and device 👌 Best consent banner format 📈 Paywall performance Read the full study below, or head to our website to download the high-resolution PDF (no email required): https://lnkd.in/ea_i9kip #Spain #DataPrivacy #Consent

11

Dutch government says it may stop using Facebook over privacy concerns The Dutch government said Friday that it may be forced to stop using Facebook after a warning from the Netherlands’ privacy regulator about the Meta-owned social media platform’s privacy risks. The Dutch Data Protection Authority (DPA) issued a statement advising the Dutch Interior Ministry not to rely on Facebook pages to communicate with citizens if it doesn’t have a clear idea of how Facebook uses the personal data of people who visit government pages. The Interior Ministry had previously asked the DPA to advise on whether the government could use Facebook pages in a compliant way. The government wants clarity from Meta “as soon as possible, at the latest before the summer recess, on how they are addressing our concerns,” Alexandra van Huffelen, the Dutch Minister for Digitalization, said in a statement. “Otherwise, in line with the advice of the DPA, we will be forced to stop our activities on Facebook pages,” she added. The Dutch DPA’s chairman, Aleid Wolfsen, said in a statement that “people who visit a government page trust that their personal and sensitive information is in safe hands.” “The fact that this can also involve information about children and young people makes this even more important. They are vulnerable online and need extra protection,” Wolfsen said in the statement, which was translated to English via Google Translate. A Meta spokesperson told CNBC: “We fundamentally disagree with the assessment that underpins this advice, which is wrong on the facts and demonstrates a fundamental misunderstanding as to how our products work.” “We review all Meta products to ensure they comply with laws in the regions in which we offer our services, and will continue to engage with the Government to ensure they can use social media to communicate with people,” the Meta spokesperson added. The DPA advice serves as further evidence of “growing distrust between European regulators and Meta,” Matthew Holman, a tech, privacy, and AI partner at law firm Cripps, told CNBC via email. Holman said that the Dutch regulator’s concern is likely to be that user data “is shared with government departments on Meta’s platform and could still be subject to security issues, monitoring or access by US federal agencies.” News credit CNBC #news #dailynews #socialmedia #viralnews #trandingnews #trending

3

I've been very positively impressed by this comprehensive guide in managing data protection risk published (in English) by the data protection supervisory authority of Spain - The AEPD. A reference-grade publication strongly recommended to anyone in the business of data privacy/protection. https://lnkd.in/eCPyDb6d  

3

1 comentario

The Spanish Data Protection Agency (AEPD) has recently unveiled an enhanced version of its comprehensive resource, now featuring nearly 800 privacy measures categorized by organizational risk areas such as governance, security, and personal data breach management. "Gestiona RGPD" facilitates the management of an organization's register of processing activities, accommodating up to 500 processing operations in a streamlined manner. This tool is also valuable for conducting Data Protection Impact Assessments (DPIAs). The AEPD has meticulously reviewed queries from data controllers and addressed them in a newly updated user guide. This guide covers a range of topics, including the scope of the tool, information storage and retention, and risk mitigation measures. Both the tool and the user manual are available in English on the AEPD’s website: [Gestiona RGPD Tool] (https://gestiona2.aepd.es/) [User Manual] (https://lnkd.in/duGrTc-5)

2

💡 The Spanish Data Protection Authority has discussed Article 22 of the GDPR in a recent article. It explains the concept of "decisions based solely on automated processing". The article emphasises the importance of assessing the degree of human involvement in automated decision-making, considering factors such as competence, preparation and training, independence and diligence, and the means available to exercise their qualifications. It provides examples and criteria for evaluating human involvement effectively: https://lnkd.in/dxBDEe9j

1

Spanish DPA fines company due to lack of information about compromised personal data after Brute Force Attack / inadequate Risk Assessment --> € 360'000 The Spanish #data protection authority investigated a report of a #security incident at 4FINANCE SPAIN FINANCIAL SERVICES (VIVUS). In the incident, personal data of the company's customers had been compromised by means of a Bruce Force attack. The #dataprotection officer of VIVUS considered the potential #risk to be too low to have to inform those affected. The AEPD instructed 4FINANCE SPAIN FINANCIAL SERVICES to do so. In addition, there were several complaints from private individuals indicating that there had been cases of identity theft in connection with the incident. The AEPD's investigation revealed that the risk assessment carried out by 4FINANCE SPAIN FINANCIAL SERVICES on its #web portal considered the risk to be significantly too low. There was no assessment of the risk for those affected by the specific security incident. The original fine of EUR 600,000, consisting of two penalties of EUR 200,000 (Art. 5 i f GDPR) and EUR 400,000 (Art 32 GDPR) respectively, was reduced to EUR 360,000 due to voluntary payment and admission of guilt. #gdpr #compliance

37

The Dutch DPA & Data Scraping The Dutch DPA warns that in certain cases scrapping isn’t just a privacy faux pas; but should be flagged as “almost always illegal”. Ioana Stoica details the subject in an article that can be read by accessing the following link: https://lnkd.in/dDvrHkBq #GNP #FreshPerspectives #Privacy #Scrapping #LegitimateInterest #AI #DataSourcing

16

2 comentarios

AI - Ingemar interviews HCL's Data Protection consultant, Nick Richards, about the new EU AI Act and what it means for business. https://lnkd.in/d8UVJh-D Contact us if you'd like to discuss this or anything to do with GDPR & Data Protection. #business #AI #HR #dataprotection #GDPR #ArtificialIntelligence

3

💡 LEGAL SPOTLIGHT ▪ Italy: ChatGPT temporarily banned by Italian Data Protection Authority ▪ 🖥️ On 30 March 2023, the Italian Data Protection Authority ordered the temporary restriction of data processing by ChatGPT, effectively blocking its use and Italy. The Authority's order was issued under Article 58 of the General Data Protection Regulation (GDPR) as a result of the violations carried out by the software in the processing of users' and data subjects' data. ✨ After consultations with Open AI, on the 11th April 2023 the Italian Authority agreed to suspend said order on condition that the latter complies with the announced corrective measure. 🛡️The measures concern, in particular, the provision of a clear information notice for you users and data subjects on the processing of their data by ChatGPT, the provision of tools for the exercise of data subjects' rights, the choice of a more compliant legal basis for the processing which also takes place for algorithmic learning purposes, and the implementation of a user age verification system. 🌐 The Italian Authority’s measures have also attracted the attention of the European Data Protection Board (EDPB), which has decided to launch a European task force to foster cooperation and identify compliant solutions. 📰 Read more here: https://lnkd.in/gTj6ycFU UIA Union Internationale des Avocats, Barbara Gislason, Steven Richman, Catherine Peulvé, Laura Collada, Marie-Pierre Richard, Anne-Marie Villain #brevesjuridiques #juristeinternational #legalspotlight #brevesjuridicos #lawyers #uiapublications

9