Beacon AI Privacy Newsletter 11th September 2020

ISSUE 11 - 11 SEPT, 2020

Newsletter The latest privacy news, views and announcements Good afternoon We hope you put down a great week. Privacy certainly did and yet again we are agog at what Schrems II is turning up - a very tricky week for

to silo off most data it collects from European users, or stop serving them entirely, at least temporarily. If it fails to comply with an order, Ireland’s data commission has the power to fine Facebook up to 4% of its annual revenue, or $2.8 billion.

Facebook as the Irish DCP issues a preliminary order to suspend EU - US data transfers. Read on for more details and other news items.

PRIVACY NEWS IN BRIEF Ireland to Order Facebook to Stop Sending User Data to U.S. The Wall Street journal reports: "A European Union privacy regulator has sent Facebook a preliminary

Nick Clegg, Facebook’s top policy and communications

order to suspend data transfers to the U.S. about its

executive, confirmed that Ireland’s privacy regulator has

EU users, according to people familiar with the

suggested, as part of an inquiry, that Facebook can no

matter, an operational and legal challenge for the

longer in practice conduct EU-U.S. data transfers using a

company that could set a precedent for other tech

widely used type of contract.“A lack of safe, secure and legal

giants. The preliminary order, the people said, was

international data transfers would damage the economy

sent by Ireland’s Data Protection Commission to

and prevent the emergence of data-driven businesses from

Facebook late last month, asking for the company’s

the EU, just as we seek a recovery from Covid-19,” Mr.

response. It is the first significant step EU regulators

Clegg said. Ireland’s Data Protection Commission declined

have taken to enforce a July ruling about data

to comment.

transfers from the bloc’s top court. That ruling restricted how companies like Facebook can send personal information about Europeans to U.S. soil, because it found that Europeans have no effective way to challenge American government surveillance.

To comply with Ireland’s preliminary order, Facebook would likely have to re-engineer its service

Last few days to access the Gartner's 2020 Market Guide for Subject Rights Request Automation. Access closed 14 Sept.

New Gartner research paper available for all attendees of our Global State of Privacy event.

Beacon AI is delighted to offer access to Gartner's recent research paper 'The State of Privacy and Personal Data Protection, 2020-2022' to all attendees of our 'Global State of Privacy' event next Tuesday Get your ticket now from Eventbrite. Register here > https://bit.ly/34GwHvf

READ ARTICLE Changes to Japan’s data privacy law echo Europe’s GDPR by mail or fax, as before. When processing image data, the intended use should be stated immediately, while the methods and privacy measures used while processing said images should be made clear.

These additions follow hard on the The Daily Swig reports - Japan has heels of more significant changes, which will mean tighter controls on made changes to its 2005 Protection of Personal Information the international transfer of data from 2022, helping to bring the law (APPI) Act, bringing the bill closer further in line with GDPR. in line with the EU’s General Data Protection Regulation (GDPR).

“Japan has a robust data privacy The latest tweaks, announced this law with many similarities to the month, cover data breach GDPR,” Scott Warren, a partner in reporting and the use of facial the Tokyo office of law firm Squire recognition data gathered from Patton Boggs, tells The Daily Swig. devices such as security cameras.

“Indeed, Japan is the only country Breaches should now be reported in Asia to have exchanged using an official form, rather than

joint adequacy findings with the EU, finding the laws roughly equivalent.”Warren added: “What I find interesting is the ways the laws diverge. For example, Japan does not have a breach notification obligation, nor significant penalties on entities failing to meet the standards. “Japan has recently passed an amendment to the law to rectify some of these and other items, including increasing penalties up to $946,000 – but it will take well over a year for it to be fully implemented.”

While in its current form the APPI applies to any organization obtaining personal information from data subjects located in Japan, this hasn’t been enforceable on foreign businesses.

Max Schrems publishes letter from his solicitor to the DCP

Days after being told to suspend data transfers to the US, Facebook has now issued a High Court case against the Irish data regulator The Currency reports that just "days after the Data Protection Commissioner (DPC) sent Facebook a preliminary order to suspend data transfers to the US, the social media giant has lodged papers in the Irish High Court seeking a judicial review. Acting on behalf of Facebook Ireland, the Dublin commercial law firm Mason Hayes + Curran lodged papers with the court yesterday, naming the Data Protection Commissioners as defendant in the judicial review action.

The High Court will be asked to test the validity and legality of the decision of the DPC, a move that will be watched by other social media giants."

Marriott, British Airways and easyJet 'fail to learn' data breach lessons as security breaches are exposed

Read letter on noyb.eu TikTok reveals algorithm details

The Herald Scotland reports - Hundreds of serious data security vulnerabilities have been uncovered on the websites of travel firms including Marriott, British Airways and easyJet, new research has revealed. The study says it suggested firms have failed to learn lessons from previous high-profile hacks that saw millions of customer details compromised. It comes from a new assessment over the security of websites operated

Axios reports - On Wednesday TikTok revealed

by 98 travel companies, including airlines, tour operators,

some of the elusive workings of the prized

hotel chains, cruise lines and booking sites. Last year British

algorithm that keeps hundreds of millions of

Airways and Marriott International were told to expect multi-

users worldwide hooked on the viral video app.

Why it matters: The code TikTok uses to pick your next video is a large part of what has led the two-year-old company to achieve broad popularity along with a remarkable $20-$30 billion valuation. The key asset is in play as

million-pound fines proposed as a result of major UK privacybreach probes with the final decisions not expected until later this year. Last July, the Information Commissioner's Office proposed fining the UK's flag-carrier airline 183 million pounds ($227 million) and the hotel group £99m ($127 million)

TikTok's Chinese parent prepares to sell its U.S.

for breaches of the EU's General Data Protection Regulation.

operation amid fears about its relationship with

The ICO said that poor security practices led to the exposure

China's government.

of customers' data.

I hope you enjoyed our privacy newsletter as we look forward to the weekend. If you have any privacy queries feel free to drop me a line at niamh@beaconai.io From Niamh & the Privacy Beaconettes