Author: stefan

Posted on

(Old) links related to the total revision of the Swiss Data Protection Law

Rosenthal, Der Vorentwurf für ein neues Datenschutzgesetz: Was er bedeutet, Jusletter v. 20.2.2017

This is excellent reading material – covers some very interesting aspects of Swiss privacy today (e.g. data subject access rights under current law)

http://datenrecht.ch/rosenthal-der-vorentwurf-fuer-ein-neues-datenschutzgesetz-was-er-bedeutet-jusletter-v-20-2-2017/

Results of the Vernehmlassung and Botschaft of the Bundesrat

https://www.ejpd.admin.ch/ejpd/de/home/aktuell/news/2017/2017-09-150.html

Summary of changes by David Vasella (post- vs. pre-Vernehmlassung Draft)

http://swissblawg.ch/2017/09/entwurf-des-datenschutzgesetzes.html

Posted on

CNIL guide 2018 – “Security of Personal Data”

in English, incl.

  • Raising user awareness
  • Authenticating users
  • Access Management
  • Logging access and managing incidents
  • Securing workstations
  • Securing mobile data processing
  • Protecting the internal network
  • Securing servers
  • Securing websites
  • Ensuring continuity
  • Archiving securely
  • Supervising maintenance and data destruction
  • Managing data processors
  • Securing exchanges with other organisations
  • Physical security
  • Supervising software development
  • Encrypting, guaranteeing integrity and signing
  • Assess the security level of the personal data in your organisation

https://www.cnil.fr/sites/default/files/atoms/files/cnil_guide_securite_personnelle_gb_web.pdf

Posted on

Norwegian DPA files complaint against Grindr mobile app data sharing (HIV status, ..)

https://fil.forbrukerradet.no/wp-content/uploads/2018/04/2018-04-03-complaint-grindr.pdf

Quote:

[..] “Insufficient consent

According to the SINTEF report, Grindr shares personal data with different of third parties.

When a user registers a user account in Grindr, the app asks for consent to the terms of service in whole, without individual elements being emphasized or singled out (see attached picture).

In the view of the Consumer Council, information about sensitive personal  data being shared with third parties should not be hidden away in long terms of service and privacy policies. The Consumer Council cannot see that Grindr fulfill  the conditions for gathering an informed and explicitly given consent.

During the process of registration and inside the app, there is no further description of how data may be shared, other than what is hidden away in the terms of service and privacy policy. There is also no separate consent for sharing sensitive personal data with third parties.

The app does not provide an opportunity to not share personal data with third parties.”

[..]

Posted on

UK: IoT security-by-design report and draft Code of Practice (devices, IoT, mobile apps)

“The report and draft Code of Practice advocates a fundamental shift in approach to moving the burden away from consumers having to secure their devices and instead ensure strong cyber security is built into consumer IoT products by design.

The draft Code of Practice for industry contains 13 practical steps to improve the cyber security of consumer IoT.”

Audience of the draft CoP is Device Manufacturers, IoT Service Providers, and Mobile Application Developers (!)

https://www.enisa.europa.eu/news/member-states/uk-government-published-security-by-design-report