Category: News

Posted on

Cookie guidance per country (fall 2019)

Spain (AEPD): https://aepd.es/media/guias/guia-cookies.pdf, in English https://www.aepd.es/media/guias/guia-cookies-en.pdf

France (CNIL): https://legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038783337&categorieLien=id

Ireland: https://dataprotection.ie/en/guidance-landing/cookies

Germany (DSK): https://datenschutzkonferenz-online.de/media/oh/20190405_oh_tmg.pdf

UK (ICO): https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies

Posted on

Seth

Seth is a tool written in Python and Bash to MitM RDP connections by attempting to downgrade the connection in order to extract clear text credentials. It was developed to raise awareness and educate about the importance of properly configured RDP connections in the context of pentests, workshops or talks. The author is Adrian Vollmer (SySS GmbH).

https://github.com/SySS-Research/Seth<7a>

Posted on

Germany: Results of a cross-industry audit of 50 companies

State Data Protection Commissioner of Lower Saxony has now submitted its final report for the result of a cross-industry GDPR-audit of 50 companies.

Find below the press release with

  • questionnaire
  • *criteria for evaluating the responses*
  • final report

*Only in German”.. As expected quite a few didn’t get their legitimate interest assessments right, etc..

https://lfd.niedersachsen.de/startseite/allgemein/presseinformationen/abschluss-der-querschnittsprufung-182253.html

Posted on

EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects

includes
“[..]
49. The EDPB does not consider that Article 6(1)(b) would generally be an appropriate lawful basis for processing for the purposes of improving a service or developing new functions within an existing service. In most cases, a user enters into a contract to avail of an existing service. While the possibility of improvements and modifications to a service may routinely be included in contractual terms, such processing usually cannot be regarded as being objectively necessary for the performance of the contract with the user. ”

Also the EDPB again gives special attention to personalisation, saying that where personalisation is not really necessary for the performance of a contract, eg where content personalisation is just used to increase user engagement, data controllers should consider another legal basis

https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf