PrivacyPod

"Pörssikursseja ei saa manipuloida, mutta ihmisiä saa."

Reijo Aarno. Mies, myytti, leganda. Reijo on varmasti jokaiselle suomalaiselle tietosuojasta kiinnostuneelle tuttu nimi, eikä ihme: 23 vuotta tietosuojavaltuutettuna taitaa olla Euroopan ennätys. Suomessa on tietosuojaihmisiä, jotka ovat syntyneet, valmistuneet ja työskennelleet alalla Reijon uran aikana. Entä miltä tuntuu, että viranomaisen jokaista sanaa analysoidaan loputtomiin jälkikäteen? Onko Reijo Aarnio pakottanut kaikki hyväksymään käteisen valuuttana?

Mutta tässä jaksossa emme vello täysin menneisyydessä (joskin poimimme sieltä oppeja), vaan siirrämme katseen tähän päivään ja tulevaisuuteen.

Yritämme selvitä jaksosta mainitsematta GDPR:ää, mutta arvaatte varmaan miten käy näillä juontajilla. Panu ja Pilvi yrittävät kaikkensa, mutta eivät säästy pullakahvien tarjoamiselta. 

Jakso tarjoaa uskomattoman syvääluotaavan katsauksen eurooppalaisen datatalouden menneisyyteen, nykyisyyteen ja tulevaisuuteen.

Pyörittelemme yhdessä muun muassa seuraavanlaisia kysymyksiä: Mitä on reilu datatalous ja mitä iloa siitä on – miksi sitä pitäisi tavoitella? Miten Eurooppa voi pärjätä kansainvälisillä datatalouden markkinoilla? 

"Sääntelyn paradigma on merkillinen. En ikinä saanut itselleni selväksi sitä, että jos meillä on lainsäätäjä joka haluaa edistää jotain asiaa, niin reaktio on neliraajajarrutus. Ei hyvänen aika", toteaa Reijo jaksossa.

Reguloiko Eurooppa itsensä ulos datatalouden markkinoilta vai voiko regulaatio olla kilpailuetu suhteessa esimerkiksi Yhdysvaltoihin?

Linkit:

YLE: “Ex-tietosuojavaltuutettu Reijo Aarnio jyrähtää vielä kerran: Vastaamon tietomurto on digitaalista väkivaltaa ja verinen vääryys” (1.11.2020)

https://yle.fi/uutiset/3-11615577

Sitra: “Datatalouden uusi suunta – luovuus voimistuu, kun yksityisyyttä suojellaan” (25.10.2021).

https://www.sitra.fi/blogit/datatalouden-uusi-suunta-luovuus-voimistuu-kun-yksityisyytta-suojellaan/

This week we discuss the upcoming privacy cases in the highest court of the EU, and have an amazing guest with us for this purpose, Joost Gerritsen!

Beware listeners, this episode is probably our nerdiest (and longest, since Milla doesnt understand editors hints) one so far, so even more awesome than our usual content – that's also why we made it extra-long.

Joost is an AI, robotics, and data protection lawyer. He is based in the Netherlands where he runs his own law firm Legal Beetle, and has a long history working with data protection issues.

What are the recurring themes in CJEU's privacy cases, which countries are the usual suspects when it comes to referring questions to the Court, and how long does it take for the Court to decide on matters? And what do we talk about when we talk about professional FOMO ie. Pro-FOMO?

We also do a speed-recap of the latest news in privacy sphere.

Italian DPA fines Clearview AI 20 MEUR https://techcrunch.com/2022/03/09/clearview-italy-gdpr/

Danish DPA: Guidance on the use of cloud https://www.datatilsynet.dk/Media/637824108733754794/Guidance%20on%20the%20use%20of%20cloud.pdf

Database of pending CJEU cases by Joost https://gdprbeetle.eu/which-cjeu-data-protection-cases-are-currently-pending/

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

This week's guest star is Karolina Iwańska, who works as a lawyer and researcher at Panoptykon Foundation, a Polish NGO fighting for freedom and privacy in the digital age. Panoptykon was one of the organizations bringing the IAB TCF case to the Belgian data protection authority, and we had the pleasure of hearing Karolina's insights on litigating the case, and her views on how this will affect the future of online advertising and privacy.

We also do a speed-recap of the latest news in privacy sphere.

EDPB launches coordinated enforcement on use of cloud by public sector https://edpb.europa.eu/news/news/2022/launch-coordinated-enforcement-use-cloud-public-sector_en

Grindr appeals the over 6 MEUR fine in Norway https://www.axios.com/grindr-appeal-norwegian-fine-privacy-bf20ff80-6117-4806-8550-10766590c0e0.html

Further decisions and reactions on Google Analytics https://www.cnil.fr/sites/default/files/atoms/files/med_google_analytics_anonymisee.pdf https://tietosuoja.fi/-/euroopan-tietosuojaviranomaiset-ovat-todenneet-google-analyticsin-kayton-verkkosivuilla-tietosuojalainsaadannon-vastaiseksi https://iapp.org/news/a/norwegian-dpa-recommends-google-analytics-alternatives/

Local DPAs react to IAB TCF decision, EPIC and ICCL demand deletion of TCF data https://www.jdsupra.com/legalnews/dutch-dpa-takes-position-on-online-5194892/ https://epic.org/epic-and-iccl-issue-deletion-demands-in-wake-of-tcf-decision/

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

This week we discuss the broader implications of online tracking with Arnold Roosendaal, who works as a director at Privacy Company in the Netherlands.

Roosendaal showed the world in 2011 how Facebook Like button is used across the internet to track also non-Facebook users. Since then he has done extensive work in highlighting the societal effects of online tracking, and how it impacts our individuality.

Example of Privacy Company's DPIA work

https://slmmicrosoftrijk.nl/downloads-dpias/

Arnold Roosendaal's articles on SSRN

https://papers.ssrn.com/sol3/cf_dev/AbsByAuth.cfm?per_id=1546115

The information trap: Arnold Roosendaal at TEDxTilburgUniversity

https://www.youtube.com/watch?v=xNQ9FG8oCCs

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

We hope everyone had relaxing holidays, because the year has not started slow in the world of privacy!

In this week's episode we talk about all the development around Google Analytics and the GDPR – the Austrian DPA being the first national data protection authority to indicate that the use of the tool breaches the GDPR and the Schrems II judgment.

In other news we look at the European Data Protection Supervisor's decision against Europol and a legal study commissioned by the EDPS and the EDPB on government access in India, China and Russia (spoiler: the study has a rather negative outcome).

EDPS orders Europol to erase data https://edps.europa.eu/system/files/2022-01/22-01-10-edps-decision-europol_en.pdf

Legal study on government access in India, China and Russia https://edpb.europa.eu/system/files/2022-01/legalstudy_on_government_access_0.pdf

Austrian DPA's decision on Google Analyticshttps://gdprhub.eu/index.php?title=DSB_(Austria)_-_2021-0.586.257_(D155.027)#English_Summary

Google's response on privacy and Google Analytics https://blog.google/around-the-globe/google-europe/google-analytics-facts/

EDPS reprimand towards European Parliament – on use of cookies, data transfers https://noyb.eu/en/edps-sanctions-parliament-over-eu-us-data-transfers-google-and-stripe

Dutch DPA giving first warning on Google Analytics https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-kan-ik-bij-google-analytics-de-privacy-van-mijn-websitebezoekers-beschermen-4898

CNIL's guidance for data processors' further use of data https://www.cnil.fr/fr/sous-traitants-la-reutilisation-de-donnees-confiees-par-un-responsable-de-traitement

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

New episode out! This week we discuss the much awaited decision from the Dutch data protection authority on the lawfulness of the IAB Transparency and Consent Framework – or at least the bits of the draft decision that have reached us so far.

Does the DPA's interpretation that IAB would be acting as a joint controller make any sense? Does following the TCF rules result in a lawful consent? And what's the timeline for getting the decision finalized? In other news, we discuss the impact Apple's privacy changes have had on ad income, and give an update on how the enforcement of the Chinese privacy law PIPL has started off.

IAB TCF draft decision coming soon https://techcrunch.com/2021/11/05/iab-europe-tcf-gdpr-breach-belgium/?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAACSEuDSf8McqwOifIOAe3-Wc2bl9ZjUZCRcD8EuF5SZhW4U45HRlieV-DCcb-I23wBkOYWsWEPZGtPRDhdek4W1NM9376VeWRBq6N1ZoWaVt3vXxFOrwmf0f5Ab0lPMQdpQ9YaGRgmrMRtMCMjirE4xoyrlPYinAhTn0mZdg5Kym

Effects of iOS updates showing in ad income https://www.ft.com/content/4c19e387-ee1a-41d8-8dd2-bc6c302ee58e

China PIPL update https://www.reuters.com/world/asia-pacific/china-ministry-orders-38-apps-rectify-excessive-collection-personal-data-2021-11-03/

Facebook shutting down its Facial Recognition System https://www.nytimes.com/2021/11/02/technology/facebook-facial-recognition.html

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

Ransomware is an ever growing issue in the world of cyber security and privacy. More and more organisations face severe repercussions on malicious attacks by different professional groups.

In this episode we take a bit of a side step and discuss ransomware attacks with an absolute legend, Quentyn Taylor, Head of Information Security at Canon EMEA.

Quentyn accounts how ransomware has developed into a multilayer "industry" of its own kind, with several layers of actors specializing in different parts. One player gets in, the otherone takes the data and third one might use it. In plain terms, Quentyn just explains it much more interestingly.

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

You can sigh in relief, the past week was slower on privacy news front and we did our best to keep it short!

We continue the discussion on Facebook View glasses as the news came last week from both the Italian as well as the Irish data protection authorities that they are looking into privacy issues related to the glasses. We marvel at AWS delivering early the updates required by the new Standard Contractual Clauses in their data processing agreement (kind reminder to fellow privacy experts: September 27 is the deadline for having the new SCCs ready for use with new contracts, and updates to old contracts should be covered by December 27, 2022). And lastly, we are happy to have Heikki rant a bit about cookies.

Italian and Irish authorities looking into Facebook view (glasses) https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-statement-concerning-facebook-view-glasses

AWS customer terms updated with new SCCs

https://aws.amazon.com/blogs/security/new-standard-contractual-clauses-now-part-of-the-aws-gdpr-data-processing-addendum-for-customers/

German consumer advocates investigate cookies https://marketresearchtelecast.com/consumer-advocates-warn-companies-about-cookie-banners/158935/

Whatsapp challenges DPC fine https://www.irishtimes.com/business/technology/whatsapp-challenges-dpc-s-225-million-fine-1.4675957

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

This week we discuss at length Facebook launching "Ray-Ban Stories" – cool-looking sunglasses, but just slightly on the creepy side when it comes to privacy. It was also reported last week that Facebook is able to read your Whatsapp messages, but at closer scrutiny the story isn't as straight-forward as that. And lastly, in the light of the messages coming from the UK on updating their privacy rules, we would like to ask: privacy colleagues in the UK, are you OK?

Facebook launching "Ray-Ban Stories" https://about.fb.com/news/2021/09/introducing-ray-ban-stories-smart-glasses/

Facebook reads your Whatsapp messages – or does it? https://www-businessinsider-com.cdn.ampproject.org/c/s/www.businessinsider.com/facebook-reads-whatsapp-messages-encryption-2021-9?amp

Class action against TikTok in the Netherlands https://siliconcanals.com/news/tiktok-in-a-6b-class-action-lawsuit/

UK's New Direction for Data Protection https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1016395/Data_Reform_Consultation_Document__Accessible_.pdf

ICO calls on G7 countries to reform cookie rules https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/09/ico-to-call-on-g7-countries-to-tackle-cookie-pop-ups-challenge/

CNIL sanction for retention times https://edpb.europa.eu/news/national-news/2021/french-dpa-175-million-penalty-against-ag2r-la-mondiale_de

Germany's sovereign cloud https://fortune.com/2021/09/08/germany-sovereign-cloud-google-t-systems/

Critique – once again – on the Irish DPA https://www.iccl.ie/digital-data/2021-gdpr-report/

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]

In this week's episode we discuss a much awaited decision – Irish Data Protection Commissioner's first fine against big tech. In an attempt to at least scrape the surface, we cover what the decision against Whatsapp was all about, and what is to be expected going forward. In other news we are tentatively positive about Cloudflare's updates in their global data processing practices and big fans of Norwegian DPA's clear guidelines on international data transfers. In the weird and wonderful section we discuss the Hush app available for iOS – but do we end up using it or not?

And hey, to all boomers out there: we're now on LinkedIn! (But not yet on TikTok, that will still take some time.)

Whatsapp decision from Ireland https://edpb.europa.eu/system/files/2021-09/dpc_final_decision_redacted_for_issue_to_edpb_01-09-21_en.pdf

Age control on Instagram https://about.fb.com/news/2021/08/asking-people-for-their-birthday-on-instagram/

Cloudflare updates to data processing https://blog.cloudflare.com/oblivious-dns/

Norwegian DPA's data transfer guidelines https://www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/overforing-av-personopplysninger-ut-av-eos/

TIA template from IAPP https://iapp.org/resources/article/transfer-impact-assessment-templates/

Weird and wonderful

https://apps.apple.com/us/app/hush-nag-blocker/id1544743900

We'd love to get feedback – so please tag us, follow us, DM us… or send us traditional email:

Twitter: https://twitter.com/PodPrivacy, #privacypod

Instagram: @privacypod

LinkedIn: https://www.linkedin.com/company/tietosuojapod/about/

Email: [email protected]