The [InfoSec] Stack

This summer, Karlskrona municipality (Sweden), moved its email management to Microsoft 365. The rescue services in Karlskrona did not learn about the change until four months later, which is not entirely unproblematic.

You see, the rescue service is part of Sweden's total defense, and in view of the fact that we have both a naval base and an air flotilla in Blekinge, this change entails a security risk. A risk that the rescue services in Karlskrona did not even have the opportunity to assess. The incident has now been reported to the Swedish Data Inspectorate as a personal data incident.

https://www.blt.se/karlskrona/raddningstjansten-befarar-att-personuppgifter-kommit-i-fel-hander-anmaler-handelsen-b4449b80 (article in swedish)

https://www.esamverka.se/download/18.1d126bc174ad1e6c39cac3/1542007824143/eSam%20-%20R%C3%A4ttsligt%20uttalande%20om%20r%C3%B6jande%20och%20molntj%C3%A4nster.pdf (in swedish)

As we are nearing the end of the year, we thought we'd switch things up a bit. In a bonus series in 7 parts, we will talk about The Seven Elements of Trust.

https://daretolead.brenebrown.com

With the GDPR and the legal situation we have regarding data protection within the EU, we often talk about how difficult, if not impossible, it is to use some of the world's largest cloud services. The recent dilemma of the invalidation of the important, legal, mechanism - Privacy Shield - makes it all the more difficult.

But what if one refuses to believe that there are any good alternatives? What if one firmly believes that the digital transformation can not be carried out with any other provider?

Well, then one should probably, first and foremost, realise how much one is depending on one single supplier and think about how healthy that might be. First and far most from a business continuity perspective but also when it comes to ones' data subjects' personal integrity.

But let's not be so negative all the time. We have really given this some thought and here are some tips for European companies who wants to, or just needs to, keep using Microsoft 365.

Today, we highlight one of the first, really big, cases of class action lawsuits brought against Oracle and Salesforce with the support of the GDPR. We're talking about ridiculous amounts of money and it will of course be extremely exciting to follow the development in both cases.

https://citynetwork.eu/podcast

We recently read a Swedish debate article written by the President of a Swedish interest group for IT and telecom companies, and feel the need to put our foot down on what exactly inhibits the digital transformation in our public sector. Spoiler: Contrary to what the article is trying to portray, it is not our laws and regulations - which in turn prevents from using American hyper scalers, that is the culprit. 

https://citynetwork.eu/podcast

https://computersweden.idg.se/2.2683/1.741729/osakerheten-pa-molnmarknaden-kostar-skattebetalarna-miljarder

https://www.youtube.com/watch?v=mWVYBqZK-Tk

https://www.youtube.com/watch?v=Go2MF0-3lCI

Today we're talking about the case of the Finnish psychotherapy company Vastaamo who got hacked. When the scandal was made public a few days ago, it also emerged that individual patients have been blackmailed and that patient records are now being spread on the darknet. We also discuss a question that we received from one of our listeneres, about the right to review sub-contractors.

"But does it ever happen in real life or is it just something that lawyers in their ivory towers think is going to happen?"

https://yle.fi/uutiset/osasto/news/vastaamo_board_fires_ceo_says_he_kept_data_breach_secret_for_year_and_a_half/11614603

Today we're discussing a recent case in which the clothing retail company H&M has been fined €35 million for violations against GDPR in Germany. We also discuss risk assessments and why it's necessary to start looking beyond GDPR and towards other laws and ethics that puts personal integrity at risk.

https://www.bbc.com/news/technology-54418936

The deadline for the Brexit transition period is currently December 31, 2020. With current news evolving around the pandemic and other large events, it is easy to forget what's about to happen. In this episode we want to remind you all that Brexit is well underway and what it will mean for data transfers to the UK, with the current legislation in the EU and the UK.

https://ukhumanrightsblog.com/2020/10/10/schrems-2-for-the-uk-cjeu-ruling-threatens-future-adequacy-talks/

https://www.infosecurity-magazine.com/news/postbrexit-digital-economy-risk-eu/

https://www.ucl.ac.uk/european-institute/news/2020/jun/eu-us-privacy-shield-brexit-and-future-transatlantic-data-flows

https://www.datainspektionen.se/other-lang/in-english/the-general-data-protection-regulation-gdpr/transfer-of-data-to-a-third-country/

Today we're discussing the value of investing in your coworkers' identity. As usual, this is of course tied to information security and you will learn how. 

We also have a cliffhanger bout Brexit and a statement by the EU about data transfers to the UK.

https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-10/cp200123en.pdf

Today we're talking about data transfers to a third country with a focus on the U.S. due to the fall of Privacy Shield.

The Swedish Data Protection Agency has produced an excellent guide on the matter and today we're covering it thoroughly.

With the fall of Privacy Shield, everything regarding global digitalisation has turned upside down. Are we allowed to transfer, process and make data available to the U.S. Which legal mechanisms can you use to do so? What are Standard Contractual Clauses? We will of course not cover all of this in one go but rest assured that we'll come back to this subject in future episodes.

"The Old Directive" as mentioned by Kim

Transfer of data to a third country