Blog overview

New DPIA for SURF and Dutch government on Zoom: all high risks solved

New DPIA for the Dutch government and universities on Microsoft Teams, OneDrive and SharePoint Online

Since the arrival ofthe General Data Protection Regulation (GDPR), organisations have put theregister of processings in order, written procedures and checklists, ensured transparent information for those involved and made an effort to raiseawareness of the major issue of 'privacy' among employees. And now?

Upcoming IAPP training sessions will be on 1 & 2 November (CIPP/E) and 3 & 4 November (CIPM). This session will be tough by Anouk and Erwin in English in the Mindspace Krausenstraße. We have planned a nice surprise in order to welcome back the training participants. Privacy Company is looking forward to training days

Google has agreed to major privacy improvements for its Google Workspace for Education services for schools and universities in the Netherlands. After intense negotiations with representatives of the schools and higher education institutions in the Netherlands, Google has agreed to mitigate the high data protection resulting from the use of Google Workspace for Education. These risks were identified in a DPIA conducted by Privacy Company for two universities.

Almost half of the political parties in the Netherlands used tracking cookies on their own websites, which they used to target potential voters elsewhere on the Internet (microtargeting). With such tracking cookies, the parties usually process special personal data. This is only permitted with the explicit consent of those involved. But this is not the case, research by Privacy Company shows.

When publishing the new Standard Contractual Clauses the European Commission (hereafter: Commission) did something remarkable. The Standard Contractual Clauses (SCCs) are meant to enable the transfer of personal data from the European Union (EU), Norway, Iceland, and Liechtenstein (European Economic Area, EEA), to a country outside the EEA that does not guarantee an adequate level of protection to the data. By agreeing on additional safeguards, the exporter and importer can still process the data safely in the recipient country. The Commission has now unexpectedly changed the definition of international transfers. It is no longer the case that every transfer of personal data to a system outside the EU/EEA is qualified as an international transfer. Rather, a transfer only qualifies as an international transfer if the personal data will no longer be directly protected by the GDPR in the recipient (third) country. The Commission states that organisations may only use the SCCs if the GDPR does not already apply to the importer in the third country anyway.

The CISPE Code of Conduct (for cloud infrastructure providers) and the EU Cloud Code (for all types of cloud providers) could, in theory, provide an enormous privacy boost. But unfortunately, the agreed rules are of little consequence. The Cloud Code does not offer a solution for the major privacy risks for European customers of(mainly) US American cloud providers, when it comes to purpose limitation,transparency, legal ground and data minimisation.

Commissioned by the Ministry of Justice and Security, Privacy Company investigated the privacy risks of G Suite Enterprise, with work and communication apps such as Gmail, Chat, Meet, Forms, Docs and Slides. Meanwhile, Google has renamed these services into Google Workspace.

Mid February 2021 Brussels took a step forward in the process to modernise the existing rules on cookies, spam and the confidentiality of digital communications. After more than 2.5 years of haggling, the representatives of the EU Member States have reached a compromise on the new ePrivacy Regulation. But this does not yet mean that there is a new law in Europe.

Due to the Brexit, companies cannot make use of their UK office as their European point of contact for privacy affairs anymore. In absence of another base inside the EEA, those companies are required to designate a GDPR Representative from December 31, 2020 onwards.

On 16 July 2020, the European Court of Justice declared the Privacy Shield invalid. The protection of rights and freedoms of European citizens is therefore not sufficiently guaranteed. The Standard Contract Provisions (SCC) for the transfer of personal data to third countries remain valid.

On behalf of the Ministry of Justice and Security, Privacy Company has analysed the data protection risks of the use of Microsoft's corporate Intune service. We identified five low data protection risks. With the Ministry's permission we are publishing the findings about Intune in this blog.

On behalf of the Ministry of Justice and Security, Privacy Company conducted a repeat assessment of the privacy risks of the browser version of Microsoft Office 365, and the Office apps for iOS and android mobile phones. We identified six high, and three low data protection risks. With the Ministry's permission we are publishing the findings of the DPIA in this blog.

Functioning as a local contact point, the Representative facilitates smooth communication between the organisation, supervisory authorities and data subjects. However, in case of a data breach, who should exactly report the breach and who should communicate with data subjects still seems to be open for interpretation.

Privacy Company has sent an open letter to European Commissioner Didier Reynders with ten proposals to make compliance with the GDPR easier. Some of these suggestions correspond to the proposals of the joint German data protection authorities and the Dutch government. The GDPR works well, but we see opportunities to improve the effectiveness of supervision and to strengthen support for compliance with the privacy rules. This blog is also available in Dutch.

The Dutch Ministry of Justice and Security has issued a European tender for the performance of Data Protection Impact Assessments (DPIAs) on software and cloud services. We are proud to announce that the tender has been awarded to Privacy Company!

Microsoft will improve its privacy terms worldwide. From the beginning of next year, improved privacy terms will apply, which according to Microsoft are based, among other things, on the conditions that the Dutch government negotiated for its employees this spring.

‍Every German organisation offering its services online must display an imprint on their website. This applies if the website pursues a commercial interest, e.g. operates an online shop, but also if services or journalistic content are offered via the website. This is even the case if the website solely places advertisement – as a result, even a private blog with advertising banners on the site must have an imprint. This is because customers who buy goods or services over the internet should have the possibility of being able to turn directly to the right contact person in case of an issue.

‍As the volume and complexity of data processings is becoming ever more challenging in today’s data-driven world, privacy management software offers the ideal solution. Because by automating privacy management activities, you should be able to mitigate risk, build accountability, and aim ongoing compliance. It's development, however, doesn't stand still. And, as it increasingly makes the lives of privacy professionals easier, many seem to wonder: 'what else does it hold in store for me?'

With the possibility of a hard Brexit, it is now high time to take measures to ensure that your data remain protected when they are processed or stored in the UK. This blog describes five ways to continue to comply with the GDPR.

In the first half of 2018, the second Payment Service Directive came into force (PSD2), and few months later the General Data Protection Regulation became applicable (the GDPR) Within this article the relationship between PSD2 and the GDPR is discussed, as well as the way in which fintech business activity affects processing of personal data of users of payment services.

Over one hundred representatives of public institutions all over Europe gathered in The Hague on 29 August 2019 for the first EU Software and Cloud Suppliers Customer Council meeting. They discussed plans for keeping control over the digital infrastructures provided by hyperscale cloud suppliers like Amazon, Google and Microsoft. The council’s aim is to collectively create standard terms and conditions that hyperscale providers must accept in collaborative procurements of cloud and software services.

Article 28(8) of the General Data Protection Regulation (GDPR) sets the option for national supervisory authority to issue the standard contractual clauses for the matters regarding data processing agreements between data controllers and data processors. In the event a supervisory authority decides to undertake such a task, it is required to compile a draft of the decision on the adoption of standard contractual clauses, and thereupon notify the European Data Protection Board (EDPB) on the fact. Subsequently, the EDPB provides its opinion on the matter. The purpose of this opinion is to contribute to a harmonised approach regarding cross border processing or processing that might affect the free flow of personal data and the consistent application of the GDPR.

‍If you take a look at the 10 steps that the Dutch Data Protection Authority has drawn up to help organisations prepare for the GDPR, creating awareness is the number one step. This is understandable, because it is crucial to create awareness among employees if you, as an organisation, want to get a grip on the subject – and not only what this subject encompasses, but also what it means for your organisation. In this blog post, I will explain how you can tackle such an “awareness campaign”!

‍On behalf of the Dutch Ministry of Justice and Security, Privacy Company has investigated the privacy risks related to the use of Microsoft Windows 10 Enterprise, Office 365 ProPlus and Office Online, as well as the mobile Office apps. With the Ministry’s permission, we are publishing two blog posts about our findings: this log blog post as well as a short blog post. For questions about the research, please contact SLM Rijk (Strategisch Leveranciersmanagement Microsoft Rijk), which can be contacted via the Ministry of Justice’s press spokesperson, +31 (0)70 370 73 45.

‍On behalf of the Dutch Ministry of Justice and Security, Privacy Company has investigated the privacy risks related to the use of Microsoft Windows 10 Enterprise, Office 365 ProPlus and Office Online, as well as the mobile Office apps. With the Ministry’s permission, we are publishing two blog posts about our findings: this short blog post as well as a long blog post. For questions about the research, please contact SLM Rijk (Strategisch Leveranciersmanagement Microsoft Rijk), which can be contacted via the Ministry of Justice’s press spokesperson, +31 (0)70 370 73 45.