Blog overview

In the first half of 2018, the second Payment Service Directive came into force (PSD2), and few months later the General Data Protection Regulation became applicable (the GDPR) Within this article the relationship between PSD2 and the GDPR is discussed, as well as the way in which fintech business activity affects processing of personal data of users of payment services.

Over one hundred representatives of public institutions all over Europe gathered in The Hague on 29 August 2019 for the first EU Software and Cloud Suppliers Customer Council meeting. They discussed plans for keeping control over the digital infrastructures provided by hyperscale cloud suppliers like Amazon, Google and Microsoft. The council’s aim is to collectively create standard terms and conditions that hyperscale providers must accept in collaborative procurements of cloud and software services.

Article 28(8) of the General Data Protection Regulation (GDPR) sets the option for national supervisory authority to issue the standard contractual clauses for the matters regarding data processing agreements between data controllers and data processors. In the event a supervisory authority decides to undertake such a task, it is required to compile a draft of the decision on the adoption of standard contractual clauses, and thereupon notify the European Data Protection Board (EDPB) on the fact. Subsequently, the EDPB provides its opinion on the matter. The purpose of this opinion is to contribute to a harmonised approach regarding cross border processing or processing that might affect the free flow of personal data and the consistent application of the GDPR.

‍If you take a look at the 10 steps that the Dutch Data Protection Authority has drawn up to help organisations prepare for the GDPR, creating awareness is the number one step. This is understandable, because it is crucial to create awareness among employees if you, as an organisation, want to get a grip on the subject – and not only what this subject encompasses, but also what it means for your organisation. In this blog post, I will explain how you can tackle such an “awareness campaign”!

‍On behalf of the Dutch Ministry of Justice and Security, Privacy Company has investigated the privacy risks related to the use of Microsoft Windows 10 Enterprise, Office 365 ProPlus and Office Online, as well as the mobile Office apps. With the Ministry’s permission, we are publishing two blog posts about our findings: this short blog post as well as a long blog post. For questions about the research, please contact SLM Rijk (Strategisch Leveranciersmanagement Microsoft Rijk), which can be contacted via the Ministry of Justice’s press spokesperson, +31 (0)70 370 73 45.

‍On behalf of the Dutch Ministry of Justice and Security, Privacy Company has investigated the privacy risks related to the use of Microsoft Windows 10 Enterprise, Office 365 ProPlus and Office Online, as well as the mobile Office apps. With the Ministry’s permission, we are publishing two blog posts about our findings: this log blog post as well as a short blog post. For questions about the research, please contact SLM Rijk (Strategisch Leveranciersmanagement Microsoft Rijk), which can be contacted via the Ministry of Justice’s press spokesperson, +31 (0)70 370 73 45.

‍After Facebook announced Libra as a new cryptocurrency, many discussions started regarding definition of a blockchain and various regulatory obstacles for cryptocurrencies. This article gives perspective on regulatory definition of blockchain technologies and regulatory challenges when it comes to personal data protection.

"We are 100% compliant”, we sometimes hear - even though describing what this means in theory is a big task, and achieving it in practice is even more difficult. Thinking that you are 100% compliant can be a pitfall, because acting in accordance with the applicable privacy laws and regulations is a continuous process and not a one-off procedure.

In close partnership with the world's largest association of privacy experts, the International Association of Privacy Professionals (IAPP), Privacy Company will offer data protection training and certifications in German and English starting in May 2019.

According to the Dutch Data Protection Authority (DPA), the tracking of people in (semi) public areas via their mobile device - or wifi tracking - is in very few cases allowed under strict conditions (Dutch). The previous blog post addressed the question of what conditions the GDPR imposes on organisations for carrying out WiFi tracking. This blog explains how organisations should take privacy into account when designing tracking techniques, such as WiFi tracking, based on the principle of Privacy by Design.

‍The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) published its first newsletter for Data Protection Officers (DPOs) on the 31st of January. The newsletter briefly discusses a misunderstanding regarding the Data Protection Officer (hereinafter: DPO).

On the 23rd of January, the European Committee determined the adequacy decision with Japan. This means that Japan has an equivalent level of personal data protection as under the General Data Protection Regulation (GDPR). An equivalent data protection level does not mean that it is an equal level of data protection as under the GDPR. The basic principle is that the standards used by the relevant country ensure a sufficient level of protection of personal data.

What is the greatest risk of privacy incidents in the workplace? The human! Lost USB sticks, unauthorized viewing of files, or sending an e-mail incorrectly are part of the daily routine of organisations. Fortunately, privacy awareness is therefore high on the agendas of Privacy Officers and DPOs. Unfortunately, people often mistakenly think too easily about it. Privacy awareness is about realizing behavioral change, and that is a complex challenge. In this blog you will find an explanation of how you can use your privacy awareness to steer initiatives towards behavioural change.

Many of you might still remember the days where the only way of accessing the data of your organisation was through devices supplied by the organisation itself or through fixed workstations in the office. However, today more and more of this data actually resides in a ‘digital cloud’ and is accessed via an employee’s own device. Because it’s easy; shifting from on-premises platforms to cloud-based file-sharing. And in addition to just being easy, this approach offers a lot of benefits. By keeping data in a cloud, and off devices, an organisation limits the potential of a data breach in the scenario a device is lost or stolen. And when good access management is in place, access to data can easily be blocked. Additionally, it gives employees freedom. Freedom to use their devices in the way that they please. The enormous benefits of this kind of freedom would hardly be necessary to explain.

In December 2018, the Dutch Data Protection Authority clarified that counting the number of visitors in (semi) public areas using tracking technologies is only permitted under very strict conditions (in Dutch). As a result of this report, a number of municipalities have temporarily suspended WiFi tracking in the city centre. A tracking company has also announced that it will stop offering WiFi tracking as a service. Early January, a municipality tracking visitors via WiFi picked up this practice again.We explain why the General Data Protection Regulation (GDPR) applies to WiFi tracking, what this has to do with the roles of Controller and Processor, and on which grounds organisations can appeal if they want to use WiFi tracking.

Privacy Nexus is an easy-to-use data protection management software that helps companies make data protection efficient and simple. Our Software-as-a-Service (Saas) is continuously developed and improved by our in-house developers. In January, we unlocked the following features:

‍While the general impression among organisations is that the GDPR has had a slow start since it coming into effect on May 25, 2018, it seems like several European Data Protection Authorities have been having some fines in the making: Tech giant Google was hit this week with a recordsetting fine of 50 million Euros for GDPR violations related to user consent.

The French data protection authority (CNIL) has announced that it has imposed a record fine of € 50 million on Google for violating the GDPR today.

Privacy Company recently celebrated its fourth anniversary. From a rough idea to a company with international presence and more than forty fantastic people. In this blog I will share four of my key learning points.

‍Many Dutch websites have not set up Google Analytics in a privacy-friendly way and therefore violate the law by tracking users without consent. This is evident from a quick inspection that I have done on cookies on 11,309 Dutch websites. This shows that 3,186 websites with Google Analytics have linked these cookies to the Google Doubleclick advertising network. As a result, website visitors can receive targeted advertisements outside of the website. And that is only allowed if the visitors have given separate consent for this.

‍On behalf of the Ministry of Security and Justice, Privacy Company carried out a DPIA on DPIA on Microsoft Office ProPlus (Office 2016 MSI and Office 365 CTR). With permission of the Ministry, we publish this blog about the findings.

The free and open web is a place full of opportuities, but also a place full of real challenges. That is why Tim Berners-Lee launched the campaign “Contract for the Web”

Two-factor authentication, or 2FA as it is commonly abbreviated, is a basic log-in procedure that is based on two factors. Hence the name. One factor can be a username and password.

On the 13th of October, Privacy Company celebrated its four year anniversary

For many businesses and organisations, spreadsheet software is the starting point for privacy management. It’s an application that easily lets you organise, analyse and store data in tabular form, it’s been around since the late 80’s and there are numerous tutorials to help you master it. But while spreadsheet software such as Excel might be a great place to start your privacy management, it does have its limits. So here’s four signs that spreadsheet software might no longer be the right tool for your privacy management.

In Privacy Nexus, you can use the new Incidents & Data Breaches module, specially designed for privacy and security professionals who deal with this in daily practice. With the module, you can easily and quickly meet the strict requirements that are set for the registration of data leaks in an organization.

The GDPR is at the heart of our team's work. This means that we work with it on a daily basis, analyse the texts, understand the obligations and, in particular, translate them into practical tools for our customers. Which article do our colleagues prefer to work with? How do we help our customers to implement the articles? In this blog series our team is talking, each about one specific article. Today, the blog post is discussing the principles of Privacy by Design & Default and the obligation to create a register of processing activities!