Blog overview

‍After Facebook announced Libra as a new cryptocurrency, many discussions started regarding definition of a blockchain and various regulatory obstacles for cryptocurrencies. This article gives perspective on regulatory definition of blockchain technologies and regulatory challenges when it comes to personal data protection.

"We are 100% compliant”, we sometimes hear - even though describing what this means in theory is a big task, and achieving it in practice is even more difficult. Thinking that you are 100% compliant can be a pitfall, because acting in accordance with the applicable privacy laws and regulations is a continuous process and not a one-off procedure.

In close partnership with the world's largest association of privacy experts, the International Association of Privacy Professionals (IAPP), Privacy Company will offer data protection training and certifications in German and English starting in May 2019.

According to the Dutch Data Protection Authority (DPA), the tracking of people in (semi) public areas via their mobile device - or wifi tracking - is in very few cases allowed under strict conditions (Dutch). The previous blog post addressed the question of what conditions the GDPR imposes on organisations for carrying out WiFi tracking. This blog explains how organisations should take privacy into account when designing tracking techniques, such as WiFi tracking, based on the principle of Privacy by Design.

‍The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) published its first newsletter for Data Protection Officers (DPOs) on the 31st of January. The newsletter briefly discusses a misunderstanding regarding the Data Protection Officer (hereinafter: DPO).

On the 23rd of January, the European Committee determined the adequacy decision with Japan. This means that Japan has an equivalent level of personal data protection as under the General Data Protection Regulation (GDPR). An equivalent data protection level does not mean that it is an equal level of data protection as under the GDPR. The basic principle is that the standards used by the relevant country ensure a sufficient level of protection of personal data.

What is the greatest risk of privacy incidents in the workplace? The human! Lost USB sticks, unauthorized viewing of files, or sending an e-mail incorrectly are part of the daily routine of organisations. Fortunately, privacy awareness is therefore high on the agendas of Privacy Officers and DPOs. Unfortunately, people often mistakenly think too easily about it. Privacy awareness is about realizing behavioral change, and that is a complex challenge. In this blog you will find an explanation of how you can use your privacy awareness to steer initiatives towards behavioural change.

Many of you might still remember the days where the only way of accessing the data of your organisation was through devices supplied by the organisation itself or through fixed workstations in the office. However, today more and more of this data actually resides in a ‘digital cloud’ and is accessed via an employee’s own device. Because it’s easy; shifting from on-premises platforms to cloud-based file-sharing. And in addition to just being easy, this approach offers a lot of benefits. By keeping data in a cloud, and off devices, an organisation limits the potential of a data breach in the scenario a device is lost or stolen. And when good access management is in place, access to data can easily be blocked. Additionally, it gives employees freedom. Freedom to use their devices in the way that they please. The enormous benefits of this kind of freedom would hardly be necessary to explain.

In December 2018, the Dutch Data Protection Authority clarified that counting the number of visitors in (semi) public areas using tracking technologies is only permitted under very strict conditions (in Dutch). As a result of this report, a number of municipalities have temporarily suspended WiFi tracking in the city centre. A tracking company has also announced that it will stop offering WiFi tracking as a service. Early January, a municipality tracking visitors via WiFi picked up this practice again.We explain why the General Data Protection Regulation (GDPR) applies to WiFi tracking, what this has to do with the roles of Controller and Processor, and on which grounds organisations can appeal if they want to use WiFi tracking.

Privacy Nexus is an easy-to-use data protection management software that helps companies make data protection efficient and simple. Our Software-as-a-Service (Saas) is continuously developed and improved by our in-house developers. In January, we unlocked the following features:

‍While the general impression among organisations is that the GDPR has had a slow start since it coming into effect on May 25, 2018, it seems like several European Data Protection Authorities have been having some fines in the making: Tech giant Google was hit this week with a recordsetting fine of 50 million Euros for GDPR violations related to user consent.

The French data protection authority (CNIL) has announced that it has imposed a record fine of € 50 million on Google for violating the GDPR today.

Privacy Company recently celebrated its fourth anniversary. From a rough idea to a company with international presence and more than forty fantastic people. In this blog I will share four of my key learning points.

‍Many Dutch websites have not set up Google Analytics in a privacy-friendly way and therefore violate the law by tracking users without consent. This is evident from a quick inspection that I have done on cookies on 11,309 Dutch websites. This shows that 3,186 websites with Google Analytics have linked these cookies to the Google Doubleclick advertising network. As a result, website visitors can receive targeted advertisements outside of the website. And that is only allowed if the visitors have given separate consent for this.

‍On behalf of the Ministry of Security and Justice, Privacy Company carried out a DPIA on DPIA on Microsoft Office ProPlus (Office 2016 MSI and Office 365 CTR). With permission of the Ministry, we publish this blog about the findings.

The free and open web is a place full of opportuities, but also a place full of real challenges. That is why Tim Berners-Lee launched the campaign “Contract for the Web”

Two-factor authentication, or 2FA as it is commonly abbreviated, is a basic log-in procedure that is based on two factors. Hence the name. One factor can be a username and password.

On the 13th of October, Privacy Company celebrated its four year anniversary

For many businesses and organisations, spreadsheet software is the starting point for privacy management. It’s an application that easily lets you organise, analyse and store data in tabular form, it’s been around since the late 80’s and there are numerous tutorials to help you master it. But while spreadsheet software such as Excel might be a great place to start your privacy management, it does have its limits. So here’s four signs that spreadsheet software might no longer be the right tool for your privacy management.

In Privacy Nexus, you can use the new Incidents & Data Breaches module, specially designed for privacy and security professionals who deal with this in daily practice. With the module, you can easily and quickly meet the strict requirements that are set for the registration of data leaks in an organization.

The GDPR is at the heart of our team's work. This means that we work with it on a daily basis, analyse the texts, understand the obligations and, in particular, translate them into practical tools for our customers. Which article do our colleagues prefer to work with? How do we help our customers to implement the articles? In this blog series our team is talking, each about one specific article. Today, the blog post is discussing the principles of Privacy by Design & Default and the obligation to create a register of processing activities!

The GDPR is at the heart of our team's work. This means that we work with it on a daily basis, analyse the texts, understand the obligations and, in particular, translate them into practical tools for our customers. Which article do our colleagues prefer to work with? How do we help our customers to implement the articles? In this blog series our team is talking, each about one specific article.

In strong partnership with the renowned law firm BDV Legal, Privacy Company Croatia will from now on deliver the practical and qualitive services our customers appreciate so much. From the Zagreb office, we are able to assist clients in the neighbouring countries of Slovenia, Serbia, Montenegro, and Bosnia and Herzegovina, thus bringing broader presence to the region. For Privacy Company, this step marks an important moment in its approach to become a leading European provider of privacy services.

The GDPR is at the heart of our team's work. This means that we work with it on a daily basis, analyse the texts, understand the obligations and, in particular, translate them into practical tools for our customers. Which article do our colleagues prefer to work with? How do we help our customers to implement the articles? In this blog series our team is talking, each about one specific article.

On the 18th of June, Transvision B.V. in Capelle aan den IJssel, Netherlands, received the first Privacy Maturity Certificate by Privacy Company. Independent testing by auditors of Accoris Audit Services B.V. has shown that Transvision handles personal data responsibly. With the quality mark, Transvision can now also make this visible to its customers and suppliers and distinguish itself in the area of privacy.

The General Data Protection Regulation (GDPR) contains a number of new obligations compared to the previous legislation. Since May 25, 2018, organizations have to ensure they comply with these requirements. An important question is: how?

The General Data Protection Regulation describes a number of roles in the data processing process, including the role of Data Protection Officer. The Data Protection Officer is also referred to as the DPO. A DPO is an internal or external supervisor of compliance with the privacy ordinance within an organisation. This blog post addresses the question of when the GDPR really does require a DPO.