How should internet regulation be improved? Committee launches inquiry - News from Parliament - UK Parliament: "The Committee will explore how the regulation of the internet should be improved, and whether specific regulation is required or whether the existing law is adequate. The inquiry also investigates whether the online platforms have sufficient accountability and transparency, and whether they use fair and effective processes to moderate content.
Over the course of the inquiry the Committee will hear evidence on what information online platforms should provide to consumers about the use of their personal data and what responsibility online platforms should have for the content that they host.
The Committee seeks evidence on questions including:
Is there a need to introduce specific regulation for the internet?
What should be the legal liability of online platforms for the content that they host?
How effective, fair and transparent are online platforms in moderating content that they host?
What role should users play in establishing and maintaining online community standards for content and behaviour?
What effect will the United Kingdom leaving the European Union on the Government’s regulation of the internet?" 'via Blog this'
Monday, 16 April 2018
Thursday, 12 April 2018
PRIVACY Congress won’t hurt Zuckerberg and Facebook, but GDPR and Europe could | WIRED UK
Congress won’t hurt Zuckerberg and Facebook, but GDPR and Europe could | WIRED UK: "Under pressure to be seen taking action on data protection, Zuckerberg – who, in 2010, remember, argued that privacy was no longer a “social norm” – announced on April 2 that he would like to extend the GDPR’s protections to all Facebook’s users “in spirit”.
No-one knew exactly what this meant – “We’re still nailing down details on this,” Zuckerberg told Reuters – and the backlash was swift. Op-eds were penned; tweets were fired out; US and European consumer groups made demands in open letters.
A few days later, Zuckerberg issued an apologetic (if still extremely unclear) climbdown.
Somehow, GDPR, bane of IT departments and sales tool of dubious “security consultants”, has turned into a political rallying point. It’s a bit like finding that your office HR policy has become the key text for a revolutionary movement." 'via Blog this'
No-one knew exactly what this meant – “We’re still nailing down details on this,” Zuckerberg told Reuters – and the backlash was swift. Op-eds were penned; tweets were fired out; US and European consumer groups made demands in open letters.
A few days later, Zuckerberg issued an apologetic (if still extremely unclear) climbdown.
Somehow, GDPR, bane of IT departments and sales tool of dubious “security consultants”, has turned into a political rallying point. It’s a bit like finding that your office HR policy has become the key text for a revolutionary movement." 'via Blog this'
Wednesday, 11 April 2018
EU Commissioner Margrethe Vestager: Facebook is designed to create addiction – like tobacco and alcohol
EU Commissioner Margrethe Vestager: Facebook is designed to create addiction – like tobacco and alcohol: "She is a Twitter user herself but says she has never used Facebook, originally because she felt at the time that it was wrong to “look over the shoulders” of her children online.
She also has a strong antipathy to accepting all sorts of conditions to be able to use social media.
“I just don’t tick that box and go somewhere else. I just get so, argh!.. I just can’t accept it. If you read just the first paragraph of Facebook’s terms of conditions, you will find it unreasonable.”
Margrethe Vestager stresses that the new rules require providers of a service to only ask for the information needed to deliver their service." 'via Blog this'
She also has a strong antipathy to accepting all sorts of conditions to be able to use social media.
“I just don’t tick that box and go somewhere else. I just get so, argh!.. I just can’t accept it. If you read just the first paragraph of Facebook’s terms of conditions, you will find it unreasonable.”
Margrethe Vestager stresses that the new rules require providers of a service to only ask for the information needed to deliver their service." 'via Blog this'
Monday, 9 April 2018
Data Enforcement Cyprus | Insights | Linklaters
Data Protected Cyprus | Insights | Linklaters: "In Cyprus, there is no current enforcement practice in relation to the GDPR. However, the enforcement of the current law is instructive.
The Commissioner investigates complaints submitted to her office and also launches her own investigations. Criminal proceedings for contraventions of the current legislation (the “DPA”) have been brought in a limited number of cases and there have been a couple of reported convictions.
The most significant civil sanction imposed by the Commissioner under the DPA to date is a fine of €10,000 imposed in November 2017 on the Cyprus Telecommunications Authority (CYTA), the government-owned telecom operator, for failure to implement appropriate organisational measures (revision of employee access rights on change of position within the organisation) to prevent unauthorised access to and disclosure of personal data of a significant number of CYTA clients to a third party. This matter is still investigated by the police and it is possible that criminal charges may be brought against the employee and/or the third party to whom the data were disclosed.
In an earlier case, a fine of €3,000 and an order to terminate processing and destroy relevant personal data had been imposed on a company that had infringed the proportionality principle under the DPA as more data than necessary was being collected.
A fine of €3,000 has also been imposed in two occasions for failure by the Nicosia General Hospital to take appropriate security measures to protect patient personal data contained in their hospital files from accidental or unintended loss or destruction.
In another case, the Commissioner imposed a fine of €2,562 on a company that had infringed various provisions of the DPA, including by sending advertising text messages without the prior written consent of the data subjects; and failing to notify the Commissioner of the commencement of processing. The same fine of €2,562 was imposed on the Director - General of a government ministry for breach of the DPA provisions on the security of sensitive personal data.
The most significant civil sanction imposed by the Commissioner under the ePrivacy Law (see below) to date was a fine of €8,000 on a person who had repeatedly infringed various provisions of the ePrivacy Law, specifically: (i) the prohibition on the use of electronic mail for direct marketing purposes without the recipient’s prior consent; and (ii) the requirement that the sender’s identity and a valid electronic mail address, to which a request that communications cease may be sent, be included in such electronic mail.
The first criminal proceeding to be reported under the DPA involved the owner of a massage business who had installed a secret video camera without consent of clients and without notification to the Commissioner. The sentence imposed at first instance was three months’ imprisonment, which was reduced to 55 days on appeal.
In a more recent criminal case, a sentence of 16 months’ imprisonment was imposed on an individual for a breach of the prohibition on unauthorised access to, and processing of, personal data. The case involved the unauthorised use of credit card information of other persons for the purpose of illegal money withdrawals.
In another case, the court imposed a criminal fine of €1,200 for the unauthorised dissemination of personal data through social media." 'via Blog this'
The Commissioner investigates complaints submitted to her office and also launches her own investigations. Criminal proceedings for contraventions of the current legislation (the “DPA”) have been brought in a limited number of cases and there have been a couple of reported convictions.
The most significant civil sanction imposed by the Commissioner under the DPA to date is a fine of €10,000 imposed in November 2017 on the Cyprus Telecommunications Authority (CYTA), the government-owned telecom operator, for failure to implement appropriate organisational measures (revision of employee access rights on change of position within the organisation) to prevent unauthorised access to and disclosure of personal data of a significant number of CYTA clients to a third party. This matter is still investigated by the police and it is possible that criminal charges may be brought against the employee and/or the third party to whom the data were disclosed.
In an earlier case, a fine of €3,000 and an order to terminate processing and destroy relevant personal data had been imposed on a company that had infringed the proportionality principle under the DPA as more data than necessary was being collected.
A fine of €3,000 has also been imposed in two occasions for failure by the Nicosia General Hospital to take appropriate security measures to protect patient personal data contained in their hospital files from accidental or unintended loss or destruction.
In another case, the Commissioner imposed a fine of €2,562 on a company that had infringed various provisions of the DPA, including by sending advertising text messages without the prior written consent of the data subjects; and failing to notify the Commissioner of the commencement of processing. The same fine of €2,562 was imposed on the Director - General of a government ministry for breach of the DPA provisions on the security of sensitive personal data.
The most significant civil sanction imposed by the Commissioner under the ePrivacy Law (see below) to date was a fine of €8,000 on a person who had repeatedly infringed various provisions of the ePrivacy Law, specifically: (i) the prohibition on the use of electronic mail for direct marketing purposes without the recipient’s prior consent; and (ii) the requirement that the sender’s identity and a valid electronic mail address, to which a request that communications cease may be sent, be included in such electronic mail.
The first criminal proceeding to be reported under the DPA involved the owner of a massage business who had installed a secret video camera without consent of clients and without notification to the Commissioner. The sentence imposed at first instance was three months’ imprisonment, which was reduced to 55 days on appeal.
In a more recent criminal case, a sentence of 16 months’ imprisonment was imposed on an individual for a breach of the prohibition on unauthorised access to, and processing of, personal data. The case involved the unauthorised use of credit card information of other persons for the purpose of illegal money withdrawals.
In another case, the court imposed a criminal fine of €1,200 for the unauthorised dissemination of personal data through social media." 'via Blog this'
Data Protected Cyprus | Insights | Linklaters
Data Protected Cyprus | Insights | Linklaters: "Are there any special rules when processing personal data about children?
Consent from a child in relation to online services will only be valid if authorised by a parent. A child is someone under 16 years old, though Member States may reduce this age to 13.
It is not yet known whether in Cyprus the age at which a child can provide a valid consent will be reduced below 16." 'via Blog this'
Consent from a child in relation to online services will only be valid if authorised by a parent. A child is someone under 16 years old, though Member States may reduce this age to 13.
It is not yet known whether in Cyprus the age at which a child can provide a valid consent will be reduced below 16." 'via Blog this'
Wednesday, 4 April 2018
Privacy: FTC failed to enforce Facebook consent decree, critics charge amid firestorm - FTCWatch
FTC failed to enforce Facebook consent decree, critics charge amid firestorm - FTCWatch: "consumer advocates are directing much of their ire at the FTC.
“I’m glad people are finally saying that maybe they should enforce their consent orders, but it is a little bit ironic that the people who were there [at the agency] back in the day and could have done something are now the ones saying that the FTC should act,” Marc Rotenberg, president and executive director of the Electronic Privacy Information Center, said in an interview.
“This whole Cambridge Analytica controversy can be laid directly at the doors of the Federal Trade Commission,” Chester said. “Despite the consent decree, Facebook expanded its data gathering practices without constraint every day. I made all of that information available to the FTC. … You know how many e-mails I sent? Hundreds. I said, ‘Here is what they are doing — it is not permitted by the consent decree.’”
Rotenberg also noted that EPIC had “repeatedly told the commission, every time they asked what do we need to do, we answered very simply, ‘enforce your consent orders.’ We said to the FTC that there should be a formal process every time there is a substantial change in business practice that implicates personal data by a company that is subject to a consent order concerning privacy. The FTC has an affirmative obligation to determine whether that change in business practice violates the consent order.”
“We wanted them to create a formal process, and we wanted them to stay on top of these companies. It didn’t happen,” he added. “What most of the world doesn’t understand is that the company was actually subject to a legal order. It wasn’t, ‘maybe we can go ask Mark Zuckerberg to be nicer.’ We knew in Washington what the constraints on the practices were supposed to be, and the FTC simply dropped the ball.”
Other advocates share that anger, as reflected in a letter signed by 17 leading consumer privacy groups last month to FTC acting Chairman Maureen Ohlhausen and Commissioner Terrell McSweeny, charging: “It is unconscionable that the FTC allowed this unprecedented disclosure of Americans’ personal data to occur. The FTC’s failure to act imperils not only privacy but democracy as well.”" 'via Blog this'
“I’m glad people are finally saying that maybe they should enforce their consent orders, but it is a little bit ironic that the people who were there [at the agency] back in the day and could have done something are now the ones saying that the FTC should act,” Marc Rotenberg, president and executive director of the Electronic Privacy Information Center, said in an interview.
“This whole Cambridge Analytica controversy can be laid directly at the doors of the Federal Trade Commission,” Chester said. “Despite the consent decree, Facebook expanded its data gathering practices without constraint every day. I made all of that information available to the FTC. … You know how many e-mails I sent? Hundreds. I said, ‘Here is what they are doing — it is not permitted by the consent decree.’”
Rotenberg also noted that EPIC had “repeatedly told the commission, every time they asked what do we need to do, we answered very simply, ‘enforce your consent orders.’ We said to the FTC that there should be a formal process every time there is a substantial change in business practice that implicates personal data by a company that is subject to a consent order concerning privacy. The FTC has an affirmative obligation to determine whether that change in business practice violates the consent order.”
“We wanted them to create a formal process, and we wanted them to stay on top of these companies. It didn’t happen,” he added. “What most of the world doesn’t understand is that the company was actually subject to a legal order. It wasn’t, ‘maybe we can go ask Mark Zuckerberg to be nicer.’ We knew in Washington what the constraints on the practices were supposed to be, and the FTC simply dropped the ball.”
Other advocates share that anger, as reflected in a letter signed by 17 leading consumer privacy groups last month to FTC acting Chairman Maureen Ohlhausen and Commissioner Terrell McSweeny, charging: “It is unconscionable that the FTC allowed this unprecedented disclosure of Americans’ personal data to occur. The FTC’s failure to act imperils not only privacy but democracy as well.”" 'via Blog this'
Privacy: The Future of Self-Regulation is Co-Regulation by Ira Rubinstein :: SSRN
The Future of Self-Regulation is Co-Regulation by Ira Rubinstein :: SSRN: "Abstract
Modern regulatory theory has long treated voluntary self-regulation and direct government regulation as opposing ends of a regulatory continuum, with most self-regulatory schemes falling somewhere in the middle. This chapter explores the middle ground by examining co-regulatory approaches to privacy, in which industry enjoys considerable flexibility in shaping self-regulatory guidelines, consumer advocacy groups have a seat at the table, and government sets default requirements and retains general oversight authority to approve and enforce these guidelines. Privacy co-regulation is generally understood as a collaborative, flexible, and performance-based approach to privacy regulation that draws on the theoretical insights of collaborative governance theory.
This paper argues that privacy self-regulation in the form of voluntary codes has had a sufficiently long run to prove its worth but has failed. Now is the time to make the transition to co-regulation, especially in the U.S. It is organized into three sections. The first considers in greater detail the differences between self-regulation and co-regulation. The second looks at the failure and stubborn persistence of voluntary codes of conduct. The third shifts the discussion to three case studies of privacy codes and practices that have benefited from a co-regulatory approach. In the past few years, there have been some notable developments in co-regulatory schemes as well some important empirical studies. These new materials provide an opportunity to understand the conditions for the success (and failure) of co-regulatory solutions in the privacy field and what this implies for the future of regulatory innovation. The chapter concludes by offering a few recommendations on how the U.S. Congress can implement co-regulatory approaches in any future legislation to optimally protect online consumer privacy while preserving innovation and economic growth." 'via Blog this'
Modern regulatory theory has long treated voluntary self-regulation and direct government regulation as opposing ends of a regulatory continuum, with most self-regulatory schemes falling somewhere in the middle. This chapter explores the middle ground by examining co-regulatory approaches to privacy, in which industry enjoys considerable flexibility in shaping self-regulatory guidelines, consumer advocacy groups have a seat at the table, and government sets default requirements and retains general oversight authority to approve and enforce these guidelines. Privacy co-regulation is generally understood as a collaborative, flexible, and performance-based approach to privacy regulation that draws on the theoretical insights of collaborative governance theory.
This paper argues that privacy self-regulation in the form of voluntary codes has had a sufficiently long run to prove its worth but has failed. Now is the time to make the transition to co-regulation, especially in the U.S. It is organized into three sections. The first considers in greater detail the differences between self-regulation and co-regulation. The second looks at the failure and stubborn persistence of voluntary codes of conduct. The third shifts the discussion to three case studies of privacy codes and practices that have benefited from a co-regulatory approach. In the past few years, there have been some notable developments in co-regulatory schemes as well some important empirical studies. These new materials provide an opportunity to understand the conditions for the success (and failure) of co-regulatory solutions in the privacy field and what this implies for the future of regulatory innovation. The chapter concludes by offering a few recommendations on how the U.S. Congress can implement co-regulatory approaches in any future legislation to optimally protect online consumer privacy while preserving innovation and economic growth." 'via Blog this'
Subscribe to:
Posts (Atom)