Tag Archives: data breach notification

Recently Datonomy attended the second of two conferences held by Exeter University addressing the UK's place in the Digital Single Market. The day, hosted at Portcullis House, focused on data protection and privacy policy with viewpoints provided by both practitioners and stakeholders. Of particular relevance to Datonomy readers were the panels' opinions on the ePrivacy Directive review, the GDPR, and the new Investigatory Powers Act (recently explored by Datonomy here). Draft ePrivacy Regulation on the horizon Perhaps the headline news from the day was the strong support for the review of the ePrivacy Directive to result in the implementation of a new ePrivacy Regulation (therefore directly effective). It was argued the Regulation should extend the scope of the current ePrivacy Directive to cover new tech including, for example, OTT Providers, publically used private networks and the Internet of Things. According to the European Commission the draft proposal … Continue Reading ››
Security breaches always get a lot of press attention but to date there haven't been that many large fines imposed by the Information Commissioner's Office (the "ICO") in the UK. However, last week saw a big one (although some have questioned whether it is big enough) with TalkTalk being given a record GBP400,000 penalty due to a violation of the DPA's seventh principle on security. This comes on the back of the GBP1,000 fine a couple of weeks ago in respect of TalkTalk's failure to give notice to the regulator in due time, which we reported on: http://datonomy.eu/2016/09/13/ico-wins-tiny-penalty-but-significant-principle-in-talktalk-security-breach-saga/ This case relates to cyber-attacks perpetrated against TalkTalk between 15 and 21 October 2015 exploiting vulnerabilities in certain webpages. Personal data of 156,959 customers including financial information was impacted with the attacker accessing the personal data of all of the customers along with bank account numbers and sort code of 15,656. When imposing … Continue Reading ››
As Datonomy readers will be aware, political agreement was reached on the new General Data Protection Regulation last month.  While we await formal ratification and a final text, Datonomy invites its readers to join a  webinar next week to take a first look at the key practical implications of the new rules. The webinar is being hosted by Datonomy's friends at US law firm Fenwick & West.  Robert Brownstone, Privacy co-chair and Electronic Information Management Chair of Fenwick & West LLP and Ross McKean, Head of Data Protection at Olswang LLP, will lead a discussion considering:
  • The timeline for implementation
  • When and where will GDPR apply, and which regulator(s) will be able to enforce it?
  • New rules for service providers
  • An overview of enhanced data subject rights
  • Data breach notification – the new rules and lessons learned from US experience
The registration link is here.  The 60 minute webinar will start at 5pm GMT, - … Continue Reading ››
On August 19, 2014, more than one year after the first draft bill of an IT Security Act, the German Federal Ministry of the Interior has published the new draft bill of the Act, aimed at boosting the security of information technology systems. The full title of the legislation is “Entwurf eines Gesetzes zur Erhöhung der Sicherheit informationstechnischer Systeme" (IT Sicherheitsgesetz) (“IT Security Act”). The new rules are still subject to change but look likely to come into force in early 2015. General overview In fact, the IT Security Act will not be an individual law, but will amend the Act on the Federal Office for Information Security, the Telecommunication Act, the Telemedia Act and the Act on the Federal Criminal Police Office as well as the Act on the German Federal Office of Information Security. The IT Security Act contains five central topics and provides for: