{"id":1022,"date":"2019-05-14T08:35:40","date_gmt":"2019-05-14T06:35:40","guid":{"rendered":"https:\/\/lam.unisg.ch\/blog\/?p=1022"},"modified":"2019-05-21T09:33:56","modified_gmt":"2019-05-21T07:33:56","slug":"latest-gdpr-enforcements-in-the-eu","status":"publish","type":"post","link":"https:\/\/lam.unisg.ch\/blog\/en\/latest-gdpr-enforcements-in-the-eu","title":{"rendered":"Latest GDPR Enforcements in the EU"},"content":{"rendered":"<p>The Polish Data Protection Authority (UODO) has<a href=\"https:\/\/uodo.gov.pl\/decyzje\/ZSPR.421.3.2018\"> fined<\/a> the digital marketing company Bisnode EUR 220,000 for not informing 6 million people about its data-scratching activities.\u00a0 The UODO said that Bisnode is obliged to inform the data subjects that they have obtained their publicly accessible personal data from public sources, in accordance with Article 14 of the EU DSVGO, when the personal data were not collected from the data subjects directly.<\/p>\n<p>UODO believes that Bisnode has failed to fulfill its obligation to inform individuals of the fact that it processes their data. According to Bisnode, the cost of providing such information was so high that it could be considered an excessive burden, exempting them from the obligation. The cost of sending so many letters amounted to EUR 8 million in registered mail.<\/p>\n<p>UODO noticed that Bisnode had been informed only a certain part of the data subjects and that 13 % of them objected to the data processing. &#8220;This shows how important it is to fulfill the information obligations properly in order to exercise the privacy rights to which we are entitled under the EU GDPR,&#8221; wrote UODO.<\/p>\n<p>Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the GDPR and local privacy regulations. But how to inform them? There are several best practice to inform the individuals as below:<\/p>\n<ul>\n<li>Privacy Policy on websites \u2013 Cookies Statement<\/li>\n<li>Privacy Policies in different Landing Pages, social media and other lead generation channels<\/li>\n<li>Letter and on time Privacy Notices<\/li>\n<\/ul>\n<p>Data Controller must provide individuals with information including the <strong>kind<\/strong> of personal data you collect from them, your <strong>purposes<\/strong> for processing their personal data, the <strong>retention periods<\/strong>, <strong>who<\/strong> it will be shared with and which <strong>rights<\/strong> the individual has with regards to the processing. The Privacy Notice must be provided to individuals at the time you collect their personal data from them. If you obtain personal data from other sources, inform the individual about the collection at the latest within one month. The Privacy Notice you provide to individuals must be <strong>concise, transparent, intelligible, easily accessible<\/strong>, and it must use <strong>clear and plain language<\/strong>.<\/p>\n<p><strong>The Danish Data Protection Authority, Datatilsynet <\/strong><a href=\"https:\/\/www.datatilsynet.dk\/tilsyn-og-afgoerelser\/afgoerelser\/2019\/mar\/tilsyn-med-taxa-4x35s-behandling-af-personoplysninger\/\"><strong>recommended a fine<\/strong><\/a><strong> for a Taxi company on March 18, 2019. <\/strong><\/p>\n<p>In Denmark, Datatilsynet recommended a fine of almost \u20ac160,200 to the taxi company Taxa 4\u00d735 for failing to delete records of 9 million taxi rides after they were no longer needed. Article 5 of the GDPR prevents companies from keeping data they no longer need.<\/p>\n<p>In the case of Taxa 4\u00d735, the company allegedly tried to comply with Article 5 by anonymising its data after two years. In practice, the company has only removed customer names from its database and kept other data points such as customer numbers and driving histories for five years for business analysis purposes.<\/p>\n<p>Datatilsynet said that was not enough. The data protection authority found that telephone numbers still allow identification of a data subject, which means that Taxa 4\u00d735 did not properly anonymise its records.\u00a0 In addition, Datatilsynet rejected Taxa 4\u00d735&#8217;s statement that its technical systems did not allow the storage of driving history data without an associated telephone number.\u00a0 &#8220;You cannot set a deletion period that is three years longer than necessary just because the company&#8217;s system makes it difficult to comply with the rules of the Data Protection Regulation&#8221; wrote the data protection authority.<\/p>\n<p><strong><em>Data Minimisation: <\/em><\/strong><em>&#8220;Personal data must be adequate, relevant and limited to the extent necessary for the purposes for which they are processed&#8221; <\/em><\/p>\n<p><strong><em>Storage Limitation<\/em><\/strong><em>: &#8220;Kept in a form that does not require the identification of data subjects for longer than for the purposes for which the personal data are processed&#8221;.<\/em><\/p>\n<p>Since the GDPR is less than a year old, even greater enforcement is still lacking. But there are signs that regulators are preparing to take the same firm line on this front.<\/p>\n<p>In the event of violations of the GDPR, the responsible DPA can prescribe certain regulatory measures:<\/p>\n<ul>\n<li><em>Issue warnings or referrals<\/em><\/li>\n<li><em>Temporary or permanent restrictions on data processing<\/em><\/li>\n<li><em>A ban on data processing<\/em><\/li>\n<li><em>fines of up to 4% of the world&#8217;s annual turnover or 20 million euros<\/em><\/li>\n<\/ul>\n<p>These actions by the Danish and Polish authorities are only the latest of a growing number of enforcement actions related to the GDPR in 2019.<\/p>\n<p><em>Picture from <a href=\"https:\/\/pixabay.com\/de\/photos\/europa-bipr-daten-datenschutz-3256079\/\">pixabay<\/a><\/em><\/p>\n<p>&nbsp;<\/p>\n\n            <div id=\"mailerlite-form_1\" data-temp-id=\"6a2d7a4ec26ba\">\n                <div class=\"mailerlite-form\">\n                    <form action=\"\" method=\"post\">\n                                                    <div class=\"mailerlite-form-title\"><h3>Newsletter Signup<\/h3><\/div>\n                                                <div class=\"mailerlite-form-description\"><\/div>\n                        <div class=\"mailerlite-form-inputs\">\n                                                                                            <div class=\"mailerlite-form-field\">\n                                    <label for=\"mailerlite-1-field-email\">Email<\/label>\n                                    <input id=\"mailerlite-1-field-email\"\n                                           type=\"email\" required=\"required\"\n                                           name=\"form_fields[email]\"\n                                           placeholder=\"Email\"\/>\n                                <\/div>\n                                                        <div class=\"mailerlite-form-loader\">Please wait...<\/div>\n                            <div class=\"mailerlite-subscribe-button-container\">\n                                <input class=\"mailerlite-subscribe-submit\" type=\"submit\"\n                                       value=\"Abonnieren\"\/>\n                            <\/div>\n                            <input type=\"hidden\" name=\"form_id\" value=\"1\"\/>\n                            <input type=\"hidden\" name=\"action\" value=\"mailerlite_subscribe_form\"\/>\n                            <input type=\"hidden\" name=\"ml_nonce\" value=\"c979f5ef46\"\/>\n                        <\/div>\n                        <div class=\"mailerlite-form-response\">\n                                                            <h4><p>Thank you for signing up!<\/p>\n<\/h4>\n                                                    <\/div>\n                    <\/form>\n                <\/div>\n            <\/div>\n\n        \n            <script type=\"text\/javascript\">\n                window.addEventListener(\"load\", function () {\n                    var jQuery = window.jQueryWP || window.jQuery;\n\n                    jQuery(document).ready(function () {\n\n                        if(jQuery) {\n                            var form_container = jQuery(\"#mailerlite-form_1[data-temp-id=6a2d7a4ec26ba] form\");\n\n                            jQuery(\".mailerlite-subscribe-submit\", form_container).prop('disabled', true);\n\n                            jQuery.post('https:\/\/lam.unisg.ch\/blog\/wp-admin\/admin-ajax.php', { \"action\" : \"ml_create_nonce\", \"ml_nonce\" : jQuery(\"input[name='ml_nonce']\", form_container).val() }, function (response) {\n\n                                if(response.success) {\n                                    jQuery(\"input[name='ml_nonce']\", form_container).val(response.data.ml_nonce);\n                                    jQuery(\".mailerlite-subscribe-submit\", form_container).prop('disabled', false);\n                                }\n                            });\n\n                            if ( typeof form_container.validate == 'function' ) {\n                                form_container.submit(function (e) {\n                                    e.preventDefault();\n                                }).validate({\n                                    submitHandler: function (form) {\n\n                                        jQuery(this.submitButton).prop('disabled', true);\n\n                                        form_container.find('.mailerlite-subscribe-button-container').fadeOut(function () {\n                                            form_container.find('.mailerlite-form-loader').fadeIn()\n                                        });\n\n                                        var data = jQuery(form).serialize();\n\n                                        jQuery.post('https:\/\/lam.unisg.ch\/blog\/wp-admin\/admin-ajax.php', data, function () {\n                                            form_container.find('.mailerlite-form-inputs').fadeOut(function () {\n                                                form_container.find('.mailerlite-form-response').fadeIn()\n                                            });\n                                        });\n                                    }\n                                });\n                            }\n                        }\n                    });\n                }, false);\n            <\/script>\n        \n","protected":false},"excerpt":{"rendered":"<p>The Polish Data Protection Authority (UODO) has fined the digital marketing company Bisnode EUR 220,000 for not informing 6 million people about its data-scratching activities.\u00a0 The UODO said that Bisnode is obliged to inform the data subjects that they have obtained their publicly accessible personal data from public sources, in accordance with Article 14 of [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1020,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false},"categories":[62,25,28],"tags":[302,357,358,308,128],"acf":{"excerpt":"<p>The data protection authority in Poland imposed its first GDPR fine on March 15, 2019. <\/p>\n","school":{"ID":166,"post_author":"1","post_date":"2017-12-04 17:17:12","post_date_gmt":"2017-12-04 16:17:12","post_content":"The Law &amp; Management department provides world-class executive education at the intersection of law and business management. The programmes are designed for legal professionals interested in acquiring management skills and executives keen to learn about commercial law.","post_title":"Law & Management","post_excerpt":"","post_status":"publish","comment_status":"closed","ping_status":"closed","post_password":"","post_name":"law-management","to_ping":"","pinged":"","post_modified":"2017-12-04 17:17:12","post_modified_gmt":"2017-12-04 16:17:12","post_content_filtered":"","post_parent":0,"guid":"https:\/\/lam.unisg.ch\/blog?post_type=school&#038;p=166","menu_order":3,"post_type":"school","post_mime_type":"","comment_count":"0","filter":"raw"}},"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/posts\/1022"}],"collection":[{"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/comments?post=1022"}],"version-history":[{"count":0,"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/posts\/1022\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/media\/1020"}],"wp:attachment":[{"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/media?parent=1022"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/categories?post=1022"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lam.unisg.ch\/blog\/en\/wp-json\/wp\/v2\/tags?post=1022"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}