Security (b)log - English edition: GDPR

Showing posts with label GDPR. Show all posts

2026-06-12

Leaky cruise

Image: Unsplash

They had just completed yet another cruise. This time too, they had managed to keep their feet dry, but as it turned out afterwards, there had been a leak after all. A data leak. And just like in the days of the Titanic, everyone acted as if nothing had happened.

They had not received a personal notification that their data had been exposed. They only found out by pure chance. In Europe, our first reaction is often to start waving the GDPR around indignantly: surely they have to tell me if my data has been leaked?! But it is not quite that simple. To begin with, the organisation responsible for the leak must determine for itself whether the incident has to be reported to the Dutch Data Protection Authority (AP). That is not required if “it is unlikely that the personal data breach will result in a risk to the rights and freedoms of data subjects”, as the AP explains. The leaked information did contain personal data (including that of my seafaring colleague), so they would probably not get away with that argument.

The next step is for the leaking party to notify the victims, and here comes the catch: only if the breach is likely to result in a high risk to them. Once again, the organisation must make that assessment itself, of course based on the GDPR rules. If personal data has been stolen by a hacker, the risk is fairly obvious, according to the AP.

And that is exactly the situation we are dealing with here. Last month, Carnival Corporation, the parent company of Carnival Cruise Line, sent letters to customers about a cybersecurity incident (though not to all customers, obviously). A month earlier, an attacker had gained access to Carnival’s IT systems through social engineering and copied customers’ personal data. The information involved includes names, email addresses, dates of birth, gender, and several Carnival-specific data elements.

Carnival Corporation’s headquarters are located in Miami. Aha, I can hear you thinking gloomily, that is well outside the EU, so that wonderful GDPR is of no use to me. Wrong! The GDPR has what lawyers like to call extraterritorial effect: if a company outside the EU also targets the European market, it falls under the GDPR. And when I add everything up, it seems to me that a personal notification to the affected individuals would indeed be appropriate here.

Unless... Yes, unless the data was encrypted, the breach was stopped before anything could be done with the data, or informing all victims would require a disproportionate effort on the part of the company, for example because it no longer has their contact details. In that last case, publishing a notice in a newspaper or on social media is sufficient.

In short: it is not as straightforward as it may seem. We do know how this particular case played out: it didn't. That is why my data-breached colleague asked me what you can do yourself in such a situation. The AP has put together a useful overview (in Dutch). Among other things, it states that you should change any leaked passwords; that is indeed the very first thing you should do. They also recommend changing the passwords for other accounts and apps if they use the same password as the compromised one.

This immediately shows why you should never reuse passwords: after a breach, it creates a lot of extra work. Criminals will simply take the password from website A and try it on websites B through Z. And of course, you should already have enabled multi-factor authentication wherever possible.

After a breach, you should also be extra alert to phishing attempts. Those phishing messages may be far more sophisticated than the run-of-the-mill phishing emails, because the attackers now have much more than just your email address. With all that additional information, they can make their messages look highly personal.

According to the AP, a criminal cannot do much with just a bank account number (IBAN) or a citizen service number (BSN) on its own. But be careful with combinations of data — a copy of your identity document can be a real game changer when it comes to identity fraud.

In summary: stay alert...

And in the big bad world ...

2024-07-12

I see, I see what you don't see

Image from Pixabay

It was a warm Tuesday afternoon in one of those summers that just won't break loose. Then you take what you can get, and so they sat in their Utrecht backyard enjoying that one beautiful day. Suddenly the peace was cruelly disturbed by shouting and banging on the garden gate. They jumped up in alarm.

Through the cracks in the gate they saw bits of a woman with a wild-eyed look. “Let me in, this is my house!” she screamed. Well, they weren't going to do that. Explaining that the woman was really at the wrong house, even in the wrong street, had no effect on this lady, who was clearly under the influence of something. She kept banging on the gate. Well, 'gate' sounds very solid, but in fact it was a construction of windmill wood that hung on inferior hinges, and the rightful owners feared that it would not last very long.

Time to call the police. They arrived quickly, and they soon realized that it was best to take the person with them, because in her current state reasoning with her was impossible. They stuffed her into the back of the car and drove away. The street regained its calm.

The local residents were of course both shocked and curious. Most were not at home at the time, or they were vacuuming, so they didn't hear anything. The neighbors across the street had a security camera. Maybe it recorded something? Bingo! It was all there. When the woman walked up, she even looked straight into the camera. The police action was also beautifully depicted. The video was shared in the neighborhood app group - not for sensation, but because everybody knew that that lady would be walking around freely again in no time, and because the neighborhood would like to be prepared.

If I lived on that street, I would want that information too. You want to protect your family and your property, don't you? As an ordinary citizen, I would not hesitate to share the images with neighbors. But at the same time, from my profession, I wonder: is that actually allowed? What about privacy? People who do something wrong are also entitled to their privacy. The General Data Protection Regulation (GDPR) is European legislation that regulates our privacy. Every country has a GDPR supervisor; in the Netherlands this is the Dutch Data Protection Authority (AP). The AP is the perfect source to look for the answer to my question.

I read there that you may not share images in which people are recognizable without their permission. So do not put it on the internet and do not share it via social media. But there is an exception for personal or household use: “The condition here is that this person keeps the photos and videos private or at most shares them in a very limited circle. For example in a small app group.” That 'small app group' is a bit strange, because any member of that group could further distribute the images.

There's more going on. The GDPR states that you are not allowed to film public roads. Because that would constitute an infringement of the privacy of every passer-by. They understand that sometimes there is no other option than for your camera to film a part of the street. But even then there are rules. The most obvious: zoom in on your property as much as possible, in other words: make the violation of the rules as small as possible. There is actually no need to keep images, but there appear to be no concrete rules for this, because the AP says: “Delete the images as soon as you no longer need them. For example, after 24 hours.” You also have to inform people about your camera and secure the images properly - because if you are hacked, it means a data breach.

There is a double standard in the rule that you are not allowed to film public spaces. Because if something happens on your street, the police would love to have the images from your 'illegal' camera - they can even demand those images, in other words: you are obliged to hand them over. So it's not allowed, but if you do it anyway, it might help in fighting crime.

And in the big bad world...

2022-09-23

The law is the law

Image from Pixabay

“Carprof and AA team use the General Data Protection Regulation (GDPR),” the garage's letter read. I burst out laughing when I read this. "Use".

They probably didn't mean it that way, but they wrote it down a bit silly. Like all legislation, privacy legislation is not a candy store where you only put the sweets you like best in the bag. Nor can you ignore the GDPR, or exchange it for, for example, the privacy law of Guatemala (a purely arbitrary example).

The special thing about the GDPR is that it is not a national law – as its predecessor, the Dutch Personal Data Protection Act (Wbp) was – but a European one (apologies if the designation 'law' is wrong in legal speech, but what I mean to say is that there are rules that you have to comply with and if you don’t you can be punished).

Earlier, I wrote about a Greek car rental company that understood that I wanted my data removed after the rental period and had a form for that. And this year I noticed that even in Italian hotels they were not surprised that I did not hand in our passports, but only copies of them. In Italy you have to be registered and they never do that at the hotel reception at the very moment you’re checking in, so they want to keep your passport for a while.

This year, they settled for a copy. I had brought a whole stack of copies with me just to be sure, but I got everything back in good order and so a single set would have been enough. On those copies I had made our social security numbers illegible and written the text 'Copy' over the photos. I noticed that the SSN is no longer on the front of the photo page in the brand new passports of the children. That is a good adjustment, which is completely in line with the GDPR principle of data minimization: do not include more data than is necessary for the intended purpose.

What was the garage company trying to tell me with that somewhat unfortunate phrase? That they have data about me and that they handle it properly – in accordance with the law. And that they don't do crazy things with it, such as selling it on to an advertising company. The fact that they occasionally send me a brochure is inherent in the business relationship I have with them (I think).

In terms of advertising, there is something strange going on. I bought my car from the local Mitsubishi dealer five years ago. That company has not been an official Mitsubishi dealer anymore for a few years; they now work under the Carprof label. The new official Mitsubishi dealer lives a few hundred meters down the road. And they also send me mail, in which they state the type, registration number and year of manufacture of my car, and an offer for that car if I buy a new one from them. I've never set a foot inside their business. Apparently a car brand can request my data purely because I have a car of that brand.

Car companies seem to cherish that data and (so?) they don’t clean up. For many years I received mail from Peugeot, my previous car brand. Until I asked them to stop. That too is an achievement of the GDPR: if you ask for it, a company must delete your data. And no, that does not apply if you have ongoing obligations to that company.

A company cannot choose to use the GDPR; they simply have to comply with it. As a private individual, however, you actually can make use of the GDPR. By knowing your rights and applying them. For example, by requiring access to what data a company has about you, having incorrect data corrected and data removed. The latter is also referred to almost poetically as 'the right to be forgotten'. But if you like all that attention, you can leave it that way. No one is forcing you to use the GDPR.

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.