EU’s digital rulebook updates
On 21 October, the Council of the European Union published its position on the proposal to simplify certain rules on data protection, privacy and cybersecurity (the so-called Digital omnibus). The changes aim to make the EU’s digital rulebook clearer and easier to apply for businesses, public administrations and citizens, to support EU competitiveness.
Among the most important findings is that it does NOT support the Commission’s original proposal to amend the definition of personal data, but introduces a new provision on pseudonymisation and identification of natural persons and safeguards for the processing of sensitive data for the purposes of biometric verification, development and operation of AI.
The Council broadly supports the Commission’s GDPR simplification rules on unfounded or excessive requests by data subjects, and extending the deadline for reporting data breaches. It also supports the definition of “scientific research” that facilitates the consistent application of the rules on the processing of personal data and introduces targeted exemptions from certain obligations.
Stay up to date! Sign up to receive our fortnightly digest via email.
The Council consolidates and streamlines the rules on data altruism and data brokerage services. It maintains the rules on cookies and other online tracking technologies under the ePrivacy Directive, but the framework is updated with clearer and additional data processing purposes for which consent will not be required to place cookies on a user’s device.
Finally, instead of an EU-wide single point of contact, it proposes the establishment of national contact points facilitating the reporting of incidents and related events in different EU legislations. However, it would also support the establishment of an EU-wide incident reporting information point for cross-border incident reporting.
Next, the Council will start negotiations with the European Parliament once the latter adopts its own negotiating position with a view to a speedy agreement.
Legal updates
Border control data: On 27 October, the EDPS set out necessary safeguards on the proposed agreement for the mutual exchange of information between the EU and the US for travel authorisations. It would facilitate the verification of identity, screening and assessment of travellers to determine whether they would pose a risk to public security.
According to the EDPS, all necessary safeguards must be in place to protect individuals, including effective oversight on both sides of the Atlantic: a) only relevant and necessary data should be used, b) criminal offences should be clearly defined, c) an objective link must be established between the risk and the person concerned. Furthermore, the framework agreement clearly identifies the data protection authorities of the EU as supervisory authorities, but such clarity is lacking on the US side.
Schufa disclosure requirements: German credit agency SCHUFA won a case before the Federal Court of Justice. The court overturned key parts of rulings by the Dresden Higher Regional Court regarding the transparency of older scoring models, as the decisive nature of the scores has not been established.
SCHUFA implements credit scores relevant to future contract conclusions, regardless of whether these scores were actually used as a determining factor. Thus, the criterion of “determining factor” no longer plays a role for SCHUFA. A credit score is considered relevant if it fully meets the criteria of Art. 22 of the GDPR (Automated individual decision-making). For this to be the case, the conclusion of a contract with a third party must depend decisively on the score.
Finally, as of 20 November, the issue of decisiveness will no longer be relevant for SCHUFA, as the new legal requirements for explaining credit scores will take effect.
Networked control systems on alert
The German Federal Office for Information Security (BSI) looked at IT security incidents at supermarkets in Germany and numerous other European countries. These incidents involved unauthorised third parties manipulating control systems for refrigeration units accessible via the internet. In some cases, this destroyed food products. The BSI emphasised that such vulnerabilities practically invite sabotage and published a guideline with technical measures for this purpose (in German).
It is aimed at operators of small industrial or similar facilities, such as those used for food cooling, electricity generation, and other applications, and includes measures that are obvious and easy to implement:
- Prevent direct internet access to control systems (If external access is necessary, restrict it to trusted IP addresses).
- VPN systems and multi-factor authentication should be implemented.
- Systems in use should be kept up to date.
- Security updates and bug fixes should be installed promptly.
Furthermore, it is essential to assess whether any devices or systems are exposed and implement specific countermeasures. These measures should become routine, thereby significantly increasing the level of security.
More from supervisory authorities
Authentication by means of voice recognition: The Federal Administrative Court in Switzerland confirms that a company (PostFinance AG) must obtain explicit consent from customers before creating voiceprints for authentication purposes. If the data subject simply continues speaking after being informed that the conversation is being recorded and that a voiceprint is being created, they do not thereby give their express consent. Swiss data protection agency, FDPIC, issued a preliminary decision earlier this year.
The court has granted PostFinance AG a deadline until mid-February 2027 to obtain the explicit consent of the customers concerned for the voiceprints already created. In cases where no consent has been given, the data must be deleted immediately.
Apple restrictions in Poland: The Polish competition authority has ordered Apple to amend its App Tracking Transparency policy. It requires Apple to change the layout and wording of consent prompts for users in both its own apps and third‑party apps. Apple defined activities referred to as user “tracking”. This involved combining user data obtained from apps operated by different companies for the purpose of personalised advertising. This triggered a requirement to display an additional notification.
Combining data obtained directly by a single entity, including Apple, was not considered “tracking”. Consequently, iPhone and iPad users saw different messages: third-party apps asked for consent to “tracking”, while Apple asked for consent to “personalised advertising”. The appearance of the consent and opt-out windows and the wording also differed. This could discourage users from sharing data with independent app publishers while favouring entities that used their own data to provide advertising services, in particular Apple.
Receive our digest by email
Sign up to receive our digest by email every 2 weeks
“Password1” is a wide-open door to malicious actors
The UK Information Commissioner issued reprimands to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales, known as Data Cymru, following a ransomware attack. During the attack, the personal information of 3,300 people was taken, the majority of whom were children. The attack exploited a test account that had existed for more than 12 years and had either remained active since it was created or been inadvertently reactivated before the incident. The account was protected by the password ‘Password1 ’, which could be compromised in less than a second.
More enforcement decisions
Personalised pricing investigation: America’s Federal Trade Commission ordered nine major airlines, ride-sharing companies and food-delivery firms to provide detailed information that will allow the agency to study the use of personal data to set prices and compensation. The orders were issued to Delta, United, JetBlue, Lyft, Uber, DoorDash, Instacart, Target and Walmart.
Each company must turn over information that will allow the agency to assess whether the pricing for a ticket, ride share, food delivery or other product or service varies from one person to the next based on factors such as participation in loyalty programs or analysis of personal data by superintelligence algorithms.
Fnac Darty fine: The French data protection regulator CNIL fined FNAC Darty Participations et Services and FNAC Direct 7 million euros for non-compliance with the applicable rules on cookies. The CNIL found that the companies used a tracker that users had not consented to, collecting their browsing history to display product recommendations and train their recommendation algorithm. Those queries contained an identifier assigned to the user as well as information relating to their activity. This tracking made it possible to display products based on browsing history, products complementary to those viewed or purchased, such as accessories, consumables or associated services, as well as similar products.
Police privacy fine: In the UK, Staffordshire Police was reprimanded after the force unlawfully disclosed a domestic abuse victim’s home address to their alleged abuser. The notice included the victim’s current address when it was served on the alleged perpetrator following their release from prison. The victim’s address was not previously known to the alleged abuser and its inclusion in the notice was not lawful. The data breach caused serious distress to the victim, who had previously moved home on several occasions to escape the alleged abuse.
Data controller’s obligation to provide access to CCTV images
The Danish data protection authority criticised Metro Service for refusing to give a citizen access to recordings from television surveillance. The decision is relevant for all data controllers as an example of how the right of access must be observed when using video surveillance. The complainant had provided a generic description of his appearance and information about some specific circumstances regarding the incident. However, due to the complainant’s social circumstances, the incident could not be timed more precisely than a period of 10 given days between 00:00 and 06:00.
Metro Service had refused to comply with the access request, citing that it was not possible to identify the complainant, that responding to the request would be associated with an excessive consumption of time, and that there were considerations of public safety that meant that recordings could not be handed over in certain cases. The authority assessed that Metro Service had not sufficiently demonstrated an exception to apply in the specific case. Furthermore, the authority found that Metro Service’s subsequent deletion of the material was in breach of data protection law.
And Finally…
Binance cryptocurrency exchange hack: Hackers used a bogus job interview and software hidden in an advertisement to compromise the computers of two Binance software engineers before using a third’s computer to drain 6.3 billion dollars worth of crypto in the record heist at the end of October, Reuters reports. A multi-stage hacking endeavour began in June when an employee on its wallet developer team downloaded a tool from the internet that hackers had tampered with.
This move exposed the employee’s role and that of others in the team that looked after Binance’s cryptocurrency wallet infrastructure, according to The Guardian. Later in September, a second software engineer seeking a new job downloaded a “malicious code repository” onto his computer after interviewing for what was thought to be a legitimate role.
At the final stage, the attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer’s system and that of a second wallet developer. Later, they used the second wallet developer’s computer, with stolen credentials from the first wallet developer, and triggered a malicious script to launch the attack.