Data protection

• To join the Mesa class action, go to http://www.rosenlegal.com/cases-register-1825.html or call Phillip Kim, Esq.
• toll-free at 866-767-3653 or email pkim@rosenlegal.com or cases@rosenlegal.com for information on the class action.
• Rosen Law Firm represents investors throughout the globe, concentrating its practice in securities class actions and shareholder derivative litigation.
• 1 by ISS Securities Class Action Services for number of securities class action settlements in 2017.

• IRVINE, Calif., May 29, 2020 /PRNewswire-PRWeb/ --MatrixPoint, a data-centric consulting firm specializing in marketing efficiency and data privacy compliance, today released its Verified Private Certification.
• The Verified Private Trustmark can improve consumer confidence and website conversions, while also protecting your company from significant fines that range from $2,500 to $7,500 per customer record.
• "Our team is extremely excited to offer this visible certification to companies who truly care about their customer's data and privacy," said MatrixPoint Managing Partner, Brian Mahoney.
• MatrixPoint Consulting was created to help companies improve their business processes, their relationship with their customers, and ultimately, their bottom line.

The General Data Protection Regulation (GDPR) has already been in existence for four years, and has been in force for two years. How can anonymization techniques under the GDPR help Data Protection Officers (DPOs) assess innovation? I hosted a webinar with Truata that featured experts from DPAs in Italy, Ireland, and the UK to find out more about their perspective. The recording is available here (link to the webinar).  

‘A revision of the 2014 opinion on anonymization techniques is in the working program of the EDPB’

• In 2014, the European data protection authorities, assembled in the Article 29 Working Party provided guidance in their opinion on anonymization techniques.
• Giuseppe DAcquisto, Senior Technology Advisor at the Italian Data Protection Authority, said that some adjustments to the 2014 guidance are needed because there are unexplored aspects of anonymization in the GDPR: A revision of the 2014 opinion is in the working program of the EDPB.
• Ultan OCarroll, Deputy Commissioner for Technology and Operational Performance at the Data Protection Commission in Ireland, said: The 2014 opinion is still as valid as it ever was, if not more so.

‘Unexplored aspects of anonymization in the GDPR’

• D’Acquisto gave three examples where in his view the use of Privacy Enhancing Technologies (PETs) could play a role.
  1. On legitimate interest as a legal ground: “Anonymization techniques can become an element in the balancing test when you want to invoke legitimate interest.”
  2. On public interest as a legal ground: “Public interest is an opportunity when used in combination with national law.” He called on national legislators to explore the possibility of including the use of privacy-enhancing safeguards in laws.
  3. On the secondary, (in)compatible use of personal data for further processing: “Rethinking the 2014 opinion is useful to explore new opportunities for data controllers.”
  • It clarifies Article 6 of the GDPR which stipulates the lawfulness of processing.
  • Recital 50 states that the processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected.
  • DAcquisto stressed that value could be added to data in the interest of the public when applying anonymization techniques as safeguards for our rights and freedoms.

‘Time to focus on privacy risk management’

• Simon McDougall, Executive Director for Technology Policy and Innovation at the Information Commissioners Office in the UK, said that it is time to focus on privacy risk management: There is a tension between risk management and hard science.
• They struggle with the concept of residual risk and the question of what risk to accept.
• He also explained the benefits of a layered approach to privacy risk management, rather than a focus on a single technology.
• Think of it as a Swiss cheese notion of [stacked] risk management measures, McDougall said.

‘Legal and technical competences are complementary to each other’

• The broader questions around innovation, sharing of data, and repurposing of data have become particularly important in the context of COVID-19.
• Accordingly, each of the experts expressed their advice for DPOs given the developments in anonymization technologies.
• DAcquisto suggested that DPOs should not rely on either legal or technical competence alone.
• A holistic approach is needed with legal safeguards, technical safeguards, and a path toward compliance.

‘DPOs: do not go alone; get help’

• DPOs need to get access to scientists and to organizational people, but also to expert advice in terms of social science, cognitive science, interface design, or mathematics, for example.
• Do not go alone; get help, he said.
• Its not worth carrying forward without that because youll be asked questions that you may not think about.
• Instead of thinking this is all incredibly complicated, they should try to understand what the risks are for the individual and the organization.
• It is possible to keep up with it so you can then have the conversation with the right expert.

• GDPR for business professionals will tell organizations how well their people understand their responsibilities.
• Only 20% believe they are fully GDPR compliant.1 Yet a breach in GDPR can incur a fine of 20million.
• GDPR for business professionals will give organizations confidence that relevant staff members understand whats expected of them.
• It now provides ready-made assessment content, such as GDPR for business professionals , as well as the assessment platform and professional services.