Out Of Curiosity | The Cat Herder, Volume 5, Issue 34
|
A bit of this, a bit of that, a bit of the other. Data brokers getting a bit bothered by the prospect of legislation in the US, Hikvision cameras a bit vulnerable, a bit of questionable data collection by the Ministry of Justice in the UK, a bit of machines being trained to recognise swimming pools in France, a bit of the consequences of Brexit, a lot of location data.
😼
Analyzing about 285,000 Hikvision web servers online, researchers spotted over 80,000 of them vulnerable to a remote command injection bug.
—
An investigation confirmed records may have been accessed by a staff member “out of curiosity”.
A UK edition of Mandatory But Not Compulsory this week.
The Information Commissioner, has opened an investigation into concerns that the Ministry of Justice was unlawfully processing barristers’ personal data.
This is significant, and awkward for Britain, which has said that its data protection overhaul will unleash tech investment.
— Vincent Manancourt (@vmanancourt) September 3, 2022
Via my colleague @g_lanktree, how an e-vehicle firm pulled a U.K. project in part because of the reform proposals. pic.twitter.com/oNjLOqoAmT
—
In France you can no longer hide your swimming pool from the taxman.
France’s tax authority said Monday that a new artificial intelligence system had found thousands of undeclared swimming pools, allowing it to collect millions of euros from homeowners who failed to report…
Local law enforcement agencies from suburban Southern California to rural North Carolina have been using an obscure cellphone tracking tool, at times without search warrants, that gives them the power to follow people’s movements months back in time, according to public records and internal emails obtained by The Associated Press.
The Italian DPA fined UniCredit €70,000 for “requiring that a data subject submit their access request via a designated form, and for not providing all information required under Article 15 GDPR.”
Data controllers in the public sector in Ireland might want to pay attention to this as their love of trying to force data subjects to use unnecessary forms when making subject access requests is almost boundless.
—
The ICO gave itself a pat on the back for encouraging some platforms to make some mostly cosmetic changes. “Children are better protected online in 2022 than they were in 2021” - ICO marks anniversary of Children’s code
The Information Commissioner himself gave an interview to The Telegraph (€) in which he announced some impending decisions on whether to prosecute for breaches of the Children’s Code, without naming who the companies involved are. Thus continuing a tradition established by recent Tory governments of announcing things in paywalled articles in The Telegraph. Natasha Lomas covers this at length for Techcrunch.
- “we are concerned that the discussions on the effective enforcement of the GDPR only focus on the lack of harmonised procedures and we invite the EDPB to extend the scope of its work when addressing the shortcomings with the enforcement of the GDPR. We, however, understand that the EDPB cannot solve all the issues regarding the enforcement of the GDPR and has limited competences and powers.” From the EDRi‘s response to the European Data Protection Board and its members [PDF]
- “Even if the bill doesn’t pass, it could still be chalked up as a win for the data broker industry, by maintaining a status quo that privacy advocates say should cease to exist. “Just because data brokers have spent the last 20 years making millions of dollars off of our personal data because Congress hasn’t passed a privacy law doesn’t mean it should continue to be legal,” EPIC’s Fitzgerald said. “The bipartisan consensus behind ADPPA is that we need to rein in these abusive data practices, not codify them into law.” From 'Privacy bill triggers lobbying surge by data brokers’ by Alfred Ng for Politico.
- "The kind of data that Fog sells to law enforcement originates from third-party apps on smartphones. Apps that have permission to collect a user’s location can share that data with third-party advertisers or data brokers in exchange for extra ad revenue or direct payouts. Downstream, data brokers collect data from many different apps, then link the different data streams to individual devices using advertising identifiers. Data brokers often sell to other data brokers, obfuscating the sources of their data and the terms on which it was collected. Eventually, huge quantities of data can end up in the hands of actors with the power of state violence: police, intelligence agencies, and the military.” From ‘Inside Fog Data Science, the Secretive Company Selling Mass Surveillance to Local Police’ by Bennett Cyphers for the EFF.
—
Endnotes & Credits
- The elegant Latin bon mot “Futuendi Gratia” is courtesy of Effin’ Birds.
- As always, a huge thank you to Regina Doherty for giving the world the phrase “mandatory but not compulsory”.
- The image used in the header is by Krystian Tambur on Unsplash.
- Any quotes from the Oireachtas we use are sourced from KildareStreet.com. They’re good people providing a great service. If you can afford to then donate to keep the site running.
- Digital Rights Ireland have a storied history of successfully fighting for individuals’ data privacy rights. You should support them if you can.
Find us on the web at myprivacykit.com and on Twitter at @PrivacyKit. Of course we’re not on Facebook or LinkedIn.
If you know someone who might enjoy this newsletter do please forward it on to them.