Christian Brockhausen (MBA)

DORA PILLAR #5 - THIRD-PARTY ICT RISK MANAGEMENT Welcome back to our editorial column on the DORA act. Today we are going to take a look at the fifth pillar of the The Digital Operational Resilience Act (DORA) EU regulation that establishes a mandatory, comprehensive implementation for the third-party ICT risk management. Article 28 outlines key principles for managing ICT third-party risk in financial firms. These include that companies remain responsible for legal compliance even when outsourcing ICT services, and they must manage risk proportionally. Key requirements include developing a strategy for ICT third-party risk, maintaining a detailed register of contracts, and regularly reporting to authorities. Firms must conduct due diligence before contracting, assessing risks like substitutability and compliance with security standards. They must also establish exit strategies in case of contract breaches or operational risks, ensuring continued regulatory supervision. Source: Managing ICT Third-Party Risk under DORA | Fieldfisher #d4next #d4x #dorapillars #dora #yogaplatform #yoga #agilitylayer #future #tech #insurance #fintech #startup #business #finance #technology #digital #innovation #software #artificialintelligence #technology #trust #future #gamechangers

8

The Federation of European Risk Management Associations (#FERMA) published a Policy Manifesto 2024-2029 calling on the European Union (#EU) to address regulatory complexities, lack of insurance for net zero transition, evolving cyber security challenges, and crisis preparedness levels. Read our article to lean more 👇 #Riskmanagers #EU #riskready #netzero #cybersecurity

17

Implement Consulting Group's fantastic regulatory and information security expert Louise Mehl has generously shared a summary of the DORA-related ESA policy products, that offers an overview of what is included in the different RTS/ITS documents that were released in January and July. Do you need a more thorough deep-dive of how to implement these standards? Don't hesitate to reach out to Louise, myself or two of my awesome cyber colleagues in IM Malmö, Mikael Carinci and Isabel Sandström and we will setup a meeting to discuss further. #DORA #digitaltransformation #operationalresilience #BCP #thirdpartyrisk #datamanagement #suppliersecurity

8

Thank you, Theodore Christakis and others, for this excellent article on a July decision from the Regional Court of Traunstein in #Germany regarding a pragmatic and risk-based methodology for analyzing international #datatransfers. #Privacy professionals, this is a refreshingly risk-based and non-zero-sum approach to international transfers under #GDPR. #Privacy #BRG #Thefirstruleofprivacyisthelastruleofprivacyjustchanged https://lnkd.in/eM-6zqeP

1

News on the Right of Access under the GDPR The German Federal Court of Justice (#BGH) has addressed the issue of the right of access under #Article15 of the #GDPR in its judgment of 5 March 2024 (VI ZR 330/21). The case specifically concerned the scope of the right to a copy in relation to different categories of documents. The BGH held that letters drafted by the data subject himself or herself always constitute #personal #data in their entirety. Therefore, the controller must provide copies of such letters. In contrast, letters drafted by the #controller only have a personal reference if they contain "information about the data subject". Therefore, these documents are also not fully personal. Only the relevant part that contains information about the #datasubject has a personal reference. Consequently, there would be no right to a complete copy of these documents. However, if a copy of these documents is necessary in order to understand the data processing as a whole and thus to be able to assert data subject rights, a complete copy must be made available. However, the data subject must credibly justify this and the necessity must be clearly recognizable. This creates more clarity for the processing of access requests. Copies of documents created by data subjects must be made available. This is not necessarily the case for documents created by the controller. The processing of access requests remains a challenging issue that is regularly associated with high effort. The BGH's limitation regarding the creation of copies is very helpful. https://lnkd.in/eUhHHcXP #LEP

4

'How the Swiss Federal Act on Data Protection applies to sports federations' by Dr. Paul Fischer and Mayank Hebbar: https://bit.ly/4d3HVu5 Article Highlights: ▶️ The Swiss Federal Act on Data Protection ▶️ Scope ▶️ Data protection principles ▶️ Data controller and processor obligations ▶️ Data subject rights ▶️ FADP vs GDPR ▶️ Similarities ▶️ Important differences ▶️ How should international federations adapt? #sportslaw #dataprotection

11

"Discussion Paper: Large Language Models and Personal Data", interesting discussion paper published in July 2024 by the Hamburg Commissioner for Data protection and freedom of information. 👇 This report supports #companies and authorities in addressing #dataprotection issues related to #LLM #technologies. It explains #LLMs' technical aspects, evaluates them under #GDPR and Tribunal de Justiça da União Europeia's case law, and distinguishes #LLMs as #AI models versus components in #AI systems under the proposed #AIAct, outlining key #compliance requirements. Link: https://lnkd.in/d5inYqHK #ailaw #machinelearning #deeplearning #artificialera #web3 #web4 #web5 #fintech #digitalera #digitaltransformation #generativeAI #trustworthyAI #explainableAI #aiethics #artificialintelligence #explainableAI #responsibleAI #foundationmodels #GPAI #GAI #LLMs #NLPs #GenAI #frontierAI #narrowAI #AGI #ethicalAI #adversarialAI

25

#DORA Update 04/12/2024 The European Supervisory Authorities (ESAs) released an update on the application of The Digital Operational Resilience Act (DORA). My high level summary: 📅 Technical standards and guidelines will apply from 17 January 2025. ▶️ Financial entities are advised to ensure they advanced preparedness and readiness to meet the obligations. 💪 Emphasis placed on the implementation of a robust, structured approach - there will not be a transitional period. 📄 Prepare to present new reporting requirements such as the register of ICT third-party providers’ contractual arrangements. 🚨Ensure there is an ability to classify and report major ICT-related incidents from the date of application. 🔬ICT third-party service providers that may meet the criticality criteria are called on to assess themselves against DORA requirements. 🕖 The first designation of CTPPs is expected to take place in H2 2025. https://lnkd.in/e9edUnYV

71

Blog Post Considerations for Holistic Risk Assessment in AI Systems and the Role of User Experience in Auditing As AI technologies become increasingly integrated into various aspects of society, the need for comprehensive risk assessment methodologies and user-centric auditing practices is paramount to ensure the ethical and responsible deployment of AI systems. One of the keys is the importance of conducting holistic risk assessments in AI systems. #ai #riskassessment #blog https://lnkd.in/drbi6dBs

11

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg/Germany has published an update of its discussion paper "Legal Foundations in Data Protection for the Use of Artificial Intelligence. I recommend to read chapter IV. 1 on legitimate interest. Like: "In the development and use of AI systems, a legitimate interest of the controller will regularly be assumed. Such a legitimate interest may, for example, lie in the development of AI systems. Thus, controllers in a commercial context will regularly pursue the goal of offering increasingly better and more innovative products, which may include, for instance, the development of autonomous vehicles or the flawless recognition of human interactions." Thank you Dr. Henrik Hanssen for sharing the machine translation!

40

“… national #dataprotection #supervisory #authorities in #Germany should be designated as #market #surveillance authorities under the #AIAct (following the entry into force of the AI Act in the coming months).” position paper from the #German #Datenschutzkonferenz #EUAIAct #AIRegulation #AI

5

1 Kommentar

Trans-Atlantik Data Privacy Framework It is almost 1 year ago that the #EUCommission announced the new adequacy decision for the #USA, called #TADPF. A key basis for this decision is a new complaints procedure that allows data subjects to have the processing of personal data by #USIntelligence services in the US reviewed. In addition to this new complaints procedure, there are other complaints procedures for possible violations of the #DPF by US organizations/companies. Data protection authorities in #EU member states accept relevant complaints. The European Data Protection Board (#EDPB) has developed complaint forms and additional information for this purpose. The documents are now also available in #German. I am wondering if the #BfDI will publish how many complaints they received? https://lnkd.in/eAr3j38K

1

"...regarding the EU-US Data Privacy Framework (DPF), the EDPB adopted Rules of Procedure, a public information note and template complaint forms to facilitate the implementation of the redress mechanisms under the DPF. The EDPB documents relate to two DPF redress mechanisms created to handle complaints by EU individuals. The redress mechanisms deal only with complaints concerning their respective competence - national security or commercial purposes - and only for data transmitted after 10 July 2023." https://lnkd.in/dQjSB5K8 https://lnkd.in/did_bZDC #DPF #datatransfers

5

🚨 Facing backlogs in investigations? Learn how one of Europe’s largest tax authorities overcame this challenge by leveraging our award-winning Unified Digital Forensics Platform. 🕵️‍♂️ With Detego technology, they significantly reduced investigative backlogs and streamlined field-based investigations. 👉 📰Find out more: https://ow.ly/mRBL50TIW9R #DigitalForensics #ForensicTechnology #DFIR #InvestigationEfficiency #Fraudprevention Forensic Focus

14

Ferma’s new Enterprise Risk Management (ERM) committee aims to boost the practice among members by clarifying exactly what ERM is and what it can deliver, providing practical advice and, crucially, helping to break down communication barriers that exist between many risk managers and their CEO, its chair told Commercial Risk. More... https://ow.ly/ciB350T4hfK #Ferma #RiskManagement FERMA | Federation of European Risk Management Associations

1