Anne Cazenave

🚨 New EDPB Guidelines on Legitimate Interests under GDPR - Impacts on health data processing ? 📝On 8th October 2024, the European Data Protection Board (EDPB) released its Guidelines 1/2024 on processing personal data under Article 6(1)(f) GDPR. These Guidelines aim to clarify the criteria controllers must meet to lawfully rely on the legitimate interest legal basis for their data processing activities. ❗The EDPB emphasizes that the legitimate interest legal basis should neither be considered a “last resort” nor an “open door” for justifying data processing. Instead, it requires the fulfillment of three strict cumulative conditions, carefully interpreted within the broader GDPR framework. First, the controller or a third party must have a legitimate interest. Second, processing personal data must be necessary to achieve this legitimate interest. Third, the interests or fundamental rights and freedoms of the data subjects should not override the legitimate interests of the controller or a third party. ⚖️A key aspect of this legal basis is the balancing exercise—ensuring that the controller’s or third party’s legitimate interests do not override the rights, freedoms, and interests of the data subjects. This evaluation takes into account various factors, such as the nature of the processing, the categories of personal data involved, as well as the reasonable expectations of the data subjects. 💡The Guidelines also shed light on the interaction between the legitimate interest legal basis and several key data subject rights, including the right to object and the right to erasure. Additionally, they explore its application across different contexts. 💊 🧪 🩺Fundamentally, this new guideline has little to no impact on health data processing in clinical trials where the legitimate interest basis has been authorized and vetted by the EDPB in 2019 in its Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) (art.70.1.b)) 📱 Outside the clinical trial context, in areas like healthcare and medical apps, this new opinion provides clarification and a framework for controllers to use the balancing test to rely on this legal basis. Special caution is advised when the end users are children. https://lnkd.in/ejsiVNDp #GDPR #EDPB #DataProtection #LegitimateInterest #ClinicalResearch #PrivacyCompliance

6

ETSI/CEN Workshop on EU Digital Identity Framework Standards 10-12 September 2024 | Sophia Antipolis (France) + online Regulation (EU) 2024/1183 amending Regulation (EU) 910/2014 on electronic identities, authentication and signatures (eIDAS 2) was published in the Official Journal of the European Union this spring 2024. This amendment establishes an ambitious European Digital Identity Framework with digital identity wallets and several new trust services. This will bring about a major transformation of security of the European digital infrastructure facilitating cross-border transactions and supporting seamless access to financial, governmental and commercial services across Europe with a high level of accountability. ETSI and CEN are working together to develop several standards to support this new regulatory framework building on the latest globally recognised standards for website authentication, open identities and mobile-based wallets. The workshop will present the latest status of these standards and aims to include demonstrations from large-scale pilots applying the EU Digital Identity Wallet. #standardization #DigitalIdentity

4

𝐂𝐲𝐛𝐞𝐫 𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐢𝐧 𝐭𝐡𝐞 𝐡𝐞𝐚𝐥𝐭𝐡 𝐚𝐧𝐝 𝐦𝐞𝐝𝐢𝐜𝐢𝐧𝐞 𝐬𝐞𝐜𝐭𝐨𝐫: 𝐚 𝐬𝐭𝐮𝐝𝐲 𝐨𝐧 𝐚𝐯𝐚𝐢𝐥𝐚𝐛𝐥𝐞 𝐞𝐯𝐢𝐝𝐞𝐧𝐜𝐞 𝐨𝐟 𝐩𝐚𝐭𝐢𝐞𝐧𝐭 𝐡𝐞𝐚𝐥𝐭𝐡 𝐜𝐨𝐧𝐬𝐞𝐪𝐮𝐞𝐧𝐜𝐞𝐬 𝐫𝐞𝐬𝐮𝐥𝐭𝐢𝐧𝐠 𝐟𝐫𝐨𝐦 𝐜𝐲𝐛𝐞𝐫 𝐢𝐧𝐜𝐢𝐝𝐞𝐧𝐭𝐬 𝐢𝐧 𝐡𝐞𝐚𝐥𝐭𝐡𝐜𝐚𝐫𝐞 𝐬𝐞𝐭𝐭𝐢𝐧𝐠𝐬 This study published in 08.08.2024 by the Joint Research Centre (JRC), the European Commission’s science and knowledge service, reveals cyber vulnerabilities in the EU healthcare sector and further highlights the challenge of characterizing cyber incidents in regard to their health consequences. Hurdles are a lack of consistent evaluation and reporting criteria and a lack of frameworks for assessing causality. We alert that such tools need to be developed in order 𝐭𝐨 𝐩𝐫𝐞𝐩𝐚𝐫𝐞 𝐟𝐨𝐫 𝐭𝐡𝐞 𝐫𝐢𝐬𝐢𝐧𝐠 𝐫𝐢𝐬𝐤 𝐨𝐟 𝐜𝐲𝐛𝐞𝐫 𝐢𝐧𝐜𝐢𝐝𝐞𝐧𝐭𝐬 in an increasingly digitized healthcare environment. Cyberattacks (e.g. supply chain attack, ransomware) were reported to have resulted in compromised patient care such as impacted healthcare services including inappropriate therapy or treatment deliveries. Importantly, reports indicated increased in mortality rates as a consequence of cyberattacks. Review the document here: https://lnkd.in/da93V7cw #KiwaMedical #Kiwa #Medicaldevices Types of cybersecurity incidents by country

21

🇱🇺 In order to simplify both the procedures for citizens & the work of the Administration des contributions directes (ACD), a new “contact centre” is being developed in three phases. In practical terms, a single form is now required for all types of request. jean-paul olinger #Luxembourg #tax https://lnkd.in/ePnzP45n

25

What are the implications of the European Digital Identity Framework ? 🇪🇺🤔 The European Commission aims to convince 80% of citizens to adopt the EUDI Wallet by 2030. This shift will utterly transform access to healthcare, administration, and payments. Check out our latest article to understand Europe's strategic ambitions for digital identity and get a perspective on : ▪ New technological and security requirements. ▪ The central role of mobile phones and the Cloud. ▪ Citizens' expectations for simplicity and data protection. 🔗 https://lnkd.in/ezcn7vj7

17

#Latestpublication The MOOD paper by Fanny Bouyer et al. related to #EpidemicIntelligence in Europe on a #userneeds perspective to foster innovation in digital #health surveillance just got released! According to EI practitioners, how can we improve the detection of emerging diseases, particularly in a One Health approach? Thanks to a multidisciplinary approach, the MOOD partners (GERDAL, CIRAD, Institute of Tropical Medicine Antwerp INRAE VetAgro Sup) studied the diversity of epidemic intelligence (EI) systems in Europe, understood the difficulties encountered and identified avenues for improvement in line with professional logic. This study lays the foundations of support for effective and lasting practice changes. This is the first stage of the co-design of digital tools and associated services of the MOOD H2020 project coordinated by CIRAD. Read the paper now at https://lnkd.in/exK9p8Xh

7

New Developments from ANSSI - Agence nationale de la sécurité des systèmes d'information this Fall! Two new documents related to the CSPN (First-Level Security Certification) were published this summer and came into effect at the beginning of this week. 💪 The new application note (Note 9) formalizes and details the content and structure of a CSPN security target. This Note 9 is particularly based on the Security Target Model for Physical Access Control Systems published last October, in which SPAC Alliance participated. 😎 The updated CER-P-02 procedure document sets the evaluation criteria for a CSPN certification. Among the new features: the conformity of the CSPN evaluation methodology with the requirements of the European standard EN17640:2022 - Fixed-time cybersecurity evaluation methodology for ICT products (FITCEM). One step closer to a common European certification based on "Fixed-Time" certifications like ANSSI's CSPN or BSI's BSZ. Do you want to be part of these developments? Join us here 👉 https://lnkd.in/gM_CMDhM #ANSSI #News #PhysicalSecurity #Documents #SPACAlliance

14

🔎 The Commission nationale de l'informatique et des libertés (CNIL), the French data protection authority, updated its Practice guide for the security of personal data: https://lnkd.in/drTU5NAf and https://lnkd.in/dVy-Ym38 (PDF). In this era of digital economy and culture, the importance and universality of personal data protection laws cannot be overstated. For example, the GDPR has proven to be very useful for the AI field and closed the legislative gap before the EU's AI Act came into force (see our post, https://lnkd.in/ei65YtaH). 👉 Some of the key principles in the GDPR are security, integrity and confidentiality, set out in Art. 5 (1)(f), which are elaborated in Art. 32. Here, at the intersection with information security and IT, many questions arise, which the CNIL provides answers to in its updated Practice guide: https://lnkd.in/dVy-Ym38 (PDF). The new edition adds several new topics, including AI. We recommend everyone data privacy and AI pros to review it and keep it handy. 💡 If you have any questions about the GDPR or the development or implementation of AI systems in a compliant manner, we at ESPE are always ready to help: [email protected]📨, https://especg.com/, www.especg.com. You can learn more about the ESPE's services on our website: 🔹 Data Protection: https://lnkd.in/e56pvSut, 🔹 Legal Support for AI Development: https://lnkd.in/exJvWeec. #cnil #datasecurity #aiact #ai #artificialintelligence #dataprivacy #intellectualproperty #gdpr #expertconsulting #ChatGPT #LLM #inspiration #ESPE

7

Ethics, privacy and regulation must come first when looking at what tech to use and why in the public sector? Watch the replay now and discover what was discussed and why it should matter to you! Register now https://lnkd.in/eGBgHWPA #ethics #privacy #security

5

On September 24, the CNIL (Commission nationale de l'informatique et des libertés) published its final recommendations for mobile applications, designed to enhance user privacy and ensure compliance with GDPR. Simultaneously, the French Competition Authority (Autorité de la concurrence) released its opinion on these recommendations, emphasizing the importance of balancing privacy protections with maintaining healthy competition in the mobile app market. Key Points: 1. Joint Effort for Privacy and Competition: The CNIL and the Autorité have collaborated to ensure that the privacy recommendations do not inadvertently stifle competition or empower dominant players, such as Google and Apple, to further entrench their market positions. The recommendations are crafted to enhance user data protection without creating barriers to entry or disadvantaging smaller players in the mobile app ecosystem. 2. Recommendations for Mobile App Stakeholders: The CNIL's recommendations provide clear guidance to various stakeholders in the mobile app ecosystem, including developers, publishers, SDK providers, OS providers, and app store operators. The guidelines focus on ensuring that user consent is informed and freely given, and that data processing practices are transparent and compliant with GDPR. 3. Addressing Competition Concerns: The Autorité has highlighted potential competition issues within the CNIL's draft, particularly the risk of reinforcing the market power of vertically integrated players like Google and Apple. The Autorité recommends that the CNIL’s guidelines be applied uniformly across all apps, including those pre-installed or proprietary to the OS providers, to prevent anti-competitive practices. 4. Focus on Proportionality and Non-Discrimination: The Autorité emphasizes that any privacy protections, especially those related to user permissions and data access, must be applied in a proportionate, objective, and non-discriminatory manner. This is crucial to maintaining a diverse and competitive app market that fosters innovation. Next Steps for Compliance and Enforcement: The CNIL will continue to provide support to industry stakeholders through webinars and other resources to help them comply with the new recommendations. Starting in 2025, the CNIL will launch specific investigations to ensure that mobile apps are adhering to these guidelines, focusing particularly on the use of permissions and data processing practices. Stay informed about the intersection of data protection and competition law by following Global Regulatory Insights. #PrivacyProtection #GDPRCompliance #CompetitionLaw #MobileApps #GRI

4

 📢 New GDPR Handbook for SMEs Now Available in 17 Languages! The European Data Protection Board (EDPB) has launched translations of its Data Protection Handbook in 17 languages as part of its 2021-2023 strategy. This comprehensive guide is designed to help small and medium-sized enterprises (SMEs) better understand and comply with GDPR requirements. The handbook offers: ·       Practical tools and tips for GDPR compliance ·       Real-life examples from GDPR implementation ·       Videos, infographics, interactive flowcharts, and more ·       A clear overview of GDPR rights, personal data breaches, and compliance measures ·       This guide is a must-have resource for SMEs looking to simplify their approach to data protection! Read more in our article (link in the comments 👇) #GDPR #DataProtection #SMEs #Compliance #PrivacyLaw #EDPB #ecovis #BusinessSupport

9

1 commentaire

#French #Data #Protection #Authority the #CNIL says the #European #Cybersecurity €Certification Scheme for #Cloud Services (EUCS) drafted by #ENISA is not #protective enough against Access by foreign governments to #sensitive #data Press release by the CNIL (19 July 2024): https://lnkd.in/eXAiJbxM About the EUCS: https://lnkd.in/emugu7T A question on #ITSECURITY and #DATAPROTECTION? Contact PharMarketing GDPR Life Sciences Data Protection, Data Privacy at [email protected] #hosting #healthcare #healthdata #dataprotection #personaldata #privacy #compliance #databreach #regulatoryaffairs #cloud #itsecurity #ISO27001 #GDPR #lifesciences

4

#French #Data #Protection #Authority the #CNIL says the #European #Cybersecurity €Certification Scheme for #Cloud Services (EUCS) drafted by #ENISA is not #protective enough against Access by foreign governments to #sensitive #data Press release by the CNIL (19 July 2024): https://lnkd.in/eXAiJbxM About the EUCS: https://lnkd.in/emugu7T A question on #ITSECURITY and #DATAPROTECTION? Contact PharMarketing GDPR Life Sciences Data Protection, Data Privacy at [email protected] #hosting #healthcare #healthdata #dataprotection #personaldata #privacy #compliance #databreach #regulatoryaffairs #cloud #itsecurity #ISO27001 #GDPR #lifesciences

4

Discover our article "𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗻𝗴 𝗗𝗲𝘃𝗦𝗲𝗰𝗢𝗽𝘀 𝘁𝗼 𝗖𝗼𝗺𝗽𝗹𝘆 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲 𝗖𝘆𝗯𝗲𝗿 𝗥𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲 𝗔𝗰𝘁". Digital security in Europe is taking on a new dimension with the Cyber Resilience Act (CRA). This regulatory framework imposes crucial new requirements to protect our infrastructures. Contents: ✅ Understanding the European regulatory context and the importance of the CRA for digital resilience. ✅ Exploring the implications of the Cyber Resilience Act, and how it affects your operations. ✅ Discovering the benefits of the DevSecOps approach to effectively comply with these new requirements. ✅ Following practical steps to integrate DevSecOps into your infrastructure and meet CRA obligations. Read the full article for practical advice and essential recommendations 👉 https://lnkd.in/dqnhVe3Y

4

AI Development & GDPR Compliance: 7 Key Steps from the CNIL 🛡️🤖 The French Data Protection Authority (CNIL - Commission Nationale de l'Informatique et des Libertés) has released guidance on ensuring GDPR compliance throughout the development of AI systems. 🌍🔍 The 7 steps include: 🔹 Define Your Purpose 🔹 Know Your Role 🔹 Establish Legal Basis 🔹 Check Data Reuse 🔹 Minimize Data 🔹 Set Retention Period 🔹 Conduct DPIA #France #DataProtection #Innovation

3

Become a GDPR Auditor: Join the GDPR Auditor course and gain essential skills to perform effective audits under GDPR. Learn from industry experts and master the GDPR audit processes.    What you'll learn:  ✅ Set audit criteria  Master selecting the right control points for GDPR audits. Florence de Villenfagne  🔍 Audit ISO 27701 management systems  Use ISO standards to organize and assess GDPR compliance. Patrick Soenen  🛠️ Audit techniques & practices  Apply key techniques like interview auditees, document findings and craft audit reports Nico De Bock & Jan Decorte 📜 Audit products & services  Explore certification schemes and their audit benefits. Kenny Willems   📢 Last call: Register now to secure your spot!   #GDPR #AuditTraining #Compliance #Certification #AuditingSkills #RiskManagement

19