Data Privacy Detective

The EU’s GDPR requires businesses outside the EU to appoint a “representative” in a member state and a Data Protection Officer in the EU to consult on and monitor data privacy matters. In this episode, Alessandro Di Mattia joins us to explore the definitions and requirements surrounding these positions and the roles they play in protecting consumer personal data according to the GDPR.

The California Supreme Court faced a challenge that may have been the first stone cast in a global debate about free expression on the internet. The case centered on a San Francisco law firm that got a one-star YELP review from an unhappy former client. When the firm’s YELP rating dipped from 5.0 to 4.5 the law firm successfully sued the reviewer for a defamation claim. YELP was not originally a p...

“California enacts the strictest online privacy law in the country!” trumpeted CNN/Tech. A statute passed unanimously in the legislature and immediately signed by Governor Brown, AB 375, had the support of large tech firms and privacy advocates. It moves California in the direction of the European Union, granting rights to California consumers concerning personal information they share online. The...

Businesses not located in the European Union have tried to understand whether the General Data Protection Regulation (GDPR), applies to them. And if it does, or if it might, one of the puzzles has been whether a non-EU business needs to appoint a natural person or legal entity to be its “representative” or a natural person to be its “Data Protection Officer” for dealing with EU and its Member Stat...

How did U.S. businesses deal with the launch of GDPR? And what’s its immediate impact on how U.S. businesses address personal information they have? The Data Privacy Detective turns the magnifying glass to this question, focusing on small and mid-sized (SME) U.S. businesses that hold personal data of Europeans. Most coverage about GDPR is about titanic battles of tech giants whose business models...

GDPR, the European Union’s effort to protect personal data, has dominated the efforts of businesses to deal with personal data across borders. Less noticed is China’s evolving system of controlling, regulating and protecting the personal information of its people. On May 1, 2018, China issued standards for personal information protection.

In this podcast episode, the Data Privacy Detective discusses the background to the EU / U.S. and Swiss Privacy Shield and how it relates to the new requirements of the EU General Data Protection Regulation (GDPR)that will take effect on May 25, 2018. If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

In this podcast, the Data Privacy Detective turns a magnifying glass to how businesses located outside the EU can gather and use personal data that originates in the EU without violating the GDPR. Businesses inside the EU are actively working to bring their policies and procedures in line with the GDPR, with the benefit of many years of practice under the 1995 EU Directive that required EU countri...

The Data Privacy Detective explored in prior podcasts the broad scope of personal data, the differences between controllers and processors and other matters, including how processing can be lawful. That includes several specific, limited instances when acquisition and use of personal data can be legitimate in the absence of express consent of the persons whose data are held.

The EU’s GDPR – the General Data Protection Regulation – becomes law on May 25, 2018. This podcast explores what processing of personal data as defined by the GDPR is considered lawful. “Processing” is defined very broadly by Article 4.2 to encompass a wide variety of ways in which personal data are held or used. Article 6 describes what constitutes “Lawfulness of Processing.” It lists six alterna...

The GDPR defines personal data very broadly. But it is not an all-encompassing effort to protect all personal data from every conceivable use or misuse. “Personal data” is defined by Article 4.1 as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by referenc...

Businesses collect, use and store personal data. It’s unavoidable. An email address, phone number, birthdate, postal address – these are all personal data that allow someone to identify or contact an individual. Other information is far more sensitive, such as health information, religious preference, political beliefs, race or ethnic origin, sexual preference, and financial details. The European...

How does a non-EU business know if it must comply with the GDPR? And what specific things are required if the answer is yes? This podcast explores these questions, detailing the specific activities that require a non-EU business to comply with this EU regulation. Merely having a website is not enough. But if a company aims to sell goods or services to Europeans or to monitor the behavior of EU cit...

On May 25, 2018 the European Union’s General Data Protection Regulation becomes law – not just within the EU but everywhere in the world in some respects. It is deliberately extraterritorial. The EU is serious about compliance with the GDPR. Fines can be as high as 4% of a company’s gross revenues or 20 million Euros. The Data Privacy Detective launches a thorough exploration of the GDPR with this...

In this podcast, the Data Privacy Detective talks about tech support scams with Michael Severini, Director of Information Security for one of America’s large law firms, Frost Brown Todd LLC. A tech support scam can start with a phone call claiming to provide computer support and security. But increasingly this scam pops up when you click on a website and your screen freezes, with a warning page th...

The risk of the Internet of Things (IoT) is far more than a stolen credit card number or a banking loss. The risk could be mortal and pervasive if a critical device is hacked and a malicious command is issued through the IoT.

Phishing is an effort by cybercriminals to use bait in the guise of a familiar email address to hook you into revealing your sensitive information. This podcast tells a real story of two college professors who were initial victims of a clever evolution of a phishing scam.

On July 25, 2017, the FBI issued a TLP:AMBER alert on its Cyber Watch system about an elaborate cyber-criminal attack underway by sources believed to originate from Iran. The Alert lists about 200 domain names and IP addresses that individuals and businesses should avoid. The Alert lists four actions that all persons and businesses should take to avoid being harmed, not only by this attack, but to...

Very private information about us can be extremely useful for medical research and other noble purposes – such as medical data that can be aggregated into a big database to help control and combat disease. But we’re reluctant to share our health and genetic details if we can be identified individually. How can we contribute to the big data need of public health and still preserve our individual pr...

The Data Privacy Detective talks about facial recognition technology, how it affects our privacy and what rights we have to fair use by the government. This episode will acquaint you with FIPPs and a law meant to ensure fair use by government on passports, videotapes and other images of our persona.

So what can you do yourself to protect your personal data and the confidential information of your company or employer? Julia Montgomery of Traveling Coaches shares top tips on how to protect confidential and personal data.

John Hibbs, Chief Information Security Officer for J.P. Morgan Chase, gave a riveting talk in Chicago in the fall of 2016 about the devices that tempt us to spend our waking hours giving them attention. He began with a challenge I readily accepted - that humans are not good at guarding their data privacy. Technology is too strong and changing too quickly to keep up with. Nonetheless, there are cho...

Personal data is vast and expanding exponentially. And the means of combing through vast quantities of digital data is becoming easier and quicker than ever, with human beings linked to each other on a global scale never before possible. At an October 1, 2016, conference in Luxembourg, French attorney Olivier Saumon cited industry projections that by 2020 the world will have 50 billion connected d...

A 2014 European Court of Justice decision against Google made Google the decision maker about whether to delink its search engine from sites that infringed the rights of European citizens – and raises the issue whether one government can set the rules of privacy worldwide. The intricacies of the case provide one glimpse into the evolving global battle over data privacy that faces technology provid...

Privacy is dead, get over it. This is what a blockchain entrepreneur told a conference at the European Court of Justice on September 30, 2016. And yet, we know this is not true. If privacy were dead, we would know all the details of Donald Trump’s tax returns and we would have access to every email of Hillary Clinton from both public and private servers while she was Secretary of State. And we don...