European Parliament reprimanded by Data Protection Supervisor

The European Data Protection Supervisor (EDPS) has launched a data protection probe into the European Parliament for continued work with a US firm.

The firm in question, NationBuilder, processes data collected though websites run by the European Parliament for citizen engagement, though it has fallen short of European standards on data protection and privacy. This is the second reprimand handed to the European Parliament concerning NationBuilder.

The website placed under current scrutiny, thistimeimvoting.eu, collected personal data from more than 329,000 people who had an interest in European Parliament elections.

“Strong data protection rules are essential for democracy, especially in the digital age,” said Assistant EDPS Wojciech Wiewiórowski.

“They help to foster trust in our institutions and the democratic process, through promoting the responsible use of personal data and respect for individual rights. With this in mind, starting in February 2019, the EDPS acted proactively and decisively in the interest of all individuals in the EU to ensure that the European Parliament upholds the highest of standards when collecting and using personal data.”

Although the details are relatively thin for the moment, the EDPS has issue involving the selection and approval of sub-processors used by NationBuilder. The sub-processors have not been named, though the EDPS has stated Article 29 of Regulation (EU) 2018/1725 are the rules in question.

Considering Europe’s position atop the data protection and privacy high-horse, this should be seen as quite an embarrassing incident. The European Parliament has taken a very condemning approach to those who flirt with data protection and privacy regulations, most notably Facebook and Cambridge Analytica. With this announcement from the EDPS, it does not appear the bureaucrats are listening to their own condemning words.

The collection and application of personal information surrounding elections is of course a very relevant topic today, not only because of numerous scandals and accusations, but also some very high-profile events on the horizon. Not only is the UK’s General Election taking place in a matter of weeks, the threat of a second Brexit referendum is a possibility, while campaigning for the US Presidential Election will hit full-steam over the next couple of months.

Posturing and rhetoric regarding the importance of data privacy and the application of data analytics in a responsible manner are more prominent than ever, but it seems to be nothing more than statements of intent. Data protection and privacy scandals will perhaps never be a thing of the past.

Microsoft might be toying with European data protection compliance

The European Data Protection Supervisor has raised ‘serious concerns’ over whether Microsoft is compliant with data protection regulations.

The contracts in question are between the software giant and various European Union institutions which are making use of said products. The central issue is whether contractual terms are compliant with data protection laws intended to protect individual rights across the region from foreign bodies which do not hold data protection to the same standards.

“Though the investigation is still ongoing, preliminary results reveal serious concerns over the compliance of the relevant contractual terms with data protection rules and the role of Microsoft as a processor for EU institutions using its products and services,” a statement reads.

“Similar risk assessments were carried out by the Dutch Ministry of Justice and Security confirmed that public authorities in the Member States face similar issues.”

The preliminary findings from the European Data Protection Supervisor follow on from investigations taking place in the Netherlands and also changes to the Microsoft privacy policies for its VoIP product Skype and AI assistant Cortana. The changes were seemingly a knee-jerk reaction to reports contractors were listening to audio clips to improve translations and the accuracy of inferences.

What is worth noting is that Microsoft is not the only company which has been bending the definition of privacy with regard to contractors and audio clips. Amazon and Google have also been dragged into the hazy definition of privacy and consent.

The issue which seems to be at the heart of this investigation is one of arm’s length. While government authorities and agencies might hand-over responsibility of data protection and privacy compliance to the cloud companies, the European Data Protection Supervisor is suggesting more scrutiny and oversight should be applied by said government parties.

Once again, the definition and extent of privacy principles are causing problems. Europe takes a much more stringent stance on the depth of privacy, as well as the rights which are affording to individuals, than other regions around the world. Ensuring the rights of European citizens are extended elsewhere was one of the primary objectives of the GDPR, though it seems there are still teething problems.

“When using the products and services of IT service providers, EU institutions outsource the processing of large amounts of personal data,” the statement continues.

“Nevertheless, they remain accountable for any processing activities carried out on their behalf. They must assess the risks and have appropriate contractual and technical safeguards in place to mitigate those risks. The same applies to all controllers operating within the EEA.”

One development which could result in additional scrutiny is The Hague Forum, an initiative to create standardised contracts for European member states which meet the baseline data protection and privacy conditions set forward. The European Data Protection Supervisor has encouraged all European institutions to join the Forum.

Although GDPR was seen as a headache for many companies around the world, such statements from the European Data Protection Supervisor proves this is not an area which can simply be addressed once and then forgotten. GDPR was supposed to set a baseline, and there will be more regulation to build further protections. Perhaps the fact that Microsoft is seemingly non-compliant with current regulations justifies the introduction of more rules and red-tape.