July 2019 - nexa - server-nexa.polito.it

Schrems II will seriously stress test EU’s data privacy rules
by Alberto Cammozzo July 11, 2019

July 11, 2019

<https://www.irishtimes.com/business/technology/schrems-ii-will-seriously-st…> At long last, a critical Irish data privacy case this week wended its somewhat tortuous and costly way to the Court of Justice of the European Union (CJEU) in Luxembourg. Justices heard arguments in a full-day hearing on Tuesday in the so-called Schrems II case, which questions whether data transfer template agreements, called standard contractual clauses (SCCs), adequately meet Europe’s data protection laws. If CJEU justices believe they don’t, there’s every possibility the court could halt data flows from Europe to the US, and also between the EU and the UK if Britain finally brexits. Unimaginable? Blame the lack of imagination on the US (government, agencies and companies), which has for years ignored the letter of European data protection law and data transfer framework Safe Harbour, on the assumption that, first, they didn’t really mean what they purported to say and could be flexibly interpreted, and second, that the EU never really enforced them anyway (which, in fairness, seems to be the case). And then there was that third assumption laid bare by those awkward Snowden revelations: that EU protections didn’t apply to national security agencies conducting mass surveillance by indiscriminately sweeping up data from technology and social media companies. Along came a young Austrian lawyer and campaigner, Max Schrems, with a complaint to the Irish Data Protection Commissioner (DPC). He asked whether his Facebook data could be adequately safeguarded, given Edward Snowden’s disclosures. Vested interests The CJEU, in its first Schrems decision in 2015, thought not. This shocked, but only because the majority of vested interests hadn’t been paying attention. In another Irish-originating case brought by Digital Rights Ireland, the same court had already found in 2013 that EU states couldn’t just grab data and hang on to it for random periods, for no explicit purpose, just in case it might be useful someday. Schrems I invalidated Safe Harbour, and a new arrangement was needed. So we got the problematical Privacy Shield, which has not yet been tried in the CJEU’s crucible – though that, too, lies ahead, in a complementary case brought by three French data privacy groups. Meanwhile, after the conclusion of the first Schrems case, the DPC disclosed that Facebook actually used SCCs as a bespoke data protection equivalent to Privacy Shield. Schrems filed another complaint, this time focusing on whether these contract clauses could be adequately enforced. The DPC sought to get this referred to the CJEU. In doing so, the office decided on an approach that still baffles privacy specialists and lawyers: bringing the case to the commercial court, where cases can run up costs of about €1 million a week (a hefty bill for Irish taxpayers, when these observers feel other courts or possibly a direct referral should have worked); and making Max Schrems the defendant, alongside Facebook, in his own complaint, leaving him potentially exposed to those costs. This sets an alarming precedent: if a complainant could be made a defendant, anyone filing a complaint with the Irish DPC – the regulator for just about every significant data-ingesting multinational – could risk liability for costs. Eventually, Schrems was indemnified against costs, but the DPC’s office has yet to justify a route that has introduced a financial chilling effect on anyone considering privacy complaints. In the end, the CJEU referral was forthcoming, despite an Irish Supreme Court appeal by Facebook. At Tuesday’s hearing, however, some participants questioned why the referral was made in the first place by a DPC who, they argued, could have taken a decision herself. But, given ongoing uncertainty about the solidity of Privacy Shield or SCCs, the newness of the GDPR, and lack of procedural clarity, a referral in this important case was possibly a better route, as Castlebridge privacy consultant Daragh O Brien argued in a blog post. [...]

1 0

Can we talk in confidence? The death of candour in the age of surveillance | World news | The Guardian
by Alberto Cammozzo July 11, 2019

July 11, 2019

<https://www.theguardian.com/world/2019/jul/11/can-we-talk-in-confidence-the…> "Dance like no one is watching,” the American journalist Olivia Nuzzi wrote in 2014. “Email like it may one day be read aloud in a deposition.” Nuzzi’s advice could have saved Kim Darroch an awful lot of trouble. The UK ambassador to the US has just been forced to resign after describing Donald Trump and his administration as “inept” and “uniquely dysfunctional” in diplomatic memos that were subsequently leaked to the Mail on Sunday. Darroch’s crime is hardly one of inaccuracy. The only person in the world who seems to disagree with the ambassador’s assessment is Trump himself, who called the civil servant “wacky” and “very stupid” in a dysfunctional series of tweets on Tuesday. But there is no denying that the memos were, well, not particularly diplomatic. An important skill of an ambassador to the US is to balance two competing requirements: to honestly report to your superiors the fact that the president is inept, while remaining chummy with the inept president. Darroch is not the first person to face trouble over seemingly private thoughts becoming public. Emails get hacked and published (awkward revelations, Donna Brazile); microphones thought to be turned off are actually broadcasting (better apologise, Gordon Brown); documents get released under freedom of information or data protection laws (be more circumspect, GCHQ); old blogposts are rediscovered in a new light (get deleting, Ben Bradley) … the list seems never-ending. [...] The death of frankness is one symptom of the wider dearth of ambient privacy in our daily lives. The cheery Silicon Valley surveillance state that prevents us from speaking plainly in private is the same one that requires us to warn our children – or be warned by our parents – not to post things online that might harm employment prospects, and the same one that ensures we vet every utterance to make sure that it doesn’t take on some darker meaning outside of the context in which it was presented. There is no external agent mandating this self-censorship, at least not in the west: in China and Saudi Arabia, Cegłowski notes, the same capacity is used as a tool of social control. In the UK and the US, “We’re using it to show ads. But the infrastructure of total surveillance is everywhere the same, and everywhere being deployed at scale.” [...]

1 0

Re: [nexa] Cloud, Germania a lavoro per piattaforma nazionale: Sovranità tecnologica
by Diego Giorio July 10, 2019

July 10, 2019

Dalla mia relazione ad e-privacy del 2017, parlando del sistema di conservazione degli Enti Pubblici; naturalmente è un discorso valido anche per le imprese, anche se preferirei tenere separati i due aspetti. Mi fa piacere vedere che non sono il solo a pensarla in un certo modo, e spero che non resti un caso isolato nel panorama europeo Eppure in molti documenti, raccomandazioni, linee guida, si continua a parlare di cloud in modo astratto e generico. Viene dunque spontaneo chiedersi: se già ci sono le norme e le strutture, perché non potenziarle ed estenderle ad un backup completo dei dati digitali dell’intero Ente? Perché lasciare questi data center ai privati e non realizzare dei data center statali o europei espressamente dedicati alle pubbliche amministrazioni, dove conservare i dati in tutta sicurezza? Sicurezza intesa a 360°, quindi sia nei confronti del disaster recovery che di una conservazione di dati pubblici esclusivamente presso strutture pubbliche sicure e riservate. Saluti a tutti D. ________________________________ From: nexa <nexa-bounces(a)server-nexa.polito.it> on behalf of J.C. DE MARTIN <demartin(a)polito.it> Sent: Wednesday, July 10, 2019 6:12 PM To: Center Nexa Subject: [nexa] Cloud, Germania a lavoro per piattaforma nazionale: Sovranità tecnologica https://www.key4biz.it/cloud-la-germania-allopera-per-la-piattaforma-nazion… (Sent from my wireless device; please excuse brevity and typos (if any)) _______________________________________________ nexa mailing list nexa(a)server-nexa.polito.it https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

2 1

Cloud, Germania a lavoro per piattaforma nazionale: Sovranità tecnologica
by J.C. DE MARTIN July 10, 2019

July 10, 2019

https://www.key4biz.it/cloud-la-germania-allopera-per-la-piattaforma-nazion… (Sent from my wireless device; please excuse brevity and typos (if any))

2 1

L’intelligenza collaborativa come chiave per la trasformazione digitale dei processi HR
by don Luca Peyron July 10, 2019

July 10, 2019

Il digitale e le sue conseguenze antropologiche e sociali... una chiave di lettura interessante. Buona lettura dl https://marcominghetti.nova100.ilsole24ore.com/2019/07/09/lintelligenza-col… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

Brazil to add digital data protection to fundamental rights
by Giacomo Tesio July 10, 2019

July 10, 2019

https://www.zdnet.com/article/brazil-to-add-digital-data-protection-to-fund… The Brazilian Senate has approved a proposal to add protection of data in digital platforms to the list of fundamental rights and individual citizen guarantees set out in the country's constitution. According to senator Simone Tebet, rapporteur of the proposal - which will now be voted by the lower house of the National Congress - the federal government should be responsible for legislation. She noted that adding the topic to the constitution demonstrates central government recognizes the importance of the topic. "State and society should be entitled, as a general rule, to knowledge about each other, as long as there is a real need. Other than that, data privacy should be preserved as much as possible," Tebet added. Brazil's general data protection law was due to go live in February 2020 but a stopgap measure signed by former president Michel Temer just before leaving office in January 2019 has extended the deadline to August next year. Earlier this year, the National Authority for Personal Data Protection has also been created , with attributions including the creation of frameworks on how to handle information and guide organizations on how to adhere to the rules. The authority will also be responsible for monitoring and applying fines to non-compliant organizations. The new developments emerge among new public concerns around digital privacy sparked by a series of reports published by news website The Intercept. The reports cast doubts on the integrity of the main actors of Operation Car Wash, a major investigation into money laundering in Brazil. The website obtained, from an anonymous source, what it described as an "enormous trove" of text and audio communication carried out over messaging service Telegram, as well as video and other digital information, exchanged between federal prosecutors and the main judge in the investigation, Sergio Moro. Moro, now the country's justice minister, has since denied wrongdoing and in a statement has condemned "the distorted and sensationalist diffusion of supposed messages obtained by criminal means".

1 0

Google And Facebook To Build Own Undersea Cables Around Africa
by J.C. DE MARTIN July 9, 2019

July 9, 2019

https://www.forbes.com/sites/tobyshapshak/2019/07/03/google-and-facebook-to… (Sent from my wireless device; please excuse brevity and typos (if any))

2 1

L'intelligenza artificiale, il volto del nuovo antiumanesimo
by don Luca Peyron July 8, 2019

July 8, 2019

Per il filosofo Éric Sadin «saremo chiamati sempre meno a dare istruzioni alle macchine e sempre più a riceverle da loro. Così l’intelligenza artificiale mina il nostro diritto a determinarci» *Alcuni spunti interessanti, buona lettura* *Dl* https://www.avvenire.it/agora/pagine/lintelligenza-artificiale-il-nuovo-ant…

5 4

Call for tenders: Exploratory Study on Governance and Accountability Mechanisms for Algorithmic Systems
by Andrea Glorioso July 8, 2019

July 8, 2019

FYI https://ec.europa.eu/digital-single-market/en/news/call-tenders-exploratory… This study is part of the second phase of a pilot project on algorithmic awareness. Deadline of the call for tenders is 16th September 2019. The tender is part of the Algorithmic Awareness Raising pilot project <https://ec.europa.eu/digital-single-market/en/algorithmic-awareness-building> the Commission is carrying out at the request of the European Parliament. The first step of the project is ongoing, and interim results of the study are regularly published for consultation and information at www.AlgoAware.EU <http://www.algoaware.eu/>. The project has analysed the state-of-the-art in algorithmic decision-making, including academic literature and an index of policy, regulatory, civil society and industry approaches, and is exploring case studies for specific areas of application. The study will converge towards designing an appropriate ‘policy toolbox’ for the concerns and opportunities emerging. Building on the first study, the second phase of the project and this call for tenders in particular will focus more in detail on two emerging policy tools for addressing risks and furthering the understanding of algorithmic decision-making systems. Specifically, it will focus on exploring future policy tools for regulatory oversight of algorithmic systems, where appropriate, and design a series of prototypes and model technical approaches to address specific issues in algorithmic decision-making in the context of online platforms. The findings are expected to inform the Commission, as well as other interested policy and regulatory bodies, on the opportunities and pitfalls of such approaches and to inform policy options in the near- and longer-term. The call for tender therefore includes two specific studies (i.e. lots), and tenderers are free to apply for one or both lots: Lot I: Design and document the feasibility of a range of options for meaningful oversight over algorithmic decision-making processes on online platforms. Lot II: Prototype technical tools and analytical models for testing, explaining and/or auditing specific algorithmic processes used on online platforms, in support to such oversight. The maximum amount allocated to the study is EUR 120 000 for Lot I, and EUR 180 000 for Lot II. The closing date of the call is 16 September 2019 at 16:00. The detailed tender specifications and more information about the procedure and eligibility conditions are available on TED <https://etendering.ted.europa.eu/cft/cft-display.html?cftId=4908>. For questions and clarifications, please also use the online interface <http://etendering.ted.europa.eu/cft/cft-questions.html?cftId=4908>. TED LINK https://etendering.ted.europa.eu/cft/cft-display.html?cftId=4908

1 0

GAO reports di un qualche interesse
by Diego Latella July 8, 2019

July 8, 2019

Nuclear Weapons: Additional Actions Could Help Improve Management of Activities Involving Explosive Materials GAO-19-449, June 17 Report: https://www.gao.gov/products/GAO-19-449 <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Highlights: https://www.gao.gov/assets/700/699767.pdf <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Critical Infrastructure Protection: Key Pipeline Security Documents Need to Reflect Current Operating Environment GAO-19-426, June 5 Report: https://www.gao.gov/products/GAO-19-426 <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Highlights: https://www.gao.gov/assets/700/699512.pdf <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Information Technology: Implementation of GAO Recommendations Would Strengthen Federal Agencies' Acquisitions, Operations, and Cybersecurity Efforts GAO-19-641T, June 26 Testimony: https://www.gao.gov/products/GAO-19-641T <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Highlights: https://www.gao.gov/assets/710/700020.pdf <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Face Recognition Technology: DOJ and FBI Have Taken Some Actions in Response to GAO Recommendations to Ensure Privacy and Accuracy, But Additional Work Remains GAO-19-579T, June 4 Testimony: https://www.gao.gov/products/GAO-19-579T <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Highlights: https://www.gao.gov/assets/700/699488.pdf <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImRpZWdvLmxhdGVsbGFAY25y…> Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat

1 0