Archive

Posts Tagged ‘Law’

What to do in case of credit/payment card fraud: real life example!

This weekend E-Crime Expert encountered a financial fraud which happened to us in real life. Money was fraudulently withdrawn from our (Dan’s) account. Luckily, we immediately identified the fraud which enables us to cancel the card and report the fraud in order to be reimbursed.

1.      How it could be detected:

i. Go log into your online banking account (Fig. 1)

(I am using a mobile platform for my online banking)

Fig. 1.

photo 1

ii. Type your user name or card number and password (Fig. 2)

 Fig. 2

photo 2

iii. Select one of your accounts and then go through your transaction records carefully and see if there is any transaction you do not recognize (this is how I identified the fraud in my VISA account).Fig. 3.

Fig. 3

photo 3

iv. Most likely the fraudulent transaction will be from a service provider or vendor that you had nothing to do with it (as it happened in my case) Fig. 4.

 Fig. 4

photo 4

2. What to do if you suspect fraudulent activity:

 Despite your best efforts, there is still a chance that you will become a victim of payment card fraud. You will save yourself time and worry by following the steps below:

  • Call your financial institution immediately. You can find the phone number easily on the back of your card (Fig. 5).

Fig. 5 photo 5

 It may want to cancel your current card and mail you a new one. Check to verify that your mailing address has not been changed.   

  • If you still have your card, but fraudulent purchases have been made on the account, call your financial institution, and ask them to issue you a new one.   
  • Contact the national credit bureaus to let them know you are a victim of fraud. They will place a “Fraud Alert” on your file. You can also request copies of your credit report, which you should review carefully. For North America:                                   Equifax: 1-800-465-7166 or www.equifax.ca
                                                                                TransUnion: 1-866-525-0262 or www.tuc.ca
  • Diligently check your statements in the following months to make sure the problem has been completely resolved.
  • Report the fraudulent activity to the proper authorities, including the police or to the Internet Crime Complaint Center:

i. Mastercard:

To successfully fulfill your mission of how to contact MasterCard fraud,

  • you can call 800-627-8372.
  • If you’re not in the United States, contact MasterCard fraud by calling 636-722-7111.
  • If it’s an emergency related to possible fraud, MasterCard will accept international collect calls.

ii. Visa:

  • Call the bank or other organisation that issued your card, if you know the telephone number. They will immediately block your card and organise a replacement
  • If you do not have your card issuer’s telephone number, use the menu on the Global Card Assistance Directory page for help. 

To use the Global Card Assitance Service Directory Click here.

From the pull-down menu choose the country you are in now. Call the telephone number that appears in the right-hand box. Calls might be free but may carry local telecom fees if one dials using a mobile phone or calls from within a hotel.

If outside the US please make a reverse-charge call to +1 303 967 1096, if within the US, simply dial +1 800 847 2911.

3.  What you need to be prepare to provide when calling:

  • The name of your card issuer
  • The type of card — for example, Visa Electron, Visa Classic, Visa Gold
  • The country where the card was issued

It will help if you can also tell them:

  • Your 16-digit Visa/MasterCard account number
  • If you have your own card account or a partner card
  • Your name as it is printed on the card
  • The address where your statement is sent
  • Your home telephone number
  • How the card went missing or what transaction you find illegitimate
  • Other personal details that will be used as a security check to confirm your identity
  • The identity of the primary cardholder, if you are the secondary cardholder.

4. Tips to stay safe:

i.                    How to prevent identity theft

Identity theft involves acquiring another person’s identification information (such as a social insurance number or any unique identifier) without a person’s knowledge for the purpose of impersonating him or her to commit fraud. The best defense against identity theft is to prevent thieves from getting the information in the first place.

Here are guidelines to follow:

  • Never leave your purse or wallet unattended – keep your personal data and information guarded at all times.   
  • Sign your credit and debit cards in permanent ink as soon as you receive them.   
  • Call your card issuer if a new or reissued card does not arrive when expected.   
  • Don’t carry your social insurance card, birth certificate, or passport in your wallet or purse unless it’s absolutely necessary. Cancel any inactive payment card accounts.   
  • Never throw away receipts in a public trash container. When disposing of receipts or old statements, be sure to destroy the areas where the account number is visible. In general, you should keep all your receipts in a safe place to refer to if you suspect suspicious activity.
  • Check your statements frequently and carefully. Be sure you are familiar with all account activity on the statement. If you find an unauthorized or questionable transaction, call the appropriate organizations immediately.
  • Do not write your credit or debit card account number on a cheque, or use it for identification when paying by other means.
  • If your social insurance card or driver’s license is missing, contact the appropriate agency immediately.
  • Never give any payment card, bank, or social insurance information to anyone by telephone, even if you made the call, unless you can positively verify that the call is legitimate and there is a true need for the information.
  • Keep a list of all your credit accounts and bank accounts in a secure place so you can quickly call the issuers to inform them about missing or stolen cards. Include account numbers, expiration dates, and telephone numbers of customer service and fraud departments.
  • Make a note of when your financial statements arrive each month. If your statements stop arriving, contact your bank immediately.
  • Obtain a copy of your credit report once a year from one of the national credit bureaus. You are entitled to a free copy of your report if you are denied credit. Otherwise, most credit bureaus will charge a small fee. If the report data is incorrect, write the credit bureau immediately and keep a copy of your letter.

 ii.                  How to prevent fraud while using your payment card

Payment cards are used everyday by billions of people throughout the world. By following the steps below, you will significantly reduce the chances of fraudulent activity occurring on your account:

  • When making a purchase, keep your card in view at all times. Retrieve the card as soon as the transaction is complete and make sure it is yours.
  • Memorize your passwords and personal identification numbers (PINs) so you do not have to write them down. Be aware of your surroundings; make sure no one is watching you input your PIN.
  • Never sign a blank receipt slip. Draw a line through any blank amount lines that appear above the total amount line.
  • Save all of your receipts so you can refer to them at a later time. Never discard your receipt in a public trash container.
  • Do not provide your account number over the phone unless you are positive the call is legitimate and there is a legitimate purpose to disclose your account number. Never provide your number over the phone if you didn’t initiate the call.
  • Avoid saying your account number aloud at a merchant location or over the phone if others can hear.

iii.                How to prevent fraud while shopping online

Shopping online opens up a world of choices and convenience – as well as some risks that require extra vigilance. Here are some tips to ensure that your online shopping experience remains safe and enjoyable:

  • Make sure you are doing business with a reputable Internet merchant. Check with the Better Business Bureau or provincial and local consumer agencies to find out about past complaints or experiences from other customers. You can also look for the following information on the website to check if a merchant is reputable:
    • Privacy policy – A reputable website often has a clearly stated privacy policy in an accessible place. Read the privacy policy so you know exactly how the merchant intends to use your information.
    • Information about the offer – make sure you learn all you can about the offer, including the delivery date, terms of warranty, cancellation policies, how to contact the company if you have questions, etc.
    • Information about the merchant – make sure to find the company’s physical address and telephone number.
    • Security – Reputable websites often provide information about how they protect your financial information when it is transmitted and stored.
  • Guard your personal information. Don’t provide information that you are uncomfortable giving. Never give anyone the password that you use to log on to your Internet Service Provider or online bank account.   
  • Keep records. Print out all information about your online transaction and keep it in a safe place to refer to at a later time.   
  • Pay with a payment card – as this is often the safest way to pay online. In North America, the cardholder has the right to dispute charges if the goods or services were misrepresented or never delivered. Also, you are not responsible for fraudulent purchases made on your account.   
  • Make sure the merchant that you are dealing with has proper security measures in place. Your computer browser can tell you if the place where you are about to send the information is secure. Look for an unbroken key or closed lock at the bottom of the browser window. If you cannot determine this, do not put your credit or debit card information over the Internet.
  • Hover the weblink on the browser you are using to see if there is no hidden link from a fake or illegitimate cloned website.

iv.                 Setting up your best security for your Visa Card:

Visa has developed several layers of fraud prevention and detection systems and programs, giving you multiple checkpoints for security to protect your business and make transactions more secure. Visa’s Layers of Security complement each other and work together, so by implementing multiple services you can help reduce your risk of fraud.

The Layers of Security:

Layer # 1 – Chip & PIN

Many Visa cards now contain a micro-computer chip that securely stores encrypted information to complete transactions. As well, Personal Identification Numbers (PINs) are used for cardholder authentication when chip cards are used in Canada. This helps make counterfeiting virtually impossible.

Layer # 2 – Verified by Visa

The Verified by Visa (VbV) program is a worldwide service that confirms a cardholder’s authenticity in real time. This helps protect merchants from fraudulent transactions and chargebacks, while protecting cardholders from unauthorized use of their Visa cards.

Layer # 3 – Three-digit Code (CVV2)

The CVV2 is a three-digit security code on all Visa cards that helps ensure a customer making an online or phone purchase has a genuine Visa card in hand.

Layer # 4 – Address Verification Service (AVS)

When fraudsters try to order online, by mail or by phone, AVS can help stop them in their tracks. Account number information obtained from a receipt or a stolen card does not include an address or postal code. AVS checks a cardholder’s address and/or postal code against the card issuer’s records in real time, giving you the opportunity to stop a transaction if desired.

Layer # 5 – Visa Advanced Authorization (VAA)

Available through most card issuers, VAA lets you immediately identify and respond to emerging fraud patterns and trends. As transactions are processed through VisaNet® Advanced Authorization, VAA evaluates an authorization request data in real time and assesses and assigns a risk rating – helping you better identify potential fraud.

5.      Additional contact numbers for Canada only:

MasterCard Issuer Security Phone Numbers in Canada:

ATB Financial: 1-800-661-2266
BMO Bank of Montreal: 1-800-361-3361
Bridgewater Bank: 1-866-398-4404
Canadian Tire Bank: 1-800-459-6415
Capital One Canada: 1-800-481-3239
CIBC:   1-800-663-4575
Citibank Canada: 1-800-305-7259
Credit Union Electronic Transaction Services: 1-800-567-8111
Direct Cash Bank: 1-888-466-4043
GE Money Canada: 1-800-243-2222
HSBC Bank Canada: 1-866-406-4722
MBNA Canada: 1-800-379-2744
National Bank of Canada: 1-888-622-2783
Peoples Trust: 1-866-452-1138
President’s Choice Bank: 1-866-246-7262
RBC Royal Bank: 1-800-361-0152
Sears Canada: 1-800-288-9965
Walmart Financial Services Canada: 1-888-925-6218
Wells Fargo Financial: 1-888-295-0050
     

 If you have any question you could contact: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

Advertisements

Beyond Data Protection – published today!

January 31, 2013 Leave a comment

Dan Manolescu is glad to announce his contribution to the Beyond Data Protection book, published by Springer and available to the public from today, January 31, 2013. You could find Dan’s contribution under the “Data Protection Enforcement: The European Experience – Case Law” chapter.

 This book provides practical approach to address data protection issues in businesses and daily life. It also compares, contrasts and substantiates the different principles and approaches in Asia, Europe and America  and recommends leading best practices to practitioners and stakeholders based on divergent of technologies involved.

​I strongly recommend you to purchase this book considering the excellent material and contribution of several top scholars in the privacy and data protection fields.

You could find  more info about this book here.

cda_displayimage

This great opportunity would not have been possible without the tremendous work of Noriswadi Ismail, an excellent data protection and privacy scholar and practitioner. He is also the Mastermind behind Quotient Consulting, a boutique firm, which focuses on array of data protection and privacy consulting services such as: Data Diagnosis, Privacy Impact Assessment, Data Protection & Privacy Strategy, Training, Data Protection & Privacy Certification, Public & Private Consultations

In addition, Philipp Fischer’s contribution to this book is remarkable. Philipp is also an outstanding data protection and privacy scholar and professional and he is the CEO of SuiGeneris Consulting, which provides privacy and data security practice, data-use business models and how data flows generate profits. He has extensive underlying subject matter experience at the interface between information security requirements, data protection & – privacy law and economics; especially in information security, quality management, consumer protection, intellectual property, software programming and risk assessment. That enables him to provide strategic business consulting on all aspects of information policy, including privacy, information security and records management.

Last but not least, E-Crime Expert signed  strategic partnerships with Quotient Consulting (with subsidiary in London, UK), and withSuiGeneris Consulting (based in Munich, Germany).

 If you have additional questions, please contact us: dan@e-crimeexpert.com

Privacy versus Data Protection

November 27, 2012 6 comments

Today, E-Crime Expert presents the main similarities and differences between privacy and data protection concepts mainly from two different legislative perspectives:  Canada and the European Union (EU), and briefly from the United States (US).

Also, this blog post provides the main privacy and data protection legislative acts from Canada and EU as a useful resource for those interested or working in this field.

Last but not least, you could find bellow the full EU Data protection revision 2012 package.

I.      US versus EU versus Canada

-The United States (US) and European Union (EU) have different concepts regarding personal information and private data, such as Privacy in the US versus Data Protection in the EU.

US’s approach to privacy focuses on narrowly applicable legislation.

  • sector-based,
  • with a mix of legislation,
  • regulation and self-regulation,
  • focusing on the protection of personal information by specifically addressing a particular industry sector (i.e. medical information, online transactions, credit check, etc)
  • regulating data collected by the federal government

EU has a more comprehensive approach.

  • set of rights and principles for personal data treatment (processing),
  • without considering that the data is held in the public or private sector,
  • protects just natural persons not legal entities
  • the relation between data protection and the economic value as a proper balance between fundamental rights and free flow of information (which has economic value).
  • by granting data protection as a fundamental right, the aim is to protect the individuals but also to encourage the free flow of information, giving data subjects legal certainty and encouraging them to not negatively affect the exchange of information and data

-Canada – similar level of protection to the EU one.

  • Privacy is regulated by the government at the federal and provincial level:
    • The Privacy Act (federal level for private information held by the gov),
    • PIPEDA (federal level for private sector),
    • PIPA (provincial level for private sector, Alberta for example),
    • FOIP (provincial level for public sector, Alberta for example),
    • HIPA (federal level for health information),
    • HIA (provincial level for health information, Alberta for example)
  • The difference between Canada and EU
    • Canada’s legislation regulates both organizations and individuals privacy rights and access
    • EU’s legislation regulates the individuals’ rights (no organizations)
    • Canada gives to the individual the right to access their data or other individuals’ or organizations data along with their privacy protection right under the same Act (The Privacy Act, FOIP)
    • EU gives to the data subject the right to protection of their personal data under one single act (Directive 95) and to access data for public interest under the Transparency Regulation (1049)-no others personal data could be accessed in the private sector (just for law enforcement)
  • Canada enacted different acts for different data categories (private-PIPA, public-FOIP, health-HIA, children-Child, Youth&family enhancement act, etc)
  • EU has the same Legislative Act (e.g. Directive) but with different degrees of protection and limitations based on the data categories sensitivity (identification, medical, criminal, etc).
  • Canada sets forth a minimum time for information retention when EU sets forth a maximum time for data retention
  • in Canada information sharing is done based on Information Sharing Agreements (local, federal, international)
  • in EU the data transfer has three layers of protection for exchange locally within the same institutions, bodies, organizations, between EU member states, or internationally (with third countries).

 II.      Privacy versus data protection

  • The concept of privacy and data protection is not the same.
  • Data protection has a privacy dimension, but it is narrower in scope than the privacy concept, “as the privacy encloses more than personal data” (i.e. private life, private home, private correspondence, etc.)
  • From a different angle, it encloses a wider area, “since personal data are protected not only to enhance the privacy of the subject, but also to guarantee other fundamental rights, such as the right to freedom of expression, or the right to know what data is gathered about you,  to have access to your data, to ask for modification or deletion of your data, etc”
    • Furthermore, data protection gives individuals the right to know
  • What personal data is collected,
  • on what legal grounds,
  • how it is used, for how long it used and kept,
  • and by whom.
    • specifically grants data subjects with the rights to access, modify,   update or ask for deletion of such data

 III.      EU legislative framework

IV.      EU Data protection revision 2012 (to reflect the new technological developments and to provide a consistent legislative framework across EU):

Click here to access the new proposed EU Data Protection regulation

  • It was proposed a Regulation versus the existing Directive. A Regulation is better, as it is immediately and more uniformly implemented into the Member States national law.
  • Data subjects
    • increasing responsibility and accountability – companies would have to notify their clients of any theft or accidental release of personal data
    • clarifying that where someone’s consent is required before a company reuses their personal data, they need to give that consent explicitly – people would also have access to their own private data and be able to transfer it to another service provider more easily
    • reinforcing the ‘right to be forgotten’ – people will be able to have their personal data deleted if a business or other organization has no legitimate reasons for keeping it
    • applying EU rules when personal data is processed outside Europe – people would be able to involve the national data protection authority in their country, even when their data is processed by a company based outside the EU
    • People will have easier access to their own data and be able to transfer personal data from one service provider to another more easily (right to data portability). This will improve competition among services
  • Good for business
    • A single set of rules would encourage a more consistent application of the law across the EU. Businesses would have clear rules on how to treat personal data
    • Companies would only have to deal with a single national data protection authority in the EU country where they have their main operations (saving businesses an estimated €2.3bn a year)
    • The obligation of appointment of a data protection officer for organizations with 250 employees and over (private sector
    • Instead of the current obligation of all companies to notify all data protection activities to data protection supervisors – a requirement that has led to unnecessary paperwork and costs businesses €130 million per year, the Regulation provides for increased responsibility and accountability for those processing personal data
    • Companies and organisations must notify the national supervisory authority of serious data breaches as soon as possible (if feasible within 24 hours)
    • Organisations will only have to deal with a single national data protection authority in the EU country where they have their main establishment. Likewise, people can refer to the data protection authority in their country, even when their data is processed by a company based outside the EU. Wherever consent is required for data to be processed, it is clarified that it has to be given explicitly, rather than assumed
    • EU rules must apply if personal data is handled abroad by companies that are active in the EU market and offer their services to EU citizens
    • Independent national data protection authorities will be strengthened so they can better enforce the EU rules at home. They will be empowered to fine companies that violate EU data protection rules. This can lead to penalties of up to €1 million or up to 2% of the global annual turnover of a company
  • Better enforcement
    • The new rules would give national data protection authorities powers to enforce the EU rules more rigorously
    • A new Directive will apply general data protection principles and rules for police and judicial cooperation in criminal matters. The rules will apply to both domestic and cross-border transfers of data. For the new Directive click here.
  • Next steps
    • The proposals is aimed to encourage more online commerce by improving consumer trust – contributing to economic growth and job creation. The new Data protection proposed legal framework (Regulation+Directive) must be approved by the European Parliament and Council before becoming law.
  • Commission Proposals on the data protection reform: legislative texts

Source: Directorat General Justice of the European Commission

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog

EU Member States’ national Data Protection Laws

December 16, 2011 1 comment

As announced in the last blog post here, E-Crime Expert presents today the National Data Protection Legal Acts of each Member State as required by the implementation of the Directive 95/46. This could be helpful for anyone interested as there are significant differences among the Member States DP national legal frameworks, acquired during their implementation  process of  the Directive 95/46. In this regards, for a company running commercial activities in Belgium, their compliance when processing personal data in Belgium, should be subject to the Belgian DP national Law. The Directive 95/46 has no direct implication or relation to their processing operations in Belgium or in any other member States. This Directive sets forth the general European legal framework with the minimum protection requirements  for the national DP laws implemented by each member State in their own ways. Therefore, for any interested party, company or data subject, it is useful to know which DP Laws particularly applies when running businesses, doing electronic commerce or any other activities that require processing of personal data.

Transposition of the Directive 95/46 requirements into national laws.

Here you can find the national laws of each member state:

Austria

Data Protection Act 2000, Austrian Federal Law Gazette part I No. 165/1999

Belgium

Act of 8 December 1992

Royal Decree

Bulgaria

Personal Data Protection Act

Cyprus

The Processing of Personal Data (Protection of Individuals)
Law 138(I)2001

Czech Republic

Act on Protection of Personal Data (April 2000) No. 101

Denmark

Act on Processing of Personal Data, Act No. 429, May 2000.

Estonia

Personal Data Protection Act of 2003
 

Finland

 Personal Data Act (523/1999)

Act on the amendment of the Personal Data Act (986/2000)

France

Data Protection Act of 1978 (revised in 2004)

Germany

Federal Data Protection Act of 2001

Greece

Law No.2472 on the Protection of Individuals with Regard to the Processing of Personal Data, April 1997.

Hungary

Act LXIII of 1992 on the Protection of Personal Data and the Publicity of Data of Public Interests

Ireland

Data Protection Act 1988.

Data Protection (Amendment) Act 2003.

Italy

Data Protection Code of 2003

Processing of Personal Data Act, January 1997

Latvia

Personal Data Protection Law, March 23, 2000.

Lithuania

Law on Legal Protection of Personal Data (June 1996)

Luxembourg

Law of 2 August 2002 on the Protection of Persons with Regard to the Processing of Personal Data.

Malta

Data Protection Act (Act XXVI of 2001), Amended March 22, 2002, November 15, 2002 and July 15, 2003

The Netherlands

Dutch Personal Data Protection Act 2000

Poland

Act of the Protection of Personal Data (August 1997)

Portugal

Act on the Protection of Personal Data (Law 67/98 of 26 October)

Romania

Law No. 677/2001 for the Protection of Persons concerning the Processing of Personal Data and the Free Circulation of Such Data

Slovakia

Act No. 428 of 3 July 2002 on Personal Data Protection.

Slovenia

Personal Data Protection Act , RS No. 55/99.

Spain

ORGANIC LAW 15/1999 of 13 December on the Protection of Personal Data

Sweden

Personal Data Protection Act (1998:204), October 24, 1998

United Kingdom

UK Data Protection Act 1998

Privacy and Electronic Communications (EC Directive) Regulations 2003

E-Crime Expert would like to thank you for reading this Blog and to wish you Merry Christmas and a very Happy New Year! We’ll be back in the first week of January 2012.

Till then, stay safe!

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

EU National Data Protection Authorities

December 14, 2011 1 comment

Today, E-Crime Expert presents the contact details of all the (EU) National Data Protection Authorities in order to help citizens/users know where to address and complaint in case their fundamental right to the protection of personal data it is breached. This right is granted by the Charter of Fundamental Rights of European Union. Also, the Directive 95/46 sets forth the National Data Protection Authorities to protect the right to privacy and personal data of the data subjects.

Briefly, the main roles of National DPA are:

-Investigations

-Interventions

-Hear claims and engage in legal proceedings

-Advisory

-Awareness.

Here are listed the up-to-date contact details of all EU National EU DPAs:

Austria

Österreichische Datenschutzkommission
Hohenstaufengasse 3
1010 Wien
Tel.
+43 1 531 15 25 25; Fax +43 1 531 15 26 90
e-mail:
dsk@dsk.gv.at

Belgium

Commission de la protection de la vie privée
Rue Haute 139
1000 Bruxelles
Tel. +32 2 213 8540; Fax +32 2 213 8545
e-mail:
commission@privacy.fgov.be

Bulgaria

Commission for Personal Data Protection
Mrs Veneta Shopova
15 Acad. Ivan Evstratiev Geshov Blvd.
Sofia 1431
Tel. +3592 915 3531; Fax +3592 915 3525
e-mail:
kzld@government.bg, kzld@cpdp.bg

Cyprus

Commissioner for Personal Data Protection
Mrs Panayiota Polychronidou
1 Iasonos Street,
1082 Nicosia
P.O. Box 23378, CY-1682 Nicosia
Tel. +357 22 818 456; Fax +357 22 304 565
e-mail:
commissioner@dataprotection.gov.cy

Czech Republic

The Office for Personal Data Protection
Urad pro ochranu osobnich udaju
Pplk. Sochora 27
170 00 Prague 7
Tel. +420 234 665 111; Fax +420 234 665 444
e-mail:
posta@uoou.cz

Denmark

Datatilsynet
Borgergade 28, 5
1300 Copenhagen K
Tel. +45 33 1932 00; Fax +45 33 19 32 18
e-mail:
dt@datatilsynet.dk

Estonia

Estonian Data Protection Inspectorate
(Andmekaitse Inspektsioon)
Director General: Mr Viljar Peep (Ph.D)
Väike-Ameerika 19
10129 Tallinn
Tel.
+372 6274 135; Fax +372 6274 137
e-mail: viljar.peep@aki.ee

Finland

Office of the Data Protection
Ombudsman
P.O. Box 315
FIN-00181 Helsinki
Tel.
+358 10 3666 700; Fax +358 10 3666 735
e-mail:
tietosuoja@om.fi

France

Commission Nationale de l’Informatique et des Libertés
8 rue Vivienne, CS 30223
F-75002 Paris, Cedex 02
Tel.
+33 1 53 73 22 22; Fax +33 1 53 73 22 00

Germany

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Husarenstraße 30
53117 Bonn
Tel.
+49 228 997799 0 or +49 228 81995 0
Fax +49 228 997799 550 or +49 228 81995 550
e-mail: poststelle@bfdi.bund.de

Greece

Hellenic Data Protection Authority
Kifisias Av. 1-3, PC 11523
Ampelokipi Athens
Tel. +30 210 6475 600; Fax +30 210 6475 628
e-mail: contact@dpa.gr

Hungary

Data Protection Commissioner of Hungary
Parliamentary Commissioner for Data Protection and Freedom of Information: Dr András Jóri
Nádor u. 22.
1051 Budapest
Tel. +36 1 475 7186; Fax +36 1 269 3541
e-mail: adatved@obh.hu

Ireland

Data Protection Commissioner
Canal House
Station Road
Portarlington
Co. Laois
Lo-Call: 1890 25 22 31
Tel. +353 57 868 4800; Fax +353 57 868 4757
e-mail: info@dataprotection.ie

Italy

Garante per la protezione dei dati personali
Piazza di Monte Citorio, 121
00186 Roma
Tel.
+39 06 69677 1; Fax +39 06 69677 785
e-mail: garante@garanteprivacy.it

Latvia

Data State Inspectorate
Director: Ms Signe Plumina
Blaumana str. 11/13-15
1011 Riga
Tel. +371 6722 3131; Fax +371 6722 3556
e-mail: info@dvi.gov.lv

Lithuania

State Data Protection
Inspectorate Director: Mr Algirdas Kunčinas
Žygimantų str. 11-6a
011042 Vilnius
Tel. + 370 5 279 14 45; Fax +370 5 261 94 94
e-mail: ada@ada.lt

Luxembourg

Commission nationale pour la protection des données
41 avenue de la Gare
1611 Luxembourg
Tel.
+352 2610 60 1; Fax +352 2610 60 29
e-mail: info@cnpd.lu

Malta

Office of the Data Protection Commissioner
Data Protection Commissioner: Mr Joseph Ebejer
2, Airways House
High Street, Sliema SLM 1549
Tel. +356 2328 7100; Fax +356 2328 7198
e-mail: commissioner.dataprotection@gov.mt

The Netherlands

College bescherming persoonsgegevens
Dutch Data Protection Authority
Juliana van Stolberglaan 4-10
P.O. Box 93374
2509 AJ Den Haag/The Hague
Tel. +31 70 888 8500; Fax +31 70 888 8501
e-mail: info@cbpweb.nl

Poland

The Bureau of the Inspector General for the Protection of Personal Data
Inspector General for Personal Data Protection: Mr Wojciech Rafał Wiewiórowski
ul. Stawki 2
00-193 Warsaw
Tel. +48 22 860 70 81; Fax +48 22 860 70 90
e-mail: sekretariat@giodo.gov.pl

Portugal

Comissão Nacional de Protecção de Dados
R. de São.
Bento, 148-3°
1200-821 Lisboa
Tel. +351 21 392 84 00; Fax +351 21 397 68 32
e-mail: geral@cnpd.pt

Romania

The National Supervisory Authority for Personal Data Processing
President: Mrs Georgeta BASARABESCU
Str. Olari nr. 32
Sector 2, BUCUREŞTI
Cod poştal 024057
Tel. +40 21 252 5599; Fax +40 21 252 5757
e-mail: anspdcp@dataprotection.ro

Slovakia

Office for Personal Data Protection of the SR
President: Mr Gyula Veszelei
Odborárske námestie č. 3
817 60, Bratislava
Tel. + 421 2 5023 9418; Fax + 421 2 5023 9441
e-mail: statny.dozor@pdp.gov.sk or gyula.veszelei@pdp.gov.sk

Slovenia

Information Commissioner
Ms Natasa Pirc Musar
Vošnjakova 1
1000 Ljubljana
Tel.
+386 1 230 9730; Fax +386 1 230 9778
e-mail:
gp.ip@ip-rs.si

Spain

Agencia de Protección de Datos
C/Jorge Juan, 6
28001 Madrid
Tel. +34 91399 6200; Fax +34 91455 5699
e-mail:
internacional@agpd.es

Sweden

Datainspektionen
Drottninggatan 29
5th Floor
Box 8114
104 20 Stockholm
Tel. +46 8 657 6100; Fax +46 8 652 8652
e-mail:
datainspektionen@datainspektionen.se

United Kingdom

The Office of the Information Commissioner Executive Department
Mr Christopher Graham
Water Lane, Wycliffe House
Wilmslow – Cheshire SK9 5AF
Tel. +44 1 625 54 57 00

Stay posted as the next blog  post will bring you the individual EU National Data Protection legal act that transpose the Directive 95/46 into National Law.

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Do you have any complaint? Did you know where to address in case of DP breach?

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

Data protection glossary (part 3)

December 12, 2011 Leave a comment

This is the last post of a series brought you by E-Crime Expert, that aims to make the readers and data subject familiar to the most common terminology in order to better understand and protect their personal data and privacy.

You could read the first post here and the second post here.

(R) Reliability (Information Security)

Reliability is the property of consistent intended behavior and results.

Residual Risk (Information Security)

Residual risks are the risks that remain after risk treatment or, in other words, after protective measures were introduced.

Right of rectification

Anyone can have incorrect data relating to him rectified free of charge, and have other data erased if they are irrelevant, incomplete or prohibited, or have the use of those data prohibited. If the controller does not react, the data subject may address the Commission, which will attempt to mediate. The data subject may also submit a complaint to the judicial police.

Right to object

You may always object to the use of your data, provided that you have serious reasons for this. You cannot object to a data processing operation that is required by a law or a regulatory provision, or that is necessary to perform a contract you have entered into. However, you always have the right to object to the illegitimate use of your data and can always object free of charge and without justification if your data are processed for direct marketing purposes.

To object you have to send a dated and signed request, including a document proving your identity (for example a copy of your identity card) to the controller by letter or by fax (a request by e-mail is only accepted with an electronic signature). The request can also be submitted on the spot. The controller then has one month to reply. If he fails to do so or if his reply is not convincing, you can address the Commission, which will try to mediate. You can also take your case to court.

Risk (Information Security)

A risk is the potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organization (for example a virus deleting a file). It is measured in terms of a combination of the probability of an event and its consequence.

A risk is characterized by two factors: the probability that an incident will occur and the gravity of the potential direct consequences and the indirect impact.

The risk can also depend on time: the situation can become worse after an incident if adjusting measures are not taken in time (for instance a software glitch infecting a database, spyware retrieving passwords, encrypted codes or pin numbers). That way, an innocent incident can have disastrous consequences.

Risk Management (Information Security)

Risk management identifies the most important risks and distinguishes between the risks that have to be taken care of and acceptable risks. It uses security resources that deal with the dangers for personal data according to a scale of priorities. The risk management process constitutes a cycle that is repeated depending on the particular characteristics of the systems and the identified risks. Risk management results in final processes and an updated security policy, and often also in adaptations to the organization and its procedures in order to better take into account possible new risks, as well as the measures that have been taken.

(S) Safe Harbor Principles

In consultation with the European Commission, the American Department of Commerce elaborated the Safe Harbor Principles, intended to facilitate the transfer of personal data from the European Union to theUnited States. If companies make a statement to the American Department of Commerce agreeing with these principles and declaring they are prepared to respect them (meaning, among other things, that the American Federal Trade Commission can check whether theyr respect these principles), they are considered as companies ensuring adequate safeguards for data protection.

Security measures (Information Security)

Security measures, also called “protective measures” or “security controls”, are procedures or decisions that limit risks. Security measures can be effective in several ways: by lessening possible dangers, correcting vulnerabilities or limiting the possible direct consequences or indirect impact. It is also possible to work with time: if incidents are traced better and sooner, action can be taken before the situation gets any worse.

Sensitive data

Certain personal data are more sensitive than others. An individual’s name and address are rather innocent data, but this does not hold true for his political opinions, sexual preferences or judicial past. The Privacy Law regulates registration and use of those sensitive data more strictly in comparison with other personal data.

Sensitive data relate to race, political opinions, religious or philosophical beliefs, trade union membership, health, sex life, suspicions, persecutions and criminal or administrative convictions. In principle, processing such data is prohibited.

Standard Contractual Clauses

For persons wishing to transfer data outside the European Community, the European Commission has elaborated standard contractual clauses, which allow for a data transfer meeting the European legal conditions for data protection (article 25 ff of Directive 95/46/EC). In other words, the parties signing these contracts are considered as parties ensuring adequate safeguards for the protection of privacy.

(T) Threat (Information Security)

A threat is any unexpected event that can damage one of the enterprise’s assets and therefore prejudice personal data protection.

There are environmental threats (fire), technical threats (system failures) or human threats.
Human threats can be accidental (mistakes, forgetfulness, unadapted procedures) or intentional (harmful intent, intrusion, theft), internal (dissemination of information) or external (espionage).

(U) Unambiguous, free and informed consent

Consent is understood:

  • to have been freely given. In other words, the data subject was not pressurised to say “yes”;
  • to be specific, meaning that the consent relates to a well-defined processing operation;
  • to be informed. The data subject has received all useful information about the planned processing.

It is not necessary for the consent to be given in writing, but oral consent does create problems with the burden of proof in case of difficulties.

(V) Vulnerability (Information Security)

Vulnerability is the weakest link of an asset or a group of assets that can be exploited by one or more imminent dangers (developer’s mistake, wrong installation). In most cases vulnerability is due to the fact that an asset is not sufficiently protected, rather than to the asset itself.

Vulnerability in itself is not harmful to the organization. Only when an imminent danger can accidentally use the vulnerability and possible special circumstances, a damaging incident can occur.

Any questions can be submitted to: dan@e-crimeexpert.com

Additional information can be found at: www.e-crimeexppert.com

Are you used to this terminology? Do you find it useful?

Hit the “subscribe” button in order to be notified when new videos and Articles are posted on this blog.

%d bloggers like this: