Tommaso G.

#PanettaTechNews: Notes from the IAPP Europe by Rocco Panetta #Italy's data protection authority, the Autorità Garante per la protezione dei dati personali, should be acknowledged for its willingness to bring privacy out of the confines of conferences and the façade of privacy policies. The DPA is touring the country to introduce privacy to the general public and is to be praised for its start from the south of Italy and the Italian islands — places we remember for holidays, but which sometimes struggle to have important institutional speakers from the public and private sectors. The initiative follows a commitment from last year's so-called Pietrarsa Manifesto, when the Garante brought together professionals, including myself, Italian and multinational companies and stakeholders, to commit to promoting privacy, explaining it wanted to take digital awareness and knowledge of personal data use rights beyond conferences. Keep reading on IAPP - International Association of Privacy Professionals: https://lnkd.in/epCQpauJ

15

𝐆𝟕 𝐑𝐨𝐮𝐧𝐝𝐭𝐚𝐛𝐥𝐞 𝟐𝟎𝟐𝟒: 𝐒𝐡𝐚𝐩𝐢𝐧𝐠 𝐭𝐡𝐞 𝐅𝐮𝐭𝐮𝐫𝐞 𝐨𝐟 𝐀𝐈 𝐚𝐧𝐝 𝐏𝐫𝐢𝐯𝐚𝐜𝐲 The 4th G7 Data Protection Authorities (DPA) Roundtable, hosted by the Italian Data Protection Authority was a global collaboration of regulators addressed key challenges in data protection and the responsible development of AI. 𝐊𝐞𝐲 𝐏𝐨𝐢𝐧𝐭𝐬: o Focus on Data Free Flow with Trust (DFFT), the impact of emerging technologies, and enforcement cooperation. o Adoption of the "Statement on the Role of DPAs in Fostering Trustworthy AI", emphasizing the need for AI technologies to align with data protection laws. o Urgent call for protecting children's privacy with the "Statement on AI and Children", highlighting the need to safeguard the most vulnerable from the potential harms of AI. 𝗪𝗵𝘆 𝗜𝘁 𝗠𝗮𝘁𝘁𝗲𝗿𝘀:  As AI technologies rapidly evolve, ensuring they are ethical, trustworthy, and compliant with global privacy standards is paramount. This year's G7 roundtable has underscored the crucial role of data protection authorities in shaping AI policies, promoting trust, and enforcing regulations. AI, with its transformative power, poses significant risks to privacy if left unchecked. The discussions also focused on the importance of secure cross-border data transfers, reaffirming the G7’s commitment to ensuring robust privacy protections in an increasingly interconnected world. Data protection authorities will play a pivotal role in ensuring that AI technologies respect privacy rights and are developed in line with ethical standards. With the rise of AI, safeguarding children's data has become a pressing issue. The G7's call to action emphasizes the urgency of developing policies that prioritize their protection. The 2024/2025 Action Plan highlights the importance of international collaboration to address the complex challenges posed by technological advancements. This includes promoting consistent regulatory approaches to data protection across borders. #PrivacyMatters #G7Roundtable #AIRegulation #DataProtection #GlobalCooperation #TrustworthyAI #ChildrensPrivacy #TechEthics #DFFT #EnforcementCooperation https://lnkd.in/ddUqJJPU Disclaimer: The Content in this post is for informational purposes only derived from references and does not constitute any professional advice. We do not claim ownership of any data or Information referenced

2

Italian Data Protection Authority Garante Rolls Out Code of Conduct On February 14th, the Italian Data Protection Authority Garante issued a Code of Conduct (CoC) an ethical guidelines pertinent to job search agencies (APLs), signaling a pivotal development in the realm of data privacy regulations. 👉You can swipe right for detailed information about Italian Data Protection Authority Garante Rolls Out Code of Conduct and our reviews. Contributors: Doğaner DOĞANAY and Gonca A.

19

The Italian Data Protection Authority ("Garante") imposed a fine of €20,000 on the Lombardy Administrative Region, the data controller, for publishing the personal data of 732 employees and the sensitive personal data of one employee on its website in breach of the data minimization. The Administrative Region of Lombardy published on its website the personal data of approximately 732 employees (including health data of one employee). Garante received a complaint on this case from the trade union associations. The data controller stated in its defense that the data was shared on the basis of a legislative decree and in order to fulfill its transparency obligations. Garante considered that data processing by a public entity is only possible if it is necessary to comply with a legal obligation or for a task to be carried out in the public interest, but given the sensitivity of health data, the data controller violated the principle of data minimization. In addition, addressing the obligation to publish data in accordance with the principle of transparency, Garante emphasized that the legislation does not allow for the comprehensive publication of personal data, in particular details of the employment relationship, the income of each employee and possible legal proceedings. As a result, Garante fined the controller €20,000 for unlawful data processing. Details: https://lnkd.in/dqQu_58R

7

My notes from the IAPP - International Association of Privacy Professionals Europe digest on the latest developments and news from Europe and Italy in more details. Thanks Isabelle Roccia (CIPP/E) for inviting me to write this article and greetings to all our members around the world who will be reading it and enjoying it.

18

European Data Protection Board: Opinion 11/2024 on the use of #facial #recognition to streamline #airport #passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR In this Opinion, the Board assesses the compliance of the processing with the above mentioned GDPR provisions in the context of four specific scenarios. 📍The first scenario involves the storage of an enrolled biometric template in the hands of the individual, for example, on their individual device, under their sole control in order to authenticate (1:1 comparison) the passenger as they proceed through the above mentioned airport checkpoints. 📍 The second scenario involves the centralised storage, within the airport, of an enrolled biometric template in an encrypted form with a key/ secret solely in the passenger’s hands. This enables passenger authentication (1:1 comparison) as they proceed through the above mentioned airport checkpoints. The enrolment is valid for a given period, which, for example, could be up to one year after the last flight was taken up to the passport expiry date. 📍 The third scenario involves the centralised storage of an enrolled biometric template in an encrypted form within the airport under the airport operator’s control. This enables passenger identification (1:N comparison), as they proceed through the above mentioned airport checkpoints. The storage period in this scenario is typically 48 hours and the data is deleted once the plane has taken off. 📍 The fourth scenario involves the centralised storage of an enrolled biometric template in an encrypted form in the cloud under the control of the airline company or its cloud service provider. This enables passenger identification (1:N comparison) as they proceed through the above mentioned airport checkpoints. The storage period in this scenario can potentially be for as long as the customer holds an account with the airline company.

45

Today, our paper "Characteristics of Smart Contracts" has been published by the Bank of Italy as publication No. 863 (Italian only. English version to appear). This joint work with Banca d'Italia, Università degli Studi Roma Tre and Università Cattolica del Sacro Cuore provides a comprehensive overview of blockchain technology and its smart contract applications. I contributed to Part II - Technological Profiles and Part III - Smart Contracts Taxonomy. In Part II, we define key characteristics of blockchains and develop a methodology to identify application trade-offs. Part III offers a detailed taxonomy of smart contract platforms, highlighting differences in their capabilities and designs. This part also examines the challenges and vulnerabilities of smart contract-based applications in traditional systems. We hope this paper will serve as a valuable resource for understanding and advancing blockchain adoption in the institutional landscape. https://lnkd.in/d79aJA2N

60

6 commenti

Italy's Data Protection Authority (the Garante) has issued a warning to Worldcoin, an iris biometric cryptocurrency project, regarding the risks of mishandling biometric data, particularly in the workplace. This emphasises the importance of compliance and employee rights protection. 🔒🔍 Companies like Worldcoin must prioritise proper data handling to uphold privacy standards and legal obligations. Learn more about the Garante's warning in the article below. #Privacy #DataProtection #BiometricData #Compliance #Worldcoin https://lnkd.in/eDbTkH-U

8

Another successful day with Giovanni Tummarello at #ISSWorldEurope assisting law enforcement with investigations and prevention strategies through Octostar Discover the most modern and flexible platform for comprehensive #investigative and #decision #intelligence data fusion: * Work on local files and records and scale seamlessly to petabytes of collected data with local or federated access. * Leverage dozens of out-of-the-box apps, integrating #SIGINT, #OSINT, #HUMINT, #ADINT, #Forensic, and #CYBER data sources and techniques.

33

1 commento

The Italian Data Protection Authority (#DPA), presented on July 3rd/ 2024 the Report on the activities carried out during the fourth year of the Board's mandate: "Relazione 2023 del Garante per la protezione dei dati personali". The Report outlines the various fronts on which the Authority has been engaged throughout a year marked by interventions in highly innovative areas: - #digitalization,  - #artificial #intelligence; - National Recovery Resilience Plan (#PNRR) as well as some constants: combating aggressive #telemarketing, paying particular attention to vulnerable individuals, and protecting #health data. On both fronts, which are interconnected, the Authority has always sought the difficult, sometimes arduous, balance of interests and rights at stake, continuing its task of protecting rights that are truly foundational to personal and social #freedom. Here is a summary of the main points covered in the report on the activities of the Data Protection Authority in 2023: 1. Interventions on innovative topics such as digitalisation, artificial intelligence and the National Recovery and Resilience Plan. 2. Focus on combating aggressive telemarketing, protecting vulnerable individuals and safeguarding health data. 3. Actions regarding generative AI, such as the temporary blocking of ChatGPT and the halt of Replika. 4. Activities related to the digitalisation of public administration and the justice system. 5. Interventions on the Electronic Health Record and telemedicine. 6. Attention to the use of biometric data and facial recognition systems. 7. Protection of minors online and combating phenomena such as revenge porn and cyberbullying. 8. Collaboration with other authorities on topics such as cybersecurity and whistleblowing. 9. Measures on data processing in employment relationships. 10. International activity, with participation in organisations such as EDPB, Council of Europe and OECD. 11. Activity statistics: 634 collegiate measures, response to over 9,000 complaints, 144 inspections, fines of approximately 8 million euros. 12. Focus on issues such as privacy and the right to report news, data breaches, and consumer protection. The report highlights the Authority's commitment on multiple fronts, balancing technological innovation and the protection of fundamental rights. 📌 Source: https://lnkd.in/di73iXht #Garante #ProtezionePrivacy #Italian #Italy #Privacy #DataProtection #UserRights

10

“Le mafie evolvono, si aggiornano anche e soprattutto tecnologicamente: per noi e le forze dell’ordine non è semplice seguirle e inseguirle, specie nel dark web, dove scambiano somme impressionanti di bitcoin e dove gestiscono ogni sorta di attività illecita”. Procuratore di Napoli Nicola Gratteri. At Jheronimus Academy of Data Science, we just finished the 4th edition of the Data Forensics course. Here, we try to shape a new generation of investigators who can think like criminals and intercept illegal activities. Students learn to use technologies like TOR, VPN, Whonix, and Tails to stay anonymous on the web. They are requested to manage concepts, tools, and technologies to crawl data from the dark web, bypass captchas and robots, find criminal activities, and build analyses to highlight illegal behaviors. If you want to know more about what we are doing during the course, I have left here the link to some projects presented and discussed during the course. All the data are from the Dark web, and all the analyses are based on true crimes. https://lnkd.in/dpkDiXsA #cybersecurity #darkweb #criminal #drug CybersecurityItalia Agenzia per la Cybersicurezza Nazionale #tgrleonardo Red Hot Cyber #darknet #internet #illicitmarketplaces #LawEnforcement #Encryption #PrivacyProtection #InternetSafety #DigitalSecurity #CyberThreats

14

1 commento

It is already five years since Giovanni #Buttarelli, magistrate, the first Secretary General of the Italian Data Protection Authority (the Garante), and President of the EDPS - European Data Protection Supervisor, suddenly passed away during the years of the transition to the #GDPR, of which he is unanimously remembered as one of the fathers. Buttarelli, wanted at his side by a giant, Professor Stefano #Rodotà, one of the fathers of #privacy in Europe, not only pioneered the first season of #data protection, in Italy and in Europe, but also courageously conceived and partly contributed to the European #digital package, without however seeing the light of day. And it is precisely of #AI and (#digital) challenges to stability, peace, development, democracy, freedom and the sustainability of the EU and its values and models that Buttarelli speaks in his latest work, published posthumously under the name ‘Privacy 2030’, also known as the Manifesto of Giovanni Buttarelli https://lnkd.in/dNcpZkcV A work written on the basis of Buttarelli's notes from the last months of his life, collected by his long-time assistant at EDPS, my friend Christian D'Cunha, published - thanks to J. Trevor Hughes and Omer Tene - by our IAPP - International Association of Privacy Professionals and corroborated by essays and comments, some exceptional, written by Shoshana Zuboff and Marc Rotenberg - in addition to a small contribution of my own that I drafted with great emotion. Remembering Mr. Buttarelli is not just a gesture of affection, but an invitation to read and study him, never separately from Stefano Rodotà, so as not to forget where we come from, where our profession originates, and to remind ourselves, in our daily exercise of assistance and consultancy in the #data market, that only the search for the continuous balancing of apparently opposing interests and rights - economic and individual and fundamental ones - is capable of achieving all the objectives set by the European Constitutions. Entanglements, oppositions, dogmatisms, laissez-faire excesses, and privacy fundamentalisms mortify all this, do not benefit the protection of people's rights, and contribute to the weakening of the global economy and that of the European Union. https://lnkd.in/dNcpZkcV

64

2 commenti

Sigma s.r.l., a company operating Vodafone Italia sale points, was fined €150,000 by the DPA for serious GDPR violations. The company activated over 1,300 SIM cards and telephone services without customer consent, using personal data from Vodafone’s systems. 💫Key Facts: Investigation by the Italian Financial Police revealed Sigma's unauthorized activation of services and charging customers without their knowledge. Sigma used data from Vodafone systems to carry out these activations, often linked to deceased individuals or unsuspecting customers. 💫 Legal Findings: Article 5(1)(a), (2) GDPR: Breach of the principles of lawfulness, fairness, and accountability. Article 13 GDPR: Failure to provide transparent information to data subjects. Article 6 GDPR: Lack of legal basis for data processing. Article 24(1) and 25(1) GDPR: Failure in controller responsibilities and implementation of appropriate measures. Article 28(10) GDPR: Sigma, though initially a processor, acted as a controller by determining the purposes and means of processing. 💫 Implications: This case underscores the critical importance of adhering to GDPR provisions and the severe consequences of data misuse. Companies must ensure transparent, lawful data processing and robust compliance frameworks to avoid such hefty penalties. #GDPR #DataPrivacy #Compliance #DataProtection #LegalUpdate #privacymatters

12

2 commenti

@Europol has released an extensive report on key criminal networks in the EU. What’s inside: 💡 Comprehensive analysis of 821 criminal networks. 🔄 ABCD framework that uncovers operational patterns. 🛠 Elements to guide policy and operational action. The data will assist national #LawEnforcement authorities to better target and conduct their cross-border criminal investigations. Curious how @Salv Bridge users may leverage these insights? Drop me a line! Link to the full report: https://lnkd.in/dqFpHDnZ #IntelligenceSharing #FinCrime #AML #Investigations #IntelligenceSharing #FinCrime #AML #Investigations

4

📊 Making Data Secure: Dedicated Sessions at the Privacy Symposium 📊 In Venice, Italy, from June 10 to 14, 2024, the Privacy Symposium offers over 140 sessions with over 300 expert speakers to promote international dialogue, cooperation, and knowledge-sharing on data regulation, compliance, and innovative technologies. The Privacy Symposium conference will feature a specialized track of sessions dedicated to Making #Data #Secure. These sessions will focus on challenges and solutions to secure and protect personal data. They will address #cybersecurity-related threats and concerns, as well as technology developments to support data protection by design and by default, including authentication and encryption mechanisms. Discover dedicated sessions on making data secure, such as: - Cybersecurity Threats Evolution - Getting Ready for Post-Quantum and AI Threats and Security - Privacy Enhancing Technologies: What's New and Where to Focus - New European Cybersecurity Framework: Cyber Resilience Act, NIS2, and DORA Don’t miss this unique opportunity to meet top-level experts to hear their views and to discuss cybersecurity-related threats, new technologies and solutions. 📝 Register here: https://lnkd.in/dBQBNDp8 The place where experts, authorities, and innovation meet to support data compliance evolution and convergence. More ℹ️: https://lnkd.in/eFcx5zSe 👉 Follow us on LinkedIn (English): https://lnkd.in/e_2b-hAt 👉 Follow us on LinkedIn (Italian): https://lnkd.in/dUGefumQ #PSC24 #PrivacySymposium #DataProtection #DataCompliance #Cybersecurity #GDPR #InternationalCooperation #Venice #Events

18

⚖️ Exploring Financial and Economic Aspects of Data Compliance: Dedicated Sessions at the Privacy Symposium ⚖️ In Venice, Italy, from June 10 to 14, 2024, the Privacy Symposium offers over 140 sessions with over 300 expert speakers to promote international dialogue, cooperation, and knowledge-sharing on data regulation, compliance, and innovative technologies.   The Privacy Symposium conference organizes dedicated sessions on financial and economic aspects of data compliance. They will discuss impacts on society, the economic dimension of privacy, and how data protection compliance is changing our ways of life and the way the economy works. These sessions are tailored to provide strategic insights and actionable knowledge, helping you navigate the evolving landscape of data regulations and compliance. The thematic tracks include sessions, such as:   - Financial and Economic Valuation of Compliance - Compliance Accountability and Reporting - Data for Good - Closing the Trust Gap: Prioritizing Privacy and Building Trust - ESG Lessons Learned for Privacy - Privacy by Design Online Marketing - Data Regulation in the Financial Sector: DORA, MICA, Toolbox for DPOs - Privacy, Free Competition, and Anti-Trust Compliance - Digital Currencies and Data Protection Compliance   Don’t miss this unique opportunity to meet top-level experts and authorities to hear their views and discuss economic and financial aspects of data protection compliance. 📝 Register here: https://lnkd.in/dBQBNDp8   More ℹ️: https://lnkd.in/eFcx5zSe 👉 Follow us on LinkedIn (English): https://lnkd.in/e_2b-hAt 👉 Follow us on LinkedIn (Italian): https://lnkd.in/dUGefumQ   #PSC24 #PrivacySymposium #DataProtection #DataCompliance #Cybersecurity #GDPR #InternationalCooperation #Finance #Compliance #ESG

18