DPOInsider

Share this post

DPOInsider #49

www.dpoinsider.com

Discover more from DPOInsider

Weekly newsletter highlighting the biggest news + issues in the world of Data Protection 👩‍💻
Continue reading
Sign in

DPOInsider #49

GDPR clarification; T-Mobile breach

DPOInsider
May 12, 2023
Share this post

DPOInsider #49

www.dpoinsider.com
Share

The DPOInsider covers the latest news and developments in data compliance and privacy. The DPO's favourite weekly read ☕️


One of Europe’s top court clarifies GDPR compensation and data access rights

Yesterday, a significant step was taken in the realm of data protection, with the European Union’s top court announcing two noteworthy rulings. One, Case C-300/21, addresses compensation for GDPR breaches, and the other, Case C-487/21, clarifies what type of information individuals should expect to receive when exercising their GDPR rights to access data held about them.

Thanks for reading DPOInsider! Subscribe for free to receive new posts and support my work.

In the area of GDPR compensation, the court's ruling delivers a nuanced verdict that could potentially have far-reaching implications. It puts the onus on claimants to demonstrate personal harm, but interestingly, the court also rules that there's no prerequisite for non-material damage to reach a certain seriousness level to justify compensation. This, in essence, removes a barrier to filing a compensation claim, a development that could be quite significant in the longer term.

Peter Church, counsel at law firm Linklaters, suggests that this could pave the way for compensation claims for even minor anxiety or upset. He also foresees a divergence between EU and UK laws in this area. Remember, back in 2021, the UK Supreme Court required proof of harm and a seriousness threshold for compensation in a case against Google. In contrast, the EU court has now removed any such seriousness bar.

Another key ruling came in the context of an individual's right to access their data under the GDPR. The court decided that individuals are entitled to "a faithful and intelligible reproduction" of their data. This is a powerful assertion of the individual's right to check the accuracy and legality of their data processing.

However, it's important to note that there's still potential for friction here, given the balancing act between the right to comprehensive personal data access and the rights and freedoms of others. The court emphasizes that the result of these considerations should not lead to a refusal to provide all information to the data subject.

We should carefully watch these developments. As we navigate the labyrinth of GDPR compliance and its ever-evolving interpretations, these rulings provide essential guidance on understanding the rights of individuals and our obligations as data guardians.


T-Mobile’s second break of the year

In the rapidly evolving digital era, data privacy has become a paramount concern. This week, we once again face a stark reminder of this reality as T-Mobile discloses its second data breach of the year. Sergiu Gatlan of Bleeping Computer provides a detailed report on this recent incident, outlining that attackers had access to personal information of hundreds of customers for more than a month, starting late February 2023. While this breach affected far fewer individuals compared to T-Mobile's previous breach, which impacted 37 million people, it is nonetheless a sobering reminder of the persistent threats we face in our sector.

The news of this breach comes on the heels of several others, marking a concerning pattern for T-Mobile. As Gatlan reports, the exposed information included "full name, contact information, account number and associated phone numbers, T-Mobile account PIN, social security number, government ID, date of birth, balance due, internal codes that T-Mobile uses to service customer accounts (for example, rate plan and feature codes), and the number of lines." This extensive set of data exposes affected individuals to risks like identity theft and phishing attacks.

T-Mobile's response to the breach reveals their proactive approach in resetting account PINs for impacted customers and offering them two years of free credit monitoring and identity theft detection services through Transunion myTrueIdentity. While these steps are commendable and vital, we must not overlook the need for prevention. It's in instances like these that the role of data protection officers becomes critical. Our profession's mandate isn't just to react to breaches but to prevent them.

It's also worth noting that this is the second data breach T-Mobile has disclosed since the start of the year, with a previous one disclosed on January 19. The history of breaches at T-Mobile, dating back to 2018, underscores the importance of vigilance and continuous improvement in data security measures. The frequency of these incidents suggests that the company has significant gaps in its data security that need addressing, and this should be a wake-up call for all of us.


Other data privacy news

Edge Of Sovereignty: Navigating Data Security And Compliance In Latin America's Evolving Tech Landscape

Data sovereignty has become a critical concern for governments, businesses and individuals worldwide as cloud computing rises in popularity and data generation and storage cross borders.

An Expert View on the Critical Data Privacy Issues for 2023 and Beyond

Data privacy veteran Jennifer Garone—who is currently the Senior Director of Privacy and Information Governance at Carnival Corporation talkas about the critical issues to look out for in 2023.

Zero Trust Data Security: It’s Time To Make the Shift

How do you secure something that no longer exists? With the rapid expansion of hybrid-remote work, IoT, APIs and applications, any notion of a network perimeter has effectively been eliminated. Plus, any risk inherent to your tech stack components becomes your risk whether you like it or not.


Post of the week

Elon has stopped Tweets from populating in Substack, so here’s the link to see the thread.

Thanks for reading DPOInsider! Subscribe for free to receive new posts and support my work.

Share this post

DPOInsider #49

www.dpoinsider.com
Share
Comments
Top
New
Community

No posts

Ready for more?

© 2023 DPOinsider
Privacy ∙ Terms ∙ Collection notice
Start WritingGet the app
Substack is the home for great writing