CASES, SANCTIONS AND CLAIMS
- (2019, Jun) The French supervisory authority CNIL fines Estate Company 400K on issues of inadequate technical measures (Art. 32 GDPR) and non-compliance with retention periods (Art. 5(1)(e) GDPR).
- (2019, Jun) Hungarian Information Safety Authority imposed a fine of €290,000 on a digital communications supplier (Digi Zrt). The authority found a vulnerability within the web site which was not mounted for years and allowed a hacker to enter.
- (2019, Sep) This article in Romanian explains the first GDPR fines applied in Romania and their relevance from the point of view of security obligations.
- (2019, Sep) The Polish DPA imposed a fine on Morele.net for insufficient organizational and technical safeguards, the amount rising up to 645,000 euros.
- (2020, Jul) The European Council has imposed the first sanctions against cyber-attacks.
REPORTS AND ARTICLES FROM OTHER ORGANISATIONS
- (2017) FTC: 50 ways to leak your data: An Exploration of Apps’ Circumvention of the Android Permissions System.
- (2019, Mar) What is state of the art in IT security? See discussion in this article written by Gabriela Zanfir-Fortuna
- (2019, Aug) IAPP: Privacy threats from inside the organization are analyzed in this article.
- (2020, Jan) Jones Day: Global Privacy & Cybersecurity Update.
- (2020, May ) Reuschlaw: IT security in practice: infusing life into Article 32 of the GDPR.
- (2020, Jun) Diana Kelly: The psychology of social engineering—the “soft” side of cybercrime.
OFFICIAL GUIDELINES, REPORTS AND STATEMENTS
- (2019, Mar) ENISA: Guidance and gaps analysis for European standardisation on the topic of privacy and the study entitled Towards a framework for policy development in cybersecurity – Security and privacy considerations in autonomous agents.
- (2019, Mar) European Parliament: Proposal for a Cybersecurity Regulation.
- (2019, Apr) European Commission: Recommendation on cybersecurity in the energy sector
- (2019, Jun) The national cyber security and incident response team from Romania (CERT-RO): set of recommendations for when it comes to web-based apps security. See also the CERT-RO infographic on what to look for when acquiring apps or software systems and the CERT-RO news on online scams.
- Irish DPC: General Portable Storage Device Recommendations.
- (2019, Oct) Irish DPC: Guidance for Organisations on Phishing and Social Engineering Attacks.
- (2019, Nov) Spanish DPA: its opinion on DNS security, data protection, and privacy.
- (2019, Nov) NISA: Stock taking of security requirements set by different legal frameworks on OES and DSPs.
- ENISA: online tool for evaluating the level of risk for a personal data processing operation.
- (2020, Jan) Saxony DPA: the deployment of a penetration testing requires the conclusion of a data protection agreement with the third party contractor (read here an article in English).
- (2020, Feb) Irish DPC: Guidance for Controllers on Data Security.
- (2020) European Commission: report providing multidimensional insights into the growth of cybersecurity.
- (2019, May) The Council of the European Union is now able to impose sanctions against “persons or entities that are responsible for cyber-attacks or attempted cyber-attacks, who provide financial, technical or material support for such attacks or who are involved in other ways. Sanctions may also be imposed on persons or entities associated with them.”