Facebook has announced a series of changes to its developer platform to implement tighter user privacy controls and limit how apps can access to user data.

The changes were initially mentioned last week, when the social platform came under fire after reports emerged that millions of Facebook users’ personal data was harvested by British firm Cambridge Analytica.

Facebook CEO Mark Zuckerberg apologized for the incident last week and said tighter controls would be coming. Also last week, Facebook paused app review in preparation for the upcoming changes to its developer platform.

The first of the announced privacy improvements have been already implemented, but more are planned for the near future.

“These are critical steps that involve reviewing developers’ actions for evidence of misuse, implementing additional measures to protect data, and giving people more control of their information,” Facebook now says.

The first major change Facebook made toward improved user privacy was to prevent applications from “seeing” a person in one’s friends list unless both users have decided to share their list of friends with the app.

“In order for a person to show up in one person’s friend list, both people must have decided to share their list of friends with your app and not disabled that permission during login. Also both friends must have been asked for user_friends during the login process,” Facebook explains.

Moving forth, the social platform plans investigating all apps that had access to large amounts of user data before that access was restricted in 2014. Facebook will ban developers from its platform if they are found to have misused personally identifiable information and will notify everyone who used the application.

The company will also require for developers who build applications for other businesses to comply with rigorous policies and terms that will be revealed within the following weeks.

Facebook also plans on encouraging people to manage the apps they use, making it easier for them to revoke apps’ ability to use their data. Users will find it easier to learn what apps are connected to their accounts and to control the data these apps have access to.

On top of that, Facebook also plans on expanding its bug bounty program to allow users file reports when data is misused by app developers, a move that many security experts approve of.

Craig Young, computer security researcher for Tripwire’s Vulnerability and Exposure Research Team, told SecurityWeek in an emailed comment that this move could “start a trend toward more policy-oriented bug bounties from social media platforms.”

“This move by Facebook really makes a lot of sense to me. By expanding their bounty program to include data misuse by app developers, Facebook may have found a way to mobilize their community to self-police. It will be interesting to see if this if spurs new bug bounty participation including people less technical than the typical bug hunter,” he said.

Ilia Kolochenko, CEO of web security company High-Tech Bridge, also believes that this step could determine other companies to start similar moves that would allow them to avoid severe sanctions for privacy violations.

“This is an exciting shift in the bug bounty industry, which untill now has focused on security vulnerabilities. Facebook is the first major company that is asking for researchers to identify data privacy issues. With the GDPR coming into force in a couple of months, data privacy is now high on many organizations’ agendas,” Kolochenko said.

Last week, Facebook said it would make its privacy tools more visible to its users, and today the company announced that it has already implemented the necessary changes.

The settings menu on mobile devices was redesigned, with all the necessary tools now available in a single place and cleared outdated settings to make it obvious what information can and can’t be shared with apps.

Facebook also implemented a new Privacy Shortcuts menu, where users can control their data with just a few taps, in addition to finding clearer explanations of how the controls work.

Now, users can add more layers of protection, such as two-factor authentication, can review the data they’ve shared and delete it, can manage the information the platform uses to show ads, and can also manage who sees their posts and the information included on their profiles.

Users can also find, download, and delete their Facebook data, via the Access Your Information option, where management of posts, reactions, comments, and things searched for is possible. Users can delete any information they no longer want on Facebook and can also download a copy of the data shared with Facebook.

Facebook also plans on updating its terms of service and data policy to make it clearer what data is collected and how it is used.

“These updates are about transparency – not about gaining new rights to collect, use, or share data,” Erin Egan, VP and Chief Privacy Officer, Policy and Ashlie Beringer, VP and Deputy General Counsel, Facebook, said.

Related: Facebook Announces New Steps to Protect Users’ Privacy

Related: Pink-haired Whistleblower at Heart of Facebook Scandal

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/08vB6aRBqds/facebook-limits-app-access-users-data

In the wake of the Cambridge Analytica scandal and rising public pressure against Facebook, the social media giant announced on Wednesday evening that it will restrict how much data advertisers can have access to.

Facebook will soon stop allowing advertisers access to data about individuals held by companies like Experian and Acxiom.

Prior to this change, Facebook allowed advertisers to target groups of people based on an amalgamation of both datasets.

“We want to let advertisers know that we will be shutting down Partner Categories,” Graham Mudd, a product marketing director, said in a statement. “This product enables third-party data providers to offer their targeting directly on Facebook. While this is common industry practice, we believe this step, winding down over the next six months, will help improve people’s privacy on Facebook.”

Earlier on Wednesday, Facebook also said it would redesign the user-facing privacy settings panel. If that sounds familiar, it’s because Facebook has made that exact kind of announcement many times over.

“We’ve redesigned our entire settings menu on mobile devices from top to bottom to make things easier to find,” Erin Egan, Facebook chief privacy officer, wrote. “Instead of having settings spread across nearly 20 different screens, they’re now accessible from a single place. We’ve also cleaned up outdated settings so it’s clear what information can and can’t be shared with apps.”

https://arstechnica.com/?p=1285009

Facebook Revamps Privacy Settings Amid Data Breach Outcry

Facebook on Wednesday unveiled new privacy settings aiming to give its users more control over how their data is shared, following an outcry over hijacking of personal information at the giant social network.

The updates include easier access to Facebook’s user settings and tools to easily search for, download and delete personal data stored by Facebook.

Facebook said a new privacy shortcuts menu will allow users to quickly increase account security, manage who can see their information and activity on the site and control advertisements they see.

“We’ve heard loud and clear that privacy settings and other important tools are too hard to find and that we must do more to keep people informed,” chief privacy officer Erin Egan and deputy general counsel Ashlie Beringer said in a blog post.

“We’re taking additional steps in the coming weeks to put people more in control of their privacy.”

The new features follow fierce criticism after it was revealed millions of Facebook users’ personal data was harvested by a British firm linked to Donald Trump’s 2016 presidential campaign — although Facebook said the changes have been “in the works for some time.”

Earlier this month, whistleblower Christopher Wylie revealed political consulting company Cambridge Analytica obtained profiles on 50 million Facebook users via an academic researcher’s personality prediction app.

The app was downloaded by 270,000 people, but also scooped up their friends’ data without consent — as was possible under Facebook’s rules at the time.

Egan and Beringer also announced updates to Facebook’s terms of service and data policy to improve transparency about how the site collects and uses data.

Deepening tech crisis

Facebook’s move comes as authorities around the globe investigate how Facebook handles and shares private data, and with its shares having tumbled more than 15 percent, wiping out tens of billions in market value.

The crisis also threatens the Silicon Valley tech industry whose business model revolves around data collected on internet users.

On Tuesday, tech shares led a broad slump on Wall Street, with an index of key tech stocks losing nearly six percent.

The US Federal Trade Commission this week said it had launched a probe into whether the social network violated consumer protection laws or a 2011 court-approved agreement on protecting private user data.

US lawmakers were seeking to haul Facebook CEO Mark Zuckerberg to Washington to testify on the matter.

Authorities in Britain have seized data from Cambridge Analytica in their investigation, and EU officials have warned of consequences for Facebook.

Facebook has apologized for the misappropriation of data and vowed to fix the problem. Facebook took out full-page ads in nine major British and US newspapers on Sunday to apologize to users.

“We have a responsibility to protect your information. If we can’t we don’t deserve it,” Zuckerberg said in the ads.

*Updated

© AFP 2018

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/k8aLf7_7uvc/facebook-announces-new-steps-protect-users-privacy

Mozilla today unveiled the “Facebook Container Extension”, a new browser extension designed to help Firefox users reduce the ability of Facebook to track their activity across other web sites.

The new extension, Mozilla says, will help users gain more control over their data on the social platform by isolating their identity into a separate container. Because of that, Facebook would find it more difficult to track users’ activity on other websites via third-party cookies.

The Facebook Container Add-On was launched in the light of news that Facebook at one point allowed applications to harvest large amounts of data on users and their friends and follows Mozilla’s announcement that it has paused Facebook advertising until the social network improves the privacy of its users.

The privacy scandal started with reports that Cambridge Analytica, the data analysis firm hired by Donald Trump’s 2016 presidential campaign, harvested 50 million Facebook users’ profiles without their permission.

The social network has been under heavy fire since last week, when the news broke, despite suspending the firm’s account. Many are losing trust in the platform and the use of Facebook data to target voters triggered global outrage.

This is what determined Mozilla last week to pause Facebook advertising, despite Mark Zuckerberg’s assurance that steps will be taken to ensure a situation like the Cambridge Analytica one won’t happen again.

“Facebook knows a great deal about their two billion users — perhaps more intimate information than any other company does. They know everything we click and like on their site, and know who our closest friends and relationships are,” Mozilla said last week.

Now, the browser maker says that users can enjoy both their time on Facebook and navigating on other websites they like. For that to happen, users should have tools that limit the data that others can collect on them, Mozilla included. Because of that, the browser won’t collect data from the use of the Facebook Container extension, except for information on how many times the extension is installed or removed.

The new extension, Mozilla claims, should provide users with the means to protect themselves from any side effects of usage.

“The type of data in the recent Cambridge Analytica incident would not have been prevented by Facebook Container. But troves of data are being collected on your behavior on the internet, and so giving users a choice to limit what they share in a way that is under their control is important,” the browser maker notes.

When installed, the extension deletes the user’s Facebook cookies and logs them out of the social platform. The next time they visit Facebook, the website will open in a new blue-colored browser tab (a container tab).

Users will be able to log into Facebook and use it like they would normally do. When clicking on a non-Facebook link or navigating to a non-Facebook website in the URL bar, those pages load outside of the container.

When clicking on Facebook Share buttons on other browser tabs, the extension loads them within the Facebook container. However, when the buttons are clicked, Facebook receives information on the website that the user shared from.

“If you use your Facebook credentials to create an account or log in using your Facebook credentials, it may not work properly and you may not be able to login. Also, because you’re logged into Facebook in the container tab, embedded Facebook comments and Like buttons in tabs outside the Facebook container tab will not work,” Mozilla explains.

Because of that, Facebook can’t associate information about the activity of the user on websites outside of the platform to their Facebook identity. Thus, the social network won’t be able to use the activity collected off Facebook to send ads and other targeted messages.

“There’s a lot of value in your social data. It’s important to regularly review your privacy settings on all sites and applications that use it. The EFF has useful advice on how to keep your data where you want it to be, under more of your control,” Mozilla notes.

Facebook isn’t the only firm to collect data from user’s activity outside of the core service, but this is a problem that can be solved quickly. Thus, users are advised to review their privacy settings for each app they use regularly.

Related: UK Regulators Search Cambridge Analytica Offices

Related: Worried About Being on Facebook? Some Options Explained

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/LcQval8SMy4/mozilla-isolates-facebook-new-firefox-extension

Instantly recognizable with his pink hair and nose ring, Christopher Wylie claims to have helped create data analysis company Cambridge Analytica before turning whistleblower and becoming “the face” of the crisis engulfing Facebook.

Carole Cadwalladr, the Guardian journalist who worked with Wylie for a year on the story, described him as “clever, funny, bitchy, profound, intellectually ravenous, compelling. A master storyteller. A politicker. A data science nerd.”

The bespectacled 28-year-old describes himself as “the gay Canadian vegan who somehow ended up creating Steve Bannon’s psychological warfare tool,” referring to Trump’s former adviser, whom the report said had deep links with Cambridge Analytica (CA).

With Wylie’s help, Cadwalladr revealed how CA scooped up data from millions of Facebook users in the US.

They then used the information to build political and psychological profiles, in order to create targeted messages for voters.

Facebook insists it did not know the data taken from its site were being used, but the revelations have raised urgent questions over how data of 50 million users ended up in CA’s hands.

Shares of the tech giant have since tumbled, with $70 billion (56 billion euros) wiped off in 10 days.

– ‘Walter Mitty’ –

Wylie studied law and then fashion, before entering the British political sphere when he landed a job working for the Liberal Democrats.

Former Lib Dem colleague Ben Rathe had a less complementary description of Wylie, tweeting that he “thinks he’s Edward Snowden, when he’s actually Walter Mitty” — a reference to a fictional character with a vivid fantasy life.

Wylie became a research director for Strategic Communication Laboratories (SCL), the parent company of CA, in 2014. 

“I helped create that company,” he said of CA in an interview with several European newspapers. 

“I got caught up in my own curiosity, in the work I was doing. It’s not an excuse, but I found myself doing the research work I wanted to do, with a budget of several million, it was really very tempting,” he told French daily Liberation.

Initially, he enjoyed the globetrotting lifestyle, meeting with ministers from around the world. 

But the job took a dark turn when he discovered that his predecessor had died in a Kenyan hotel. He believes the victim paid the price when a “deal went sour”.

“People suspected poisoning,” he told a British parliamentary committee investigating “fake news” on Tuesday. 

– ‘Repair Facebook!’ –

His appearance before MPs saw him swap his usual loud T-shirts for a sober suit and tie, producing hours of testimony against the firm that he left in 2014. 

He said he eventually decided to speak out after US President Donald Trump’s shock election victory, which he partly attributed to the misuse of personal data for political purposes. 

Cambridge Analytica vigorously denies the charges levelled against it, saying that Wylie was merely “a part-time employee who left his position in July 2014” and had no direct knowledge of how the firm had operated since.

Wylie urged British MPs to dig deeper into the story, insisting that his concern was not political and was focussed on abuses in the democratic process — including during the Brexit referendum campaign.

“I supported Leave, despite having pink hair and my nose ring,” he said.

He claimed that various pro-Brexit organisations worked together to get around campaign finance rules, using the services of Aggregate IQ, a Canadian company linked to the SCL group. 

Wylie believes that it is “very reasonable” to say that CA’s activities may have swung the Brexit vote, although he stressed he was not anti-Facebook, anti-social media or anti-data.

“I don’t say ‘delete Facebook’, but ‘repair Facebook’,” he told the European newspapers.

However, he admitted to MPs that he had “become the face” of the scandal.

© AFP 2018

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/bsFKQwSpVqY/pink-haired-whistleblower-heart-facebook-scandal

A US consumer protection agency said Monday it has opened an investigation into Facebook’s privacy practices, another blow to the social network, which is struggling to deal with a growing crisis on misuse of private data.

The Federal Trade Commission (FTC) confirmed news reports from last week that it had opened an inquiry over the harvesting of data on tens of millions of Facebook users by the British consulting group Cambridge Analytica.

While the FTC normally refuses to comment on its probes, it took the unusual step of confirming a “non-public investigation” into Facebook over whether it mishandled private data or violated a 2011 agreement which settled an earlier probe.

Acting FTC consumer protection chief Tom Pahl said the agency will look into whether Facebook violated its privacy promises or failed to comply with the US-EU agreement on data protection known as the Privacy Shield.

The agency also will also determine if Facebook engaged “in unfair acts that cause substantial injury to consumers in violation of the FTC Act.”

The FTC suggested that Facebook could face new legal problems if it violated the consent decree with the consumer agency in 2011 settling charges that it deceived consumers on how it handled private data.

“Companies who have settled previous FTC actions must also comply with FTC order provisions imposing privacy and data security requirements,” Pahl said in the statement.

“Accordingly, the FTC takes very seriously recent press reports raising substantial concerns about the privacy practices of Facebook.”

Facebook shares reversed early losses and closed up 0.42 percent on Monday, after having lost some 14 percent last week.

Separately, Senate Judiciary Committee chairman Charles Grassley said he had asked Facebook CEO Mark Zuckerberg to appear at a hearing on April 10 “to discuss Facebook’s past and future policies regarding the protection and monitoring of consumer data.”

Grassley said he also invited Google CEO Sundar Pichai and Twitter CEO Jack Dorsey “to discuss the future of data privacy in the social media industry.”

– Germany to boost oversight –

Germany’s justice minister meanwhile said Monday that Facebook should face “stricter” oversight and be more transparent with its users.

Speaking after a meeting with European Facebook executives in Berlin, Justice Minister Katarina Barley said the firm’s assurances that it had already cracked down on the misuse of personal data were “not enough.”

“In future we will clearly have to monitor companies like Facebook more strictly and punish data protection violations severely and quickly,” she told reporters.

The world’s biggest social network is facing calls on both sides of the Atlantic for more information on how its user data was leaked. Several US states have opened investigations.

A public apology by Zuckerberg has failed to quell outrage over the hijacking of personal data.

Separately, Facebook disputed reports that it had been logging call and text data surreptitiously from its users.

A Facebook statement said call and text history logging “is part of an opt-in feature” for those using Messenger or Facebook Lite on Android.

“This helps you find and stay connected with the people you care about, and provides you with a better experience across Facebook,” the statement said, while pointing to ways users can turn off the feature.

In London, authorities said they were assessing data seized in a raid on the offices of Cambridge Analytica as part of their investigation.

About 18 enforcement agents from the Information Commissioner’s Office participated in the raid late Friday after getting a court order.

“This is one part of a larger investigation by the ICO into the use of personal data and analytics by political campaigns, parties, social media companies and other commercial actors,” the UK agency said.

Cambridge Analytica, which worked on US President Donald Trump’s election campaign, has been accused of illegally mining tens of millions of users’ Facebook data and using it to target potential voters.

Facebook took out full-page ads in nine major British and US newspapers on Sunday to apologize to users.

“We have a responsibility to protect your information. If we can’t we don’t deserve it,” Zuckerberg said in the ads.

© AFP 2018

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/AJhX2PEgT3s/ftc-probe-facebook-over-privacy-practices

Ho sfogliato velocemente il testo dello Schema di Decreto Legislativo  che introduce disposizioni per l’adeguamento della normativa nazionale alle disposizioni del Regolamento (UE) 2016/679 (in seguito GDPR – General Data Protection Regulation) in attuazione dell’art. 13 della Legge di delegazione europea 2016-2017 (legge 25 ottobre 2017, n. 163) annunciato da Governo con un Comunicato  Stampa del 21 marzo 2018.

Premetto che ho ricevuto giorni fa il testo di questo decreto legislativo, ma per pudore istituzionale (e rispetto verso le fonti che me lo avevano cortesemente inviato), ho evitato di diffonderlo e anche di commentarlo. In pochi attimi, invece, la Rete è stata travolta da opinioni e testi pubblicati, in versione – più o meno – ufficiale.

Questo lungo testo normativo (104 articoli contro i 99 del GDPR che tale decreto vorrebbe frettolosamente integrare nel nostro ordinamento) merita di essere oggetto di un’approfondita lettura. Trovo che sia impossibile commentarne i contenuti di getto, al solo scopo di “arrivare primi”, azzerando il tempo di ragionamento. Conviene peraltro aggiungere un’attenta e puntuale lettura del testo della relazione illustrativa, utilissima per comprenderne lo spirito.

Si legge nell’art. 102 del testo normativo (che ora dovrà seguire l’iter di approvazione presso le Commissioni parlamentari competenti e acquisire il parere del Garante della protezione dei dati) che “a decorrere dall’entrata in vigore del presente decreto, il Codice in materia di protezione dei dati personali di cui al decreto legislativo 30 giugno 2003, n. 196 è abrogato. A decorrere da tale data sono altresì abrogati i commi 1021 e 1024 dell’articolo 1 della legge 27 dicembre 2017, n. 205”.

Mi permetto solo tre riflessioni.

1) La sbandierata trasparenza

Si continua a blaterare di trasparenza nelle istituzioni e di partecipazione nella stesura delle leggi e invece normative delicatissime come queste seguitano a svilupparsi in modo segretissimo, magari anticipate da altri provvedimenti di coordinamento europeo, immediatamente messi in discussione (e abrogati) come se nulla fosse. Si arriva così ai Comunicati Stampa del Governo con uno “stupore che stupisce” ogni volta anche gli addetti ai lavori, perché non si sa mai cosa accade, ma soprattutto come e perché. Basti pensare che a seguito del Comunicato Stampa di qualche giorno fa, diversi studiosi chiedevano la cortesia di poter capire quale testo fosse realmente quello approvato dal Governo.

Ovvio che così procedendo si continuino a partorire pasticci e, dalla veloce lettura dello schema di decreto legislativo, si ha la sensazione che si sia proceduto in fretta e furia, credo in considerazione del fatto che il nostro Paese in questa fase di delicato recepimento è in ritardissimo rispetto ad altre realtà europee.

In un Paese che fa del FOIA una (piuttosto contraddittoria) bandiera non potremmo almeno meritarci una pubblicazione on line immediata e ufficiale dei testi normativi approvati e anticipati nei Comunicati Stampa? In un Paese che dice di essere digitalizzato non dovrebbe essere ovvio questo processo di trasparenza?

2) Eccesso di delega del decreto

Condivido le perplessità di Elena Bassoli.  La legge delega del Parlamento n. 163 del 25 ottobre 2017 all’art. 13 prevedeva una delega al Governo soltanto per un necessario adeguamento della normativa nazionale alle disposizioni del regolamento (UE) 2016/679 e, in particolare, secondo il dettato dell’art 13 nell’esercizio della delega il Governo era tenuto a:

– abrogare espressamente (solo e soltanto) le disposizioni del codice in materia di trattamento dei dati personali, di cui al decreto legislativo 30 giugno 2003, n. 196, incompatibili con le disposizioni contenute nel regolamento (UE) 2016/679;

– modificare il codice 196/2003 limitatamente a quanto necessario per dare attuazione alle disposizioni non direttamente applicabili contenute nel Regolamento (UE) 2016/679;

– coordinare le disposizioni vigenti in materia di protezione dei dati personali con le disposizioni recate dal regolamento (UE) 2016/679;

– adeguare, nell’ambito delle modifiche al codice di cui al decreto legislativo 30 giugno 2003, n. 196, il sistema sanzionatorio penale e amministrativo vigente alle disposizioni del regolamento (UE) 2016/679 con previsione di sanzioni penali e amministrative efficaci, dissuasive e proporzionate alla gravità della violazione delle disposizioni stesse.

Da quanto ho letto mi sembra di capire che si sia proceduto diversamente. Solitamente si cerca di seguire (in modo più o meno rigoroso) la delega ricevuta per non incorrere nell’eccesso previsto dall’art. 76 Costituzione. Qui si è andati proprio da un’altra parte, anche alla luce dell’abrogazione delle sanzioni previste dal Codice.

Alla fin fine ritengo che il modus operandi indicato nella legge delega n. 163 sia anche più corretto e rigoroso dal punto di vista del diritto europeo, anche in considerazione di quanto ricordato recentemente dalla Commissione: “il Regolamento non ha modificato in modo sostanziale i concetti e i principi fondamentali della legislazione in materia di protezione dei dati introdotta nel 1995. La grande maggioranza dei titolari del trattamento e dei responsabili del trattamento che rispettano già le attuali disposizioni dell’UE non dovrà quindi introdurre importanti modifiche nelle proprie operazioni di trattamento dei dati per conformarsi al regolamento” (COMUNICAZIONE DELLA COMMISSIONE AL PARLAMENTO EUROPEO E AL CONSIGLIO – Bruxelles, 24.1.2018 COM(2018) – Maggiore protezione, nuove opportunità – Orientamenti della Commissione per l’applicazione diretta del regolamento generale sulla protezione dei dati a partire dal 25 maggio 2018). Questi stessi concetti sono stati ribaditi tante volte in diversi interventi dal nostro Garante Europeo Giovanni Buttarelli.

Soprattutto, non possiamo dimenticare che il nostro Codice ha una sua storia ed è testo autorevole. A mio avviso (e – ribadisco – come indicato dalla legge delega) occorreva solo snellirlo nei punti incompatibili con il GDPR, al fine di poter essere adeguato e coordinato meglio. Comprendo che in pochi mesi sia più comodo buttare tutto all’aria, operare un veloce “copia-incolla” di certi punti e far finta di nulla, ma resto molto perplesso su questo modus operandi.

3) Rimbocchiamoci le maniche perché la strada è lunga e il futuro digitale oscuro e incerto

Ormai siamo arrivati a far coincidere la nostra realtà digitale con quanto paventava tempo fa Stefano Rodotà e cioè siamo diventati tutti uomini di vetro sempre visibili dai detentori del potere politico ed economico, con un rischio evidente per la libertà e la democrazia. Il caso Cambridge Analytica ci ha messi di fronte a tutte le nostre fragilità e nudità di individui nelle mani tentacolari e invadenti delle nuove sorelle del digitale, di cui fa parte Amazon. E proprio Amazon, come sappiamo, ci ha prestato gratuitamente un grande uomo, Diego Piacentini, come Commissario Straordinario per l’Agenda Digitale, con ampi poteri su tutto un settore, quello dell’innovazione digitale della PA, che ovviamente ha grandi impatti sulla protezione dei dati personali. E Amazon proprio in questi anni è diventato leader nelle soluzioni cloud per  enti governativi…

Sono solo coincidenze e so bene che denunciare i conflitti di interesse non va di moda nel nostro Paese, ma io non posso evitare di notare certi accadimenti e avvertire un senso di inquietudine. Perché c’è disperato bisogno di rigore metodologico e di certezze giuridiche. E il semplicismo di un’abrogazione non mi sembra che vada in questa direzione.

Il GDPR in ogni caso è e resta l’ultimo baluardo per arginare certi fenomeni che ci riguardano tutti e non posso non riferire pertanto che queste ultime novità non mi rendono tranquillo.

Spero di sbagliarmi.

Codice per la protezione dei dati personali: un’abrogazione frettolosa (forse incostituzionale) e senz’altro pericolosa

Raffaele Barberio, presidente dell’associazione Privacy Italia, è stato ospite di Sky Tg24 Pomeriggio per analizzare criticamente il caso Facebook-CambridgeAnalytica. “Con l’uso illegittimo dei nostri dati viene perpetrata una violazione della privacy degli utenti e questo non può più andare avanti”, ha detto Barberio.

La sintesi della trasmissione

[embedded content]

Raffaele Barberio a SkyTg24 su Facebook-CambridgeAnalytica: ‘Stop a uso illegittimo dei dati’

A snowballing Facebook scandal over the hijacking of personal data from millions of its users has many wondering whether it’s time to restrict access to their Facebook information or even leave the social network altogether, with the #deletefacebook movement gaining traction.

Here are some options open to the worried Facebook user.

Put it to sleep 

Putting a Facebook account on hold used to be difficult but has become a lot easier.

To deactivate their account, users need to go on their “settings” page, then on to “manage account”, where they can “deactivate” their account. Facebook defines this action as putting activity “on hold”.

The move disables a user’s profile and removes their name and pictures from most things they have shared.

Some information may still remain visible, like a user’s name in a friend’s list, or messages exchanged with friends.

If they have second thoughts, users can easily restore a de-activated profile.

Kill the account

Deleting an account is a more radical step, as users will not be able to access it again once they’ve gone for that option.

Facebook warns users that it can take up to 90 days to purge the network of a user’s posts.

Even so, some information is likely to stay online, for example messages sent to friends.

According to French data expert Nathalie Devillier there is also a chance that Facebook holds on to information about some users if asked to by US authorities in the name of national security.

Be more alert

Facebook users can check with the network how much of their personal information is accessible on the network.

In “settings“, the option “download a copy of your Facebook data” allows a user to do just that.

Once Facebook has double-checked a user’s password, the site compiles and then e-mails a compressed file.

The file gives an overview of the pictures and videos a user has posted, their downloaded apps, message traffic with friends, their “likes”, unfriended friends and ads clicked.

The information can be difficult to decrypt, as are some passages in Facebook’s privacy rules.

It is possible to exercise some control over some ad preferences. This includes, for example, users deciding whether their relationship status can be used as a criterion for targeted ads.

– Go after Facebook – 

Some experts and consumer rights organizations argue that rather than withdraw from Facebook, users should help shift the balance of power between the social network giant and individuals by legal means.

“We must be able to use the service without being under Facebook’s surveillance,” said Arthur Messaud at Quadrature du Net, a French organization that defends the rights of internet users.

The group is planning a class action suit against Facebook in France, based on a new set of EU data protection rules that come into force in May, Messaud said.

He said one aim of the lawsuit is to force Facebook to seek explicit user consent for the use of data by, for example, ticking a box.

© AFP 2018

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/0NM8v5f-Nko/worried-about-being-facebook-some-options-explained

Il Regolamento europeo sulla protezione dei dati (GDPR) entrerà pienamente in vigore dal 25 maggio. Per questo motivo è di stretta attualità e di rilevante interesse professionale il seminario formativo “Il nuovo Regolamento UE in materia di protezione dei dati personali. Il Garante incontra l’Amministrazione economico finanziaria” organizzato da Sogei, presso la sua sede di Roma, il 27 marzo a partire dalle 9:30.

I lavori saranno aperti dal presidente e dall’amministratore delegato di Sogei, Biagio Mazzotta e Andrea Quacivi, e dal Garante Privacy, Antonello Soro.
L’evento, su invito e a numero chiuso, è stato organizzato da Sogei, in collaborazione con l’Autorità Garante per la protezione dei dati personali, per approfondire le novità del Regolamento europeo con particolare riferimento alla protezione dei dati nel settore pubblico, il nuovo ruolo del DPO, i titolari e responsabili del trattamento e la valutazione d’impatto privacy quale strumento per la gestione dei rischi nell’uso dei dati dei contribuenti.
Inoltre saranno analizzati gli impatti della nuova normativa sull’Amministrazione Finanziaria in tutte le sue articolazioni. Il Regolamento Europeo 679/2016 (GDPR), introdotto allo scopo di creare una legislazione Privacy comune a tutti gli Stati membri dell’Unione Europea, abroga la Direttiva madre 95/46/CE e dal 25 maggio 2018 sarà pienamente in vigore e le sanzioni previste immediatamente applicabili. Il Gdpr andrà ad ampliare e modificare la legge nazionale sulla privacy di ogni singolo Stato.

L’agenda del seminario

Al seminario interverrà il Responsabile “Security Governance e Data Protection” di Sogei, Fabio Lazzini e alcuni esperti dell’Autorità Garante: Francesco Modafferi, Miriam Viggiano e Irene Faganello.

Scarica la locandina dell’evento in Pdf

Il seminario è riservato ai Responsabili privacy dell’amministrazione e ai soggetti della PA che operano nel settore della fiscalità, tuttavia è possibile seguirlo in diretta streaming sul canale YouTube di Sogei. Imposta il promemoria per non perdere l’evento.

Per approfondire:

Gdpr, seminario formativo di Sogei con il Garante Privacy (diretta streaming il 27 marzo)