Google has been attracting some plaudits for being responsive to concerns about privacy abuses.  In October 2021  Google started allowing people under 18 or their parents request to delete their photos from search results. Users must specify that they want Google to remove “Imagery of an individual currently under the age of 18” and provide some personal information, the image URLs and search queries that would give rise to the results. Google also now allows requests to remove non-consensual explicit or intimate personal images from Google, along with involuntary fake pornography

It is pleasing that these changes have been made of Google’s own volition but it was done  at a time of regulator pressure and adverse findings regarding the use of Google Analytics by the CNIL. 

Recently Google announced  its plan to include a “reject all” button on cookie banners.  Google is now giving consumers more choice and control on how their data is tracked. 

The UK Information Commissioner is huffed stating:

We welcome news of Google’s revised approach to cookie consent. It’s a change we’ve been seeking through our ongoing discussions with Google and broader adtech work. The new ‘reject all’ option gives consumers greater control and balance of choice over the tracking of their online activity.

“There’s still a long way to go to address concerns around consent across the whole online advertising industry, but short term, we expect to see industry following Google’s lead to provide clearer choices for consumers. This is only a first step; current approaches to obtaining cookie consent need further revision in order to provide a smoother and increasingly privacy-friendly browsing experience.”

As of this week Google has updated its personal information removal policy to allow doxxing victims to remove personal identifiable information from search engines.

The statement from Google, per Read the rest of this entry »

The difference between Australian Privacy regulation and the European regulation under the General Data Protection Regulation has been well known.  The protections are greater under the GDPR than Australia’s Privacy Act 1988 and the size of the fines are much greater. That is made clear with the Data Data Protection Australian imposing a fine of 565,000 Euros on the Ministry of Foreign Affairs for violations of Articles 13(1)(e) and 32(1) of the General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’).

The media release provides:

The Dutch Data Protection Authority (DPA) fined the Dutch Ministry of Foreign Affairs €565,000 for long-term, large-scale, serious infringements of the General Data Protection Regulation (GDPR) in its visa-issuing process.

NVIS, the digital system used by the Ministry of Foreign Affairs for the Schengen visa process, is inadequately secured. As a result, there is a risk that unauthorised persons could access and change files. Furthermore, the Ministry of Foreign Affairs failed to provide visa applicants with sufficient information about the sharing of their personal data with third parties. Read the rest of this entry »

Justice Riordan considered an appeal against an order for security for costs in In the matter of Credit Clear Limited [2022] VSC 206.  The appellants were unsuccessful across the board. 

FACTS

By originating process filed 15 July 2020, the plaintiffs made an application under:

(a) sections 175, 232, 233, 461(1)(k), 1041H(1), 1324(1) and 1325 of the Corporations Act 2001 (Cth) (‘the Act’);

(b) sections 12DA and 12GM of the Australian Securities and Investments Commission Act 2001(Cth) (‘the ASIC Act’);

(c) Sections 237 and 243 of the Australian Consumer Law, being Schedule 2 of the Competition and Consumer Act 2020 (Cth) (‘ACL’); and

(d) the inherent jurisdiction of the Court [2].

The plaintiffs sought the following substantive relief in their points of claim [4]:

(a) The first plaintiff (‘Mr McKendrick’) sought to be reinstated as a director of the first respondent (‘Credit Clear’).

(b) The appellant sought the following relief:

B. Declarations and or orders under s 1325 of the Act, alternatively s 233(1)(c) and or (j) of the Act, s 12GM of the ASIC Act and or ss 237 and 243 of the ACL, that the Separation Agreement dated 11 November 2016 and Intellectual Property Assignment Agreement dated 11 November 2016 (by which the plaintiffs were forced to give up their interests in the first defendant together with the intellectual property rights owned by the first plaintiff) are void on the grounds they were procured under duress, undue influence, unconscionable conduct and or misleading and deceptive conduct in contravention of 1041H(1) of the Act, s 12DA of the ASIC Act and or s 18 of the ACL;

C. A declaration that the second plaintiff is entitled to hold 20% of the issued ordinary shares in the first defendant;

D. Rectification of the share register of the first defendant pursuant to s 175 of the Act to reinstate the second plaintiff as a member and to record that it holds a number of fully paid ordinary shares representing 20% of issued shares in the first defendant alternatively that it holds 6,805,555 fully paid ordinary shares in the first defendant;

E. A declaration that the affairs of the first defendant are being conducted contrary to the interests of the members as a whole and or are oppressive to, or unfairly prejudicial to, or unfairly discriminatory against the second plaintiff, or in the interests of and to the benefit of the second to third defendants and not the first defendant or its members;

F. An order that the second and or third defendants purchase the second plaintiff’s shareholding in the first defendant at fair value; Read the rest of this entry »

Ransomware attacks have surged early this year according to databreach today with Cybercrime: Ransomware Attacks Surging Once Again based on a report by the NCC Group.  it’s findings are that:

• Ransomware attacks increased 53% compared with February, representing continued growth since the start of the year
• The most targeted sectors continue to be Industrials (34%), Consumer Cyclicals (21%), and Technology (7%)
• The most targeted regions were North America (44%) and Europe (38%) – a return to the usual split after seeing both regions with a similar number of victims in February
• The most prolific ransomware variants were again Lockbit 2.0 (96 victims) and Conti (71 victims)

An interesting, and worrying development, is that the percentage of data being restored after paying the demanded ransom has dropped.  On average only 61% of the data is restored whereas 65% was restored in 2020. the key caveat to reporting on ransomware is that the figures are notoriously spongey.  Many affected businesses don’t report attacks if they pay the ransom.

To show that the threat is real in the US the ransomware group going by the name Conti posted on the dark web data belonging Elgin County which had been hit by a ransomware attacked.  Yesterday Austin Peay State University admitted to being a victim of a ransomware attack.  This is the twelfth US institute of higher education being successfully targeted by ransomware gangs Read the rest of this entry »

Yesterday the Australian Competition and Consumer Commission (“ACCC”) yesterday released Interim Report No s – General online retail marketplaces.

In broad compass the report covers, as its brief description states:

• intensity of competition in the relevant markets
• trends in online shopping and general online retail marketplaces
• the conduct of marketplaces in their roles as platforms to facilitate interaction between third party sellers and consumers; including, where marketplaces also supply their own products on their platform, the impact that these sales and associated practices may have on competition with third-party sellers
• relationships between marketplaces and third party sellers
• relationships between marketplaces and consumers, as well as third party sellers and consumers.

The report necessarily deals with the issue of data collection and privacy.  It does not contain any new insight or previously unknown fact or issue however it does synthesise and summarise the relevant issues.  All too often these issues are not considered with this level of focus.  In that regard it relevantly states Read the rest of this entry »

The Singapore Personal Data Protection Commission has imposed a $35,000 fine on GeniusU for failing to prevent unauthorised access and exfiltration of personal information of 1.26 million.  It is a significant data breach for Singapore in terms of numbers of individuals affected.  Singapore has a population of a little over 5 million. 

As is all too common there were more than one mistake in GeniusU’s cyber security set up.  The likely entry was through the use of a developer’s password.  Once in it was easy to exfiltrate the data.  It was stored in the codebase of its GitHub environment.  

The decision summary relevantly Read the rest of this entry »

In Bioaction Pty Ltd v Ogborne, in the matter of Bioaction Pty Ltd [2022] FCA 436 the Federal Court considered, for the first time by the courts, the deeming provisions of sections 105A and 105B of the Corporations Act regarding service applications to set aside a statutory demand within the 21 day time limit,.  

FACTS

By originating process filed on 3 February 2022, the plaintiff, Bioaction Pty Ltd, sought an order setting aside a statutory demand pursuant to s 459G of the Corporations Act dated 12 January 2022 served by the defendant, Gordon Ogborne (“Ogborne”) [5].

Bioaction  specialises in the design, manufacturing and installation of systems to eliminate or mitigate odorous, hazardous and corrosive gases & Ogborne was its Chief Financial Officer / Chief Operating Officer from December 2019 until November 2021, when he was made redundant [7].

Ogborne and Bioaction were in dispute as to his entitlements where Ogborne claimed he was entitled to any additional sum [8].

On 13 January 2022, Ogborne served the statutory demand on Bioaction seeking payment of $240,688.31 being unpaid:

• salary,
• superannuation,
• salary in lieu of termination,
• annual leave and
• redundancy

pursuant to an employment contract [9].

The statutory demand was Read the rest of this entry »

The National Institute of Standards and Technology has released a preliminary draft guide on ensuring the transference from 4G to 5G is managed properly managed, in particular dealing with adequate cyber and cloud security and privacy protections.

As to be expected, this 83 page document is highly technical however it is a valuable asset for those practising in the privacy and cyber security space.

The Abstract provides:

Organizations face significant challenges in transitioning from 4G to 5G usage, particularly the need to safeguard new 5G-using technologies at the same time that 5G development, deployment, and usage are evolving. Some aspects of securing 5G components and usage lack standards and guidance, making it more challenging for 5G network operators and users to know what needs to be done and how it can be accomplished. To address these challenges, the NCCoE is collaborating with technology providers to develop example solution approaches for securing 5G networks. This NIST Cybersecurity Practice Guide explains how a combination of 5G security features and third-party security controls can be used to implement the security capabilities organizations need to safeguard their 5G network usage.

It defies easy summation.

In the broad the proposed Read the rest of this entry »

It is something of a persistent myth that authors can hide behind pseudonyms and publish defamatory statements with impunity.  If, as demonstrated in Colagrande v Kim [2022] FCA 409 a plaintiff is determined enough there is high probability of obtaining sufficient information to identify the author and convince a court that that person is the correct defendant in a subsequent defamation proceeding. Jagot J ordered a very significant award against the respondents.

FACTS

Dr Colagrande (“Colagrande”) a Australian trained doctor who is highly qualified:

• in 1999 completing a training Fellowship with the Cambridge Private Hospital in Cambridge, United Kingdom i
• in 2002, becoming an Honorary Fellow in Aesthetic Plastic and Reconstructive Surgery at Addenbrooke’s Public Hospital in Cambridge, United Kingdom
• in 2005, gaining a Fellowship in Cosmetic Surgery from the European Academy of Cosmetic Surgery
• in 2005,  establishing a clinic at Mermaid Beach, Gold Coast, Queensland where he mainly performed cosmetic procedures, health assessments and well-being programs.

In February 2017 Dr Colagrande pleaded not guilty to a charge of  indecent assault of a patient, to which he was found not guilty [5]. On 5 June 2018 the Queensland Court of Appeal quashed that conviction and the prosecution entered a nolle prosequi (a formal abandonment of the charge) on 7 June 2018 [5].

Colagrande had an account with the RateMDs website, a Doctor rating site with over 40 million visits every year. Members of the public can post entries relating to doctors on the RateMDs website [6].

In early 2019 when Colagrande Read the rest of this entry »

Yesterday the National Institute of Standards (“NIST”) released Trusted Cloud: Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments, Hardware-Enabled Security: Policy-Based Governance in Trusted Container Platforms and Hardware Enabled Security: Machine Identity Management and Protection and Hardware-Enabled Security:Policy-Based Governance in Trusted Container Platforms.

The guides are highly technical but include useful practical methodologies on cyber security.  They are a valuable resource.  In Australia there is nothing equivalent at this level of detail. 

Trusted Cloud

The abstract Read the rest of this entry »