Personal Data: Uncovering Misconduct by Companies – NRW Data Protection Officers' Latest Report
Non-compliant Practices Uncovered in NRW Businesses by Data Protection Authorities - Data guardians over NRW county investigate privacy concerns
North Rhine-Westphalia's (NRW) data protection officer, Bettina Gayk, reveals an unprecedented 12,490 complaints to her office in 2021 – a figure last seen in 2019. In her recent 30th activity report, Gayk highlights several instances where companies in the region have shirked data protection guidelines.
Case in point, NRW's authorities discovered a shocking practice among 11 insurance companies trading sensitive health data among themselves, a clear breach of privacy. A call center operator in NRW was also stopped from relying on emotion recognition software secretly.
An online weather service based in NRW was barred from sharing location data of its users with third parties, lacking valid permission. And while a large housing association installed smart smoke detectors with climate monitoring functions in apartments, Gayk's office clarified that the climate function should remain inactive due to privacy concerns.
Regarding the New Federal Government's proposals to centralize data protection supervision of companies with the federal data protection officer, Gayk expressed concern. She believes localized data protection supervision has proven effective for decades and has proven crucial in handling complaints relating to economic activities. She cautioned that transferring this responsibility to a federal authority would hinder companies from gaining the valuable, accessible advice they currently receive.
Gayk also voiced concern over weakening data protection in favor of new security laws, criticizing proposals to implement facial recognition AI and granting the constitutional protection agency access to private video surveillance systems. She called for a clear legal framework to protect citizens' privacy, believing that everyone traveling by train is not an enemy of the constitution.
Weighing in on private video surveillance, Gayk notes that millions of people are daily affected by it without giving the authorities any reason to act. If citizens suspected that the constitutional protection agency was behind every camera in the future, it would be an "unjustified massive infringement on civil liberties."
Manipulating data via messaging services like WhatsApp was another issue highlighted by Gayk, encouraging people to be cautious with their use and avoid transmitting sensitive data such as smart meter data. Gayk also criticized job centers that required applicants to disclose their phone numbers and email addresses as a data protection violation.
Unclear competencies regarding collaboration with state prosecutors was another issue raised by Gayk, expressing dissatisfaction with NRW Minister of Justice Benjamin Limbach (Greens). Despite her demands for clarification, she received the opposite response, leaving her puzzled.
| Topic | Concern/Criticism ||--------------------|-------------------------------------------------------------------|| Complaints Handled | Record breaking complaints in 2021 || Health Data | 11 insurance companies trading sensitive health data || Emotion Recognition Software | Call center operator relying on secret emotion recognition software || Location Data | Online weather service sharing location data with third parties || Privacy | Smart smoke detectors with climate monitoring functions in apartments || Centralization | Loss of local data protection supervision would deprive companies of valuable advice || Data Protection | Concerns about weakening data protection in favor of new security laws || Private Video Surveillance | Millions affected daily without giving authorities reasonable cause for action || WhatsApp | Cautioning against using WhatsApp too casually due to opaque data handling || Job Center Applications | Expressed concern over the disclosure of phone numbers and email addresses in job center applications || Prosecutors Collaboration | Feeling frustrated by unclear control competence of data protection authorities in the area of public prosecutors' offices |
- Vocational training in data protection is essential to combat the increasing number of data breaches, as revealed by the NRW data protection officer's report.
- The science of cybersecurity is crucial in ensuring companies adhere to community policies regarding personal data and privacy.
- With rising concerns about data privacy and security, vocational training in health-and-wellness industry therapies and treatments should also focus on patient data protection.
- In the face of recent data misconduct incidents, it's vital for the finance industry to prioritize vocational training in data protection and financial technology (fintech) to secure customers' data.
- As many companies are incorporating smart devices and IoT into their services, vocational training in home-and-garden technology should emphasize data protection to protect homeowners' privacy.
- With the increasing popularity of CBD products, it's important for businesses to prioritize vocational training in data protection and privacy practices to maintain trust with their customers.
- The rise of e-commerce and online shopping calls for vocational training in data-and-cloud-computing and technology to protect consumers' data and maintain a secure industry.
- As the lifestyle sector continues to grow, it's essential for businesses to prioritize vocational training in data protection and privacy practices to keep up with consumer demands for secure and trustworthy services.
- The sports industry, including sports-betting and sports-analysis, should prioritize vocational training in data protection to protect athletes' and bettors' personal information and maintain their trust.
- The travel industry should emphasize vocational training in data protection and privacy practices to ensure customers' personal information is secure when traveling and remains compliant with local data protection regulations.
