Content by Mathew J. Schwartz

Privacy Fines: Total GDPR Sanctions Reach $331 Million

Mathew J. Schwartz  •  January 19, 2021

Privacy watchdogs in Europe have imposed fines totaling more than $330 million since the EU's General Data Protection Regulation went into full effect in May 2018, according to law firm DLA Piper. Over the past year, regulators received 121,000 data breach notifications, up 19% from the year before.

Are EU Privacy Regulators Starting to Find GDPR Consensus?

Mathew J. Schwartz  •  December 28, 2020

More than two years after Europe's tough new General Data Protection Regulation came into full effect, EU privacy watchdogs are finding more consensus, and consumers have been benefiting, experts say. But how regulators apply sanctions, in particular, remains a work in progress.

Microsoft Backpedals Over 'Productivity Score' Monitoring

Mathew J. Schwartz  •  December 3, 2020

Microsoft is revamping its controversial "productivity score" in Microsoft 365 so that individual workers can no longer be tracked. The move follows warnings by privacy advocates that the feature was a step too far into the realm of workplace surveillance.

Productivity Tools May Be Monitoring Workers' Productivity

Mathew J. Schwartz  •  November 27, 2020

Warning to workers: Your productivity tools may also be tracking your workplace productivity, and your bosses may not even know it. But as more workplace surveillance capabilities appear, legal experts warn that organizations must ensure their tools do not violate employees' privacy rights.

Ticketmaster Fined $1.7 Million for Data Security Failures

Mathew J. Schwartz  •  November 16, 2020

Ticketmaster UK has been fined $1.7 million by Britain's privacy watchdog for its "serious failure" to comply with the EU's General Data Protection Regulation. Its failure to properly secure chatbot software led to attackers stealing at least 9.4 million payment card details.

German Court Slashes a GDPR Privacy Fine by 90%

Mathew J. Schwartz  •  November 13, 2020

A German appeals court has slashed by 90% the $11 million General Data Protection Regulation fine levied last year against 1&1 Telecom by the nation's federal privacy watchdog over call center data protection shortcomings. Experts say the case is a reminder that all GDPR fines can be appealed.

Probing Marriott's Mega-Breach: 9 Cybersecurity Takeaways

Mathew J. Schwartz  •  November 10, 2020

Inadequate database and privileged account monitoring, incomplete multifactor authentication and insufficient use of encryption: Britain's privacy regulator has cited a raft of failures that contributed to the four-year breach of the Starwood guest reservation system discovered by Marriott in 2018.

Marriott Breach Takeaway: The M&A Cybersecurity Challenge

Mathew J. Schwartz  •  November 4, 2020

Takeaway from the U.K.'s GDPR privacy fine against hotel giant Marriott: During M&A, review an organization's cybersecurity posture before finalizing any acquisition. Because once a deal closes, you're fully responsible for data security - IT network warts and all.

Marriott and BA's Reduced Privacy Fines: GDPR Realpolitik

Mathew J. Schwartz  •  November 3, 2020

Large, recently levied privacy fines against the likes of British Airways, H&M and Marriott show regulators continuing to bring the EU's General Data Protection Regulation to bear after businesses get breached. But in the case of Marriott and BA, were the final fines steep enough?

Marriott Hit With $24 Million GDPR Privacy Fine Over Breach

Mathew J. Schwartz  •  November 2, 2020

Hotel giant Marriott has been hit with the second largest privacy fine in British history, after it failed to contain a massive, long-running data breach. But the final fine of $23.8 million was just 20% of the penalty initially proposed by the U.K.'s privacy watchdog, owing in part to COVID-19's ongoing impact.

Cybercrime: 12 Top Tactics and Trends

Mathew J. Schwartz  •  October 13, 2020

Ransomware attacks remain the top cyber-enabled threat seen by law enforcement. But phishing, business email compromises and other types of fraud - many now using a COVID-19 theme - also loom large, Europol warns in its latest Internet Organized Crime Threat Assessment.

Clothing Retailer H&M Told to Wear $41 Million GDPR Fine

Mathew J. Schwartz  •  October 5, 2020

Privacy regulators in Germany have slammed clothing retailer H&M with a $41 million fine for collecting and retaining private employee data in violation of the EU's General Data Protection Regulation. H&M has apologized, instituted changes and promised to financially compensate employees.

Breach of COVID-19 Test Data Undermines Pandemic Response

Mathew J. Schwartz  •  September 15, 2020

What's one of the worst things that can happen during a pandemic? The answer is anything that gives people less reason to trust in their public health system to handle the crisis. Enter a data breach that has exposed personal information for everyone who's ever tested positive for the disease in Wales.

Data Breach Reports Fall 45% in UK

Mathew J. Schwartz  •  September 4, 2020

The number of cybersecurity incidents reported to the U.K.'s data privacy watchdog has continued to decline, recently plummeting by nearly 40%. But is the quantity of data breaches going down, or might organizations be failing to spot them or potentially even covering them up?

Marriott Faces Another Data Breach Lawsuit

Mathew J. Schwartz  •  August 19, 2020

Marriott faces another lawsuit, filed in Britain, over the breach of its Starwood guest reservation system. The breach ran from 2014 to 2018 - Marriott acquired Starwood in 2016 - and exposed personal information for an estimated 7 million customers in the U.K.