- \n
- Orbitz\u00a0| Buscador de passagens a\u00e9reas |\u00a0880 mil usu\u00e1rios | acesso indevido de\u00a0dados banc\u00e1rios e pessoais.<\/li>\n<\/ul>\n
- \n
- SingHealth\u00a0| Rede de assist\u00eancia m\u00e9dica do governo de Cingapura |\u00a01,5 milh\u00e3o de usu\u00e1rios | acesso indevido a dados pessoais e hist\u00f3rico de medicamentos.<\/li>\n<\/ul>\n
- \n
- myPersonality\u00a0| Aplicativo de rede social |\u00a04 milh\u00f5es de usu\u00e1rios | acesso indevido a\u00a0dados pessoais de usu\u00e1rios do Facebook que utilizaram o myPersonality.<\/li>\n<\/ul>\n
- \n
- Marriott Starwood\u00a0| Hot\u00e9is |\u00a0500 milh\u00f5es de usu\u00e1rios | acesso indevido a dados financeiros e pessoais de h\u00f3spedes.<\/li>\n<\/ul>\n
Each of these organizations experienced a data breach incident.<\/p><\/blockquote>\n
These are only some of the most significant cases reported to date (see the link at the end of this article for more examples). The reality is that we have no clear picture of how many organizations are affected by cybersecurity incidents or data breaches every single day. The scale of the problem is alarming.<\/p>\n
What is striking is that almost every accident or incident can ultimately be traced back to negligence, recklessness, or incompetence on the part of an individual or organization.<\/p>\n
Let's examine these concepts from a data protection perspective.<\/strong><\/p>\n
A\u00a0<\/em>Neglig\u00eancia<\/em><\/strong>\u00a0implica que o respons\u00e1vel pelo tratamento deixa de fazer algo que sabidamente deveria ter feito, dando causa a uma viola\u00e7\u00e3o de dados. Significa agir com descuido, desaten\u00e7\u00e3o ou indiferen\u00e7a, sem tomar as devidas precau\u00e7\u00f5es.<\/em><\/p>\n
A common example is an organization that has no information security or data protection policy, fails to maintain reliable backups (or never verifies that backups can actually be restored), does not use antivirus or anti-malware software, lacks a firewall despite knowing one is necessary, has no visibility into who has access to its systems, or has not mapped its data processing activities and information flows. These are just a few examples of widely recognized security best practices that are often neglected. The risks are well known, yet no meaningful action is taken.<\/p>\n
A\u00a0<\/em>Imprud\u00eancia<\/em><\/strong>, por outro lado, pressup\u00f5e uma a\u00e7\u00e3o que foi feita de forma precipitada e sem cautela. O respons\u00e1vel pelo tratamento toma uma atitude a respeito do assunto sem a cautela e zelo necess\u00e1rio que se esperava. Significa que sabe fazer a a\u00e7\u00e3o da forma correta, mas n\u00e3o toma o devido cuidado para que isso aconte\u00e7a.<\/em><\/p>\n
<\/div>\n
A common example is an organization that, in an effort to avoid regulatory fines rather than genuinely protect personal data, hires a consultant\u2014often a lawyer, since the GDPR is a legal framework\u2014or sends an employee to a GDPR training course and expects them to implement the entire compliance program internally.\n\nThe result is often an organization that has a privacy policy, documented data flows, and perhaps a few information security policies. However, in practice, these measures do little to effectively protect the personal data for which the organization is responsible.<\/p>\n
Por ser feito dessa forma, essas empresas ficam \u00e0 merc\u00ea de terem o dados pessoais se tornarem indispon\u00edveis, sem integridade ou n\u00e3o confi\u00e1veis, por falhas na gest\u00e3o ou por algum incidente de seguran\u00e7a de origem interna ou externa. Essas organiza\u00e7\u00f5es s\u00e3o como sepulcros caiados, lindos por fora, mas por dentro, nem tanto.<\/p>\n
J\u00e1 a\u00a0<\/em>Imper\u00edcia<\/em><\/strong>\u00a0consiste em n\u00e3o saber praticar o ato. Ser imperito na prote\u00e7\u00e3o de dados \u00e9 realiz\u00e1-la sem ter o conhecimento t\u00e9cnico, te\u00f3rico ou pr\u00e1tico necess\u00e1rio para isso.<\/em><\/p>\n
- Marriott Starwood\u00a0| Hot\u00e9is |\u00a0500 milh\u00f5es de usu\u00e1rios | acesso indevido a dados financeiros e pessoais de h\u00f3spedes.<\/li>\n<\/ul>\n
- myPersonality\u00a0| Aplicativo de rede social |\u00a04 milh\u00f5es de usu\u00e1rios | acesso indevido a\u00a0dados pessoais de usu\u00e1rios do Facebook que utilizaram o myPersonality.<\/li>\n<\/ul>\n
- SingHealth\u00a0| Rede de assist\u00eancia m\u00e9dica do governo de Cingapura |\u00a01,5 milh\u00e3o de usu\u00e1rios | acesso indevido a dados pessoais e hist\u00f3rico de medicamentos.<\/li>\n<\/ul>\n