Datenschutz-Plaudereien · Martin Steiger & Andreas Von Gunten, Datenschutzpartner

DAT340 Tätigkeitsbericht 2024 der Zürcher Datenschutzbeauftragten

·19 min·1 clip

Zurich's Data Protection Officer Dominika Blonsky just published her 2024 report—what surprising failures and AI cases does it reveal?

The episode begins with hosts Martin Steiger and Andreas Von Gunten introducing the recently published 2024 activity report from Zurich's Data Protection Officer, Dr. Dominika Blonsky. They note the report is published on a dedicated website, datenschutz.ch, and is available as a dynamically generated PDF. The hosts play a short video from the Data Protection Officer explaining the report's purpose as an independent supervisory authority document. They then delve into the report's content, starting with statistics: 82 data protection cases were reported in 2024, a slight increase, with 27 in cantonal administration and 28 in hospitals. The most common issue was faulty sending of personal data, accounting for two-thirds of cases. The hosts speculate the actual number of such incidents is likely higher. A notable case discussed involves a patient filming a list of patient data in a clinic and posting the recording on TikTok, which the clinic attempted to have deleted. The hosts express skepticism about the ease of content removal from TikTok. Another topic is a control finding regarding Microsoft 365, specifically that Exchange Online is used without comprehensive encryption, potentially allowing access by US authorities. The hosts debate the practical implications of email encryption shortcomings. They also mention findings on password length requirements and areas for improvement like deletion of telemetry data and employee training. The report notes an increase in pre-control advice requests from authorities, suggesting growing awareness. The hosts critique the report for often remaining on the surface, lacking details on enforcement actions, especially regarding cases like Microsoft 365 compliance and unauthorized access to Schengen Information System data by employees. They express a desire for more data on state authority data accesses, such as by police, and acknowledge the practical limits of the Data Protection Officer's enforcement power. The episode concludes with a brief mention of a chapter on generative AI for public organs and an invitation for listener feedback.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Datenschutz-Plaudereien