Enterprises are shaking up their approach to data privacy and governance, new research shows, largely due to added risk factors created by AI adoption.

According to Cisco's 2026 Data and Privacy Benchmark Study, nearly all companies are expanding privacy programs and governance frameworks to protect their data.

AI is the main reason for 90%, with 93% saying they planned further investment to keep up with the complexity of AI systems and the expectations of customers and regulators.

The survey found that 38% spent at least $5 million on their privacy programs in the past year – marking a dramatic increase from just 14% who spent over that threshold in 2024.

Notably, these programs appear to be working well. An overwhelming 96% of organizations reported that robust privacy frameworks were helping unlock AI agility and innovation, and 95% said privacy was essential for building customer trust in AI-powered services.

One interesting change spotted by the researchers is that trust is no longer just a question of meeting regulatory requirements.

Data governance is now seen as a strategic business enabler, with 99% of organizations reporting at least one tangible benefit from their privacy initiatives, such as enhanced agility, innovation, and greater customer loyalty.

Almost half said that clear communication about how data is collected and used is the most effective way to build customer confidence.

As a result, governance is evolving – although many organizations are still working to define and establish the structures they need to manage AI responsibly.

While three-quarters report having a dedicated AI governance body in place, only 12% describe it as mature. Meanwhile, 65% of organizations struggle to access relevant, high-quality data efficiently.

"AI is forcing a fundamental shift in the data landscape, calling for holistic governance of all data – both personal and non-personal,” said Jen Yokoyama, senior vice president, legal innovation and strategy, at Cisco.

“Organizations must deeply understand and structure their data to ensure every automated decision is explainable. It’s not just for compliance, but a necessary scaling engine for AI innovation.”

Data requirements are causing headaches

While 72% of respondents were generally positive about data privacy laws, there is a growing push to streamline and update data requirements, Cisco found.

Just over eight-in-ten organizations surveyed face heightened demand for data localization and global data complexity - and 85% said this adds cost, complexity, and risk to cross-border service delivery. #

Similarly, 77% report these requirements limit their ability to offer seamless 24/7 service across markets.

On top of this, the assumption that locally stored data is inherently more secure is gradually eroding, from 90% in 2025 to 86% in 2026.

“To capture the potential of AI, organizations (83%) are advocating for a shift toward harmonized international standards,” said Harvey Jang, Cisco vice president and chief privacy officer.

“They recognize that global consistency is an economic necessity to ensure data can flow securely while maintaining the high standards of protection required for trust.”

Cisco said enterprises should invest in robust data infrastructure, prioritizing transparency, and embedding security and privacy throughout AI initiatives.

Elsewhere, they should make sure they're making informed decisions about data localization, establish strong AI governance, and kit out their teams with comprehensive training and safeguards.

FOLLOW US ON SOCIAL MEDIA

Microsoft has announced it plans to cease security updates for Windows 7 beginning Tuesday 10 January.

The move will see users of Windows 7 Professional and Enterprise editions go without vital security protections unless they switch to a more recent operating system (OS), the company confirmed in a recent update.

In addition, the company confirmed that support for Windows 8.1 will also end on Tuesday.

Microsoft officially discontinued support for Windows 7 in January 2020. However, customers still using the legacy operating system were granted some security provisions as part of the company’s Extended Security Update (ESU) programme.

A key factor in continuing security support, Microsoft revealed at the time, was to provide users with “additional time” to transition from Windows 7 to supported operating systems such as Windows 11.

“But, during that time, as long as the device is still running Windows 7, Microsoft 365 won’t receive any new features updates,” the firm said.

The tech giant said that in order to “maintain the reliability and stability” of devices, it strongly recommends users upgrade to more modern PCs capable of running Windows 11.

Users can upgrade to Windows 10 as an alternative. However, the tech giant warned that support for this OS will end in October 2025.

“Most Windows 7 devices will not meet the hardware requirements for upgrading to Windows 11, as an alternative, compatible Windows 7 PCs can be upgraded to Windows 10 by purchasing and installing a full version of the software,” Microsoft said.

“Before investing in a Windows 10 upgrade, please consider that Windows 10 will reach its end of support date on 14 October 2025.”

Windows 7 officially launched in October 2009 and the operating system still caters to a significant global user base.

At present, the OS runs on around 11% of all Windows systems globally. Reports from January 2021 suggested that Windows 7 was still used on nearly 100 million devices, highlighting its popularity despite the series of more modern options available to users.

Security considerations

Joey Stanford, VP of privacy and security at Platform.sh, said the end-of-life (EoL) announcement has been long-awaited and as such, businesses should view upgrades as imperative to prevent security risks.

“While it might feel like an easy option to ignore the announcement, any system left operating on Windows 8 exposes a business to a significant amount of risk,” he said.

“In August 2020, the FBI issued a warning to the private industry that cyber criminals were specifically targeting Windows 7 systems following its end of support. Ignoring the EoL date isn’t an option,” Stanford added.

Counting the cost of upgrades

While Microsoft advises businesses to upgrade devices as frequently as possible, Stanford warned there are inherent burdens associated with this process, including the potential costs of upgrading.

"It’s not a simple case of 'auto-update' for everyone,” he said. “Those late to the party will be forced to bypass Windows 10 and go straight to 11, a much newer and more expensive OS that some won’t have the hardware to support.”

“Unfortunately, many businesses still have a heavy reliance on legacy systems including those that operate in the industrial industry and banking sector. These industries put their digital faith in systems that struggle to be updated and can’t handle being switched off for updates. Without a plan for EoL this can become a big security risk.”

A recommended approach for businesses to curtail costs when upgrading to Windows 11 is to upgrade in waves or plan to commit budgets towards future upgrades.

This does vary depending on the number of machines businesses run and the current spec of devices, however.

To assess upgrade readiness, Microsoft’s Endpoint Manager allows businesses to better understand how compatible the organisation is when embarking on upgrades.

The Endpoint Manager tool provides users with insights into which devices meet Windows 11 hardware requirements

Bioengineered food is food that contains genetically modified material, and soon food manufacturers will be required to inform customers if their products contain any, through labels and display signage.

The National Bioengineered Food Disclosure Standard (NBFDS) is a mandatory requirement as of the beginning of 2022, and this whitepaper shares the key points of NBFDS for food manufacturers and its impact, as well as the technologies that can support the industry to be NBFDS compliant.

Download this paper now to learn the solutions manufacturers, ingredient suppliers and retailers can implement now.

Provided by

Auditing is an independent consulting activity, intended to help organisations improve their operations, as it evaluates ways to improve risk management. However within the technology industry, auditors are being replaced by automation, and with CFOs looking to reduce spending, the function of audit and compliance could become obsolete.

The audit process needs to change for the better, and with emerging technology, there’s great potential for auditing to adapt and drive real value in relation to data analytics and risk management monitoring.

Download this whitepaper to learn where audit technology is headed, and what it means for your organisation.

Provided by

In today’s hybrid working world, with the increased number of devices, data and systems, the risk to global IT is significant, making the regulatory environment more complex.

With IT leaders facing more challenges than ever before, the differing regulations and compliance frameworks means a vast amount of work for an often resource-limited team. But being able to get to a stage of IT compliance, ready for audit, is achievable with the right technology.

Download this whitepaper to understand the key components when it comes to being IT audit-ready - including process, technology, and people - with clear steps to follow, ensuring your business gets there.

Provided by

Key risk indicators (KRIs) can help predict adverse events that may impact your organisation and are widely considered an essential part of good governance. These indicators link to a range of operational risk-management activities and processes, making them especially beneficial as metrics of changes in a company’s risk profile.

Here, you’ll learn how to implement, manage and maintain KRIs within your IT department:

• Choosing appropriate KRIs can benefit your organisation
• Examples of effective KRIs
• KRIs/KRI selection worksheet
• Implementing automated reporting

Provided by

Google has called on the US government to rethink its practice of favouring Microsoft technology when procuring technology, accusing the company of having a reputation for cyber security vulnerabilities and poor user perception.

Repeated cyber security breaches on US government systems have interrupted vital work and cost the taxpayer billions of dollars, said Google Cloud’s Jeanette Manfra, senior director of Global Risk and Compliance in a blog post.

Manfra, who has spent 20 years in the public sector, most recently as the head of the Cybersecurity and Infrastructure Security Agency (CISA)’s cyber security division, claimed that the government was at a disadvantage due to its approach to procurement, and an over reliance on Microsoft products.

She pointed to a recent Google poll of 2,600 US government workers, which found that the majority of those surveyed reported being “very” concerned about cyber attacks against their employers in the coming years. Most of those surveyed (80%) also said that the recent attacks, like the SolarWinds breach, has them concerned about their personal data and privacy, and that of their family members.

Results also showed a lack of satisfaction with legacy software, with over 50% of government workers stating that there are other products or services that could help them do their jobs better.

According to Google's data, around 84% of D.C. metro government employees primarily use Microsoft products at work, including Word, Outlook, Teams, and OneDrive. This is confirmed by another recent study by Omdia which found 85% of government employees use Microsoft productivity software.

“This reliance on a single software suite might suggest that these products are safe and secure, but the Public Opinion Strategies survey found that more than half of all respondents said that the government’s reliance on these Microsoft products actually made the federal government more vulnerable to hacking or cyber attacks,” said Manfra.

However, a US Senate report released last August detailed that seven out of eight federal agencies had failed to protect critical data due to inadequate cyber security policies, rather than problems with their systems. It stated that most agencies failed to install security patches quickly enough, and warned that at least seven out of the eight agencies are still using legacy systems that have reached end of life, and no longer receive vendor security patches.

When survey respondents were asked why their employers used Microsoft services, 45% said the reason was because their employer has always used those products and services and doesn’t want to change, while 55% said because they are the most effective at helping them to do their job.

Manfra said that with so many respondents reporting they're dissatisfied with their legacy IT solutions, it may be time for the government to rethink its approach to procurement.

“As governments work to meet the demands and preferences of their constituents—and their employees—it’s clear that there’s an overreliance on legacy solutions, despite a track record of cyber security vulnerabilities and poor user perception,” she added.

IT Pro has contacted Microsoft for comment.

Despite the tech giant criticising Microsoft for its cyber security, it isn't immune to these kinds of threats either. In February, it had to resolve a critical security flaw in Android 12 with its February 2022 Android security update. In the same month, the company had to release another wave of patches for seven high-severity issues affecting Chrome, including one zero-day vulnerability being actively exploited.

A report highlighted in January that Google Drive accounted for the most malware downloads in 2021, taking the top spot from Microsoft OneDrive. It accounted for 37% of all malicious downloads last year, while OneDrive fell to second place with 20% of downloads.

Google Cloud also revealed in November last year that 86% of compromised Google Cloud Platform instances in 2021 led to cryptocurrency miners being dropped into customers' environments. Its customers were heavily targeted by attackers who were attempting to leverage the high levels of compute available to them without having to pay for it.

In the modern world, AI is everywhere, powering a variety of applications from enterprise business intelligence tools to sorting through photos of our pets. But as the technology becomes more and more widespread, concerns have been raised about the potential dangers that could be posed by unrestrained AI development.

Calls have been intensifying from campaigners seeking guardrails on how AI systems are developed, and the kind of use-cases they’re applied to, with opponents arguing that legislation governing AI development would only stifle innovation. Joining us this week to discuss the feasibility of AI regulation, the need for AI codes of practice and the responsibility of organisations to ensure ethical development is Cindi Howson, chief data strategy officer for analytics software vendor ThoughtSpot.

Highlights

"So one of the hot buttons in AI is really facial recognition. There are some issues, let's say, also with financial services and discrimination there. So if we think about some of the broad-based AI; facial recognition. Where we do not want it is we do not ever want to arrest somebody based on a match, a potential match, of a photo scanned from somebody walking down the street. That's invasive, it's a violation of privacy. And the degree of accuracy is not high enough, particularly with minority communities or people with darker skin tones."

"I mean, again, financial services. Let's take this: if you train your data, going too far back - and I lived in Switzerland for eight years married to a Brit. Because I was married, I was not allowed to have my own bank account. This is twenty five years ago. So if you trained your model on historical data going back 25 years, well, I'm going to look like a big credit risk, a bigger credit risk. So this is a problem. Now, a woman knows this rule deeply. If I only have male developers working on this, then I may not even think, Oh, wait, if I go too far back, that data is biased."

"So the first question, how do we stay on top of this, it has to be education. And education, not just for the data professionals, and the AI professionals, it is up to every citizen to understand the good of AI and the bad."

Read the full transcript here.

Footnotes

• Apple co-founder Wozniak echoes sexist Apple Card allegations
• How to spot – if not fix – algorithmic bias
• Industry "delighted" with UK's 'landmark' anti-bias AI standard
• What is an algorithm?
• Do we need an algorithm police?
• Facebook put "profit before public safety" with algorithm change
• The A-level results crisis has once again shown the limits of AI
• Twitter to make AI algorithm open source to scour for biases
• What is AI?
• Is artificial intelligence safe?
• Building an AI superpower: Does the UK stand a chance?
• IDC expects spending on AI to increase by a fifth in 2022
• How to monetise AI for better business outcomes
• Fujitsu to establish AI Ethics and Governance Office
• EU proposes strict regulations to curb AI misuse
• Most UK businesses say data regulations are stifling AI innovation
• UK gov urged to protect human right to review AI decisions

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Do we need AI regulation?'. To listen to the full episode, click here. We apologise for any errors.

Adam Shepherd

Hi, I'm Adam Shepherd.

Sabina Weston

And I'm Sabina Weston.

Adam

And you're listening to the IT Pro Podcast where this week we're examining the area of AI regulation.

Sabina

The AI industry has been going from strength to strength over the past several years, with machine learning technology becoming increasingly widely available to businesses, along with a stream of breakthroughs in research and development. However, this explosion of AI capabilities has also brought its share of problems.

Adam

Questions of model transparency, implicit bias and ethical deployments have frequently been levelled at efforts in this space. And numerous campaigners have called for governments to introduce legislation, which will place greater controls on the development and implementation of AI systems.

Sabina

Joining us this week to discuss the issue of AI regulation, whether it's necessary and how it might be implemented without stifling innovation is Cindi Howson, chief data strategy officer for analytics software vendor ThoughtSpot. Cindi, great to have you on the show.

Cindi Howson

Great to be here, Sabina, and Adam.

Adam

So Cindi, can you tell us a little bit about what ThoughtSpot does?

Cindi

Sure. So ThoughtSpot is the modern analytics cloud platform. We use search and AI-driven insights to allow people to find the meaningful insights in their data. Within the context of AI, we would call this more narrow AI. And yet still trust and transparency is very important. So if we generate an insight using AI, we also will give the users full transparency over the inputs. So if gender was an input, or postcode, things like this, and users can choose to remove those variables from the input to the AI.

Adam

So Cindi, what is the current state of AI legislation?

Cindi

Well, I think you'd have to put some boundaries on that down to the city-country world region. You know it. So it really does vary. I would say there's not strict regulation per country. In the UK, it's more about innovation. There's a lot of ideas and proposals out there. But getting very precise, is something banned. That is more the exception.

Adam

So it's kind of quite fragmented at the moment.

Cindi

Yes, fragmented and inconsistent. But in its early days, let's say.

Adam

So what's the impact of that? Do you think from the perspective of building and deploying AI technologies?

Cindi

Right now, in terms of building and deploying? I don't think there is a big impact. If you think about the technology providers working on AI systems, what they want from regulation is a level playing field. But they do not want innovation stifled. what citizens want is all the good that AI can bring. And I don't think we talk about that enough. I think there's still a lot of fear about AI. And that is where we need informed regulation.

Sabina

That's a very interesting subject here, because, on one hand, this regulation is needed. But I remember I remember covering research in December 2021, which found that 70% of UK businesses, well, the majority of UK businesses in that study said about data regulation was stifling AI innovation. And many, like 70% needed more information to help them navigate this very complex legal requirements surrounding especially data collection and use to vent sort of like to be used in artificial intelligence. And how do you see that, especially in the, in the market at the moment?

Cindi

Well, I mean, so So let's parse that a little bit. And you also talked about the data collection, which then we need data to build AI. And this is actually where the problems start because we do not have enough of a recognition that all data is biased. And let's also take some examples. So one of the hot buttons in AI is really facial recognition. There are some issues, let's say also with financial services and discrimination there. So if we think about some of the broad based AI facial recognition where we do not want it is we do not ever want to arrest somebody based on a match, a potential match of a photo scanned from somebody walking down the street. That's invasive, it's a violation of privacy. And the degree of accuracy is not high enough, particularly with minority communities or people with darker skin tones. So we don't want that. But I will also say when I visit the UK, I love the facial recognition at London Heathrow Airport, you know, the lines there have gone from two hours to about five minutes to immigrate. I love the way AI facial recognition is being used to rescue children from human trafficking. So this is the good of AI. But we need to separate it from when it can be used to unintentionally harm and create bias at scale, really.

Adam

So what role do you think legislation can play in helping to, I guess put in guardrails for that kind of that kind of potentially harmful use case that you've touched on?

Cindi

Yeah, so I see legislation in general, as just the moral minimum company should be better than legislation. Legislation is, in a way, a reaction when companies have not behaved in the best interests of the citizens and sometimes their stakeholders. So maybe in the rush to get an algorithm out there. They didn't do all the vetting of what was the data used to train the model. And again, we have to go back to all data is biased, and how do we overcome that? We need it to be explainable, not to the point that you're revealing intellectual property, but more that the human interpreting the AI model can say, oh, I can see where this would be a problem. And so the regulation is the moral minimum companies have to be more proactive on these other aspects.

Sabina

How do we get companies to be more proactive? Because it seems like they, it would be great to assume that they follow, you know, they are better than for roles, but unfortunately, we've seen when in many cases, but they really do take advantage of any potential loophole. And especially in you know, in relation to data collection, or even, you know, full on, full on the scraping from, you know, social media, you know, any, for facial recognition usage. We've seen a lot of abuses of, of data, I think privacy, what I call it data privacy requirements, or data protection. My question is basically, what can we do to get companies to actually behave themselves and restrict regulation?

Cindi

How do we make well, companies don't want, again, companies want regulation only to the extent that it levels the playing field. But what's also not helpful is if a company has invested so much in AI and bringing a product or an algorithm to market, let's look at the Apple Pay and the credit card. And then they found out afterwards, oh, wait a minute. There's some biases in here. Why is the woman who earns the higher salary, better credit score, getting a lower credit, than her husband, is what happened in that situation? So once a company has invested in an AI application, that's almost a little too late. So we need education. So it has to be a multifaceted approach. And this is where I think it has to be education of both the customers or people that benefit from the AI. And so that's us, the citizens. It also has to be the people building the models. And I was very discouraged to read a data point from a McKinsey survey, that even the best in class companies, only 36% of the best companies that AI leaders, as McKinsey dubs them proactively looks for biases in their data. And that's where a lot of the problems start. So this is really an education of the AI and data science community. And then it really has to be conversations with a broader range, a more diverse set of stakeholders, the customers as well as the company providing it, as well as community watchdog groups in the UK, I follow the work of Big Brother UK. So academia I think has a role to play here. This point of diversity is a very pernicious problem, because unless we have diverse developers working on these AI models, it's the unintended outcomes and the unintentional bias the questions that you did not think to ask

Adam

it's unknown unknowns, right? Yeah, yeah.

Cindi

I mean, again, financial services. Let's take this: if you train your data, going too far back, and I lived in Switzerland for eight years married to a Brit, because I was married, I was not allowed to have my own bank account. This is five years ago right now. So if you trained your model on historical data going back 25 years, well, I'm going to look like a big credit risk, a bigger credit risk. So this is a problem. Now, a woman knows this rule deeply. If I only have male developers working on this, then I may not even think, Oh, wait, if I go too far back, that data is biased.

Sabina

I think we especially see it with, like you said earlier minorities, but a lot of algorism, especially in facial recognition are trained on white faces, on the Caucasian faces. And yeah, I think the biggest problem is about a lot of the times when it comes to facial recognition software it classes. Black women as men, it doesn't seem agenda for black people a lot of times. And, and yeah, it just stems from like, maybe not complete, like, like a very big like problem of diversity issues in the tech industry. This is what basically showcases Yeah,

Cindi

yeah, Sabina. It's the diversity of the data. It's the training data. So this is where I do think synthetic data may help with some of these things. This is still early days in the industry, but there are some companies working on this. But it's then so you only have so much data available. So recognise that the data is biased account for that in the model development, and then reveal the limitations. So this is also where AI on its own. We're not We're not ready for that it's human plus AI. So use the facial recognition, or whatever use the algorithm to inform your research your decision, but then it has to be ai plus the human using both.

Adam

So just to bring it back to the question of legislation, then we've talked a lot about the knowledge side of things and making sure that you're asking the right questions. When you're building an algorithm or an AI system, which a lot of organisations currently aren't doing. Do you think then this is an argument for imposing, if you like, due diligence requirements on companies that are looking to build AI systems?

Cindi

Yes, and this is where I think so regulation is almost just, you don't want it to be so precise that it renders AI useless, and people will stay out of the market. You want regulation to protect those who might be harmed from AI. And so having guidance is saying it should never just be an AI only decision, whether it's in criminal sentencing, or there was again, a mistake about something about who could get certain retirement benefits in one school system. And so you want the AI regulation to prohibit that. Now, can we get so precise to say there has to be a degree of transparency or Explainable AI to say what the inputs were to a particular model. I think that's good. I think that degree of regulation does not invade somebody's IP, or encroach on somebody's intellectual property. But once you start saying you have to share the full code, then then you can forget it.

Adam

But I think there's, before you get to that stage, even I think there's an argument for saying in the way that you know, you have things like Know Your Customer regulations, I think there's an argument for saying, Okay, if you want to implement an AI system, if you want to even, you know, build an AI or machine learning driven system, these are the questions that you need to be able to demonstrate that you have asked internally, before you start putting pen to paper with the with the code, you know, you need to have, you need to have asked, you know, where are we getting our data from? Is it as unbiased as can be reasonably expected? You know, what are the, you know, what the range of applications that we're looking to put this AI system to? Are there any unintended consequences that this could potentially have? And asking those kinds of questions before you start on a project? You know, we've heard from multiple sources throughout the industry is how you build robust and beneficial AI models.

Cindi

Yes, and I think your point, so doing this early in the process should be something that companies are doing, regardless of regulation. Now, if you want to tell them, they have to do it, fine. But then I would also get more prescriptive and say, Who is the contrarian reviewing the unintended consequences? If you look at what happened with Timnit, at Google, she was and one of the leading AI researchers, she spoke out against some potential harm from some of the AI. And we still don't know the full details but was fired. So then being a contrarian, and an employee is difficult. Having a contrarian from a marginalised group who is brainstorming, and identifying the unintended consequences, again, is a best practice, should it be regulated? Possibly.

Sabina

When it comes to the self regulation, what do you think about companies such as Fujitsu, for example, establishing their own AI, like governance offices, we've seen that on the in late January this year. So that was only a few weeks ago, really about that Fujitsu established its AI ethics and governance office. What do you think about companies taking the steps to sort of like establishing their own sort of like, self regulation? Office like that?

Cindi

I think it's a great idea. I think all companies should be doing this and doing this proactively. But again, I would want to know, what is the composition of that AI ethics review board? How diverse is it? Both in terms of the professionals, and also the who are the groups that may benefit from the AI? And who might be potentially harmed from the AI? You need to have both as part of that? This is almost where at one point I wrote about, should we have just like, there's for doctors, a Hippocratic Oath, should there really be for AI builders a kind of oath or do no harm?

Adam

At the very least that kind of code of practice?

Cindi

Yes, yes. And and, you know, recently, I had an interesting conversation with the chief data officer at a company on the data chief podcast. And we were talking about how it's really a failure of the data science education system, where the developers are rewarded, and academia rewards them for how much their model improved, and they are not paying enough attention of what was the training data set. And given that I come from a data background, to me that is the root of so many problems. And so we have a disconnect between AI developers, data science professionals, and data professionals. That really feeds the AI models.

Adam

What it kind of comes back to a lot for me, is there really isn't any oversight of AI, specifically in the way that there is for other elements of technology. I mean, in the UK, for example, we have the Information Commissioner's Office that looks into things like data breaches, and you know, data protection and all of that kind of stuff, which overlaps with AI in a lot of cases. But I think there is a strong argument for having an organisation like that, that is specifically focused on kind of ensuring and enforcing and advising on AI best practice, because it's, it's not going away, and it's only going to get more influential.

Cindi

Yes, so some of these best practices I see are coming out from different regulating and governing bodies. So they are just guidelines, the degree that practitioners are aware of them and follow them vary. So for example, under in the US, under the Trump administration, it was much more hands off, there was the federal data strategy that had aI recommendations and guide guidelines in there. Under the Biden administration, there is more coming out from the OSTP, the Office of Science and Technology. And and we once again, have a US chief data scientist, we did not have that here in the last four years. So but all of these are frameworks, they're frameworks. They're not required practices.

Adam

They're not binding in any way. Exactly.

Sabina

Yeah, I think in the EU, we're seeing regulation come out, which is actually legally binding. And is basically we'll see for implementation of fines, like, which are very similar to how the GDPR fines work. But this will be basically used, as, you know, fines for abusing artificial intelligence. misuses? Yeah, well, yeah.

Cindi

And this is where I just think we kind of put the cart before the horse here. So because again, most of where AI goes wrong, was unintentional. So we can say, and I, if I remember correctly, it's 6 million euros, or sorry, 6% of turnover, or 30 million euros, whichever amount is higher. Now, defining the harm here, and where did it go wrong? Was it really the model? Or is it how somebody used the model? If it's a self driving car that killed somebody, and it was a decision between hitting a tree or hitting a little old lady crossing the street? And yet the car manufacturer or the person developing the AI that drives that car, If they said, you know, it's never recommended that you put it in self drive mode in a neighbourhood, Well, who's really at fault here? Who's really involved?

Sabina

Yeah, well, there's a change in that I think there's supposed to be another like changing law about this. Because technically, I think that changing the way sort of like have a responsibility of the so called driver of the car, but it's technically not a driver anymore, it's, I think there's going to be like, the person in the car can be sort of like they'll have due to the car being self driving. But that driver has less of an authority then, than what we saw in previous sort of like in normal car models. So again, it's like, the waste of like, the law has to constantly be updated. How do we stay sort of, like on top of, you know, technology being developed? And how many, you know, and how often should we review these laws really?

Cindi

So the first question, how do we stay on top of this, it has to be education. And education, not just for the data professionals, and the AI professionals, it is up to every citizen to understand the good of AI and the bad. You know, the same thing is true with GDPR. GDPR is Europe-led here, California came out with CCPA later, but your blood here really is a way of protecting the individual's data privacy, but there were some negative consequences in that it's harder to get personalised recommendations like I want that loyalty coupon or what have you. So every citizen has to Be educated about this. And if I can make a recommendation I think of in the analytics industry, a groundbreaking book was Moneyball and later made into a movie. To me, every family should watch the documentary coded bias, that details some, it's on Netflix.

Sabina

I really liked it.

Cindi

Yeah. And it is it doesn't get so deep that you'll get lost in the technology. The other one would, would maybe also be the social dilemma. Now I would like a more balanced view, because I want people to understand the good of AI, whether it's again, the human trafficking or just look on your phone, look at your pictures on your phone, and filter by cat or dogs. See what you get. I thought it was hysterical. I was I was looking for is we recently had Pi Day 3.14. I think in the UK, it's it's 22.7 is your day for this. But I was looking for photos of pies and a picture of a stuffed bear came up a stuffed animal. Okay, but AI was not working there. But I don't think every citizen understands enough of what AI really is. They think it's just some mysterious thing that tech companies have invented. And yet data is part of our everyday lives. AI is part of our everyday lives. It is what allows you to order an Uber, it is what allows you to immigrate faster. When going into different countries.

Adam

on that basic level is predictive text, right. I mean, that's something that everyone is familiar with. predictive text essentially, is a very basic form of AI.

Cindi

Yes, yeah. And, and even so, so think of all the good I mean, AI is being used to expedite cancer recognition. This is huge. So I think of AI, it is the best of times, and the worst of times, and if we do not get this right, and to me, regulation is an afterthought. It's a moral minimum. We have to have this multifaceted approach, education of the professionals, but also the citizens. What do you want? What do you want AI to do for you? And what do you not want it to do? So a lot of times, we're just not being proactive about the potential harm, and in the risk for profit, and the race. And let's also keep in mind, this is not just a single country race, this is a global race. So this is where we want regulation to level the playing field to protect people who might be harmed. But we do not want it to stifle innovation, because there are countries that are less ethical about this, that will develop AI faster, and we do not want that.

Adam

So with that in mind then, although specific regulation isn't yet eminent companies can still ensure that they're approaching the topic responsibly and developing this technology in a safe way that's going to provide actual benefit. What would your top tips be for ethical AI development?

Cindi

The first one is Sabina mentioned, have a review board, make AI ethics core to your data science and AI programme. And make sure that you have some external stakeholders there, the contrarians and the people, not only who will benefit from it, but who may be harmed from it. The other big thing is education. Recognising where bias starts, and just acknowledging that all data is biased that alone is not something that we have enough recognition about.

Adam

Well, I'm afraid that's all we've got time for on this week's show. But thanks once again to ThoughtSpot’s Cindi Howsen for joining us.

Cindi

Thank you, Adam and Sabina, it's been lovely.

Sabina

You can find links to all of the topics we've spoken about today in the show notes, and even more on our website: itpro.co.uk.

Adam

You can also follow us on social media as well as subscribe to our daily newsletter.

Sabina

We'll be back next week with more analysis from the world of it but until then, goodbye.

Adam

Bye.

Uber has been granted a 30-month licence to operate private hire vehicles in London.

The ride-hailing company confirmed in a tweet that it had secured a two-and-a-half-year licence from Transport for London (TfL), adding that TfL rightly holds its industry to the highest regulatory and safety standards and it is pleased to have met their high bar.

The company said that as it continues to serve in London, it remains focused on raising industry standards in all areas. This includes offering drivers the benefits and protections they deserve, ensuring all Londoners can get around safely and becoming a fully electric platform by 2025.

"Uber has been granted a London private hire vehicle operator’s licence for a period of two and a half years," a TfL spokesperson told IT Pro.

Uber has had to fight for a licence to operate in London over the past few years. In 2017, TfL said it wouldn’t issue Uber a private hire operator licence, stating that the company wasn’t fit and proper to hold one.

Then, in June 2018, Uber was granted a 15-month probationary licence following a two-day hearing in London. The judge said the company was considered fit and proper to hold a licence, after hearing of the sweeping operational changes it had made since TfL chose not to renew its licence the prior year.

However, in November 2019 it lost its licence to operate once again, with authorities saying it wasn’t a fit and proper operator. Authorities recognised it had made a number of positive changes and improvements but wasn’t enough to satisfy safety officials.

Finally, in September 2020, it won a licence to operate in London after plugging IT gaps. It made changes to its systems and internal processes, including the addition of software tools and more automation. This was enough to satisfy Westminster magistrates court, who ruled in favour of Uber after TfL refused to give the company a licence extension.

Uber securing a 30-month licence comes after the Supreme Court in the UK ruled that Uber drivers must be treated as workers instead of self-employed, which could lead tp minimum wage and holiday pay for thousands of Uber drivers. The Supreme Court said the ride-hailing company has to consider its drivers as workers from the time they log on to the app until they log off.

17 London councils don’t have a cyber insurance policy in place to provide support in the event of a cyber attack on their IT systems.

That's according to cyber security firm ProLion, which sent Freedom of Information (FOI) requests to each of London’s 32 borough councils plus the City of London in December 2021. In their responses, 17 local authorities admitted they are not properly insured against the risk of a cyber incident.

What's more, five councils refused to say whether or not they have in place a cyber insurance policy, citing Section 31 of the Freedom of Information Act which exempts the disclosure of information that could “prejudice the prevention or detection of crime”.

One council said that disclosing the information relating to cyber insurance could lead to an increased risk by encouraging an attack, said ProLion. Other councils stated that the disclosure of such information would give cyber criminals insight into possible vulnerabilities, or embolden them to attack those most at risk.

Eight councils were ambiguous or unclear in their response to the FOI, while three councils didn’t respond to the request at all.

“Ransomware attacks have continued to rapidly grow both in frequency and sophistication,” said Steve Arlin, VP Sales in UK, Americas & APAC at ProLion. “The situation demanded action a long time ago, and the issue is now so large that businesses can’t afford to be reactive in their approach to cybersecurity.”

ProLion pointed out that organisations of all sizes and sectors are viable targets for opportunistic cyber criminals. However, the public sector is likely to hold more sensitive data, including council tax, medical records, and financial information. “This might explain why they are a preferred target and more likely to pay any ransom demands,” stated the company.

Arlin added that for organisations like borough councils, the risk of large volumes of sensitive personal data falling into the wrong hands means that it could face huge UK GDPR related fines as a result.

ProLion also found that the research provided insights on councils’ approach to cyber security. One representative for a council said that they discovered the cyber insurance market to be very challenging and therefore difficult to obtain competitive quotations. They added that they are currently looking at both insurance and a cyber consultancy review, including self-assessments as a solution to their cyber risks.

DC Attorney General Karl A Racine has proposed legislation that would prevent algorithmic discrimination. The Stop Discrimination by Algorithms Act (SDAA) would prevent companies from making automated decisions that discriminate against marginalized groups in the District.

The Center of Privacy and Technology and Communications and Technology Law Clinic (both part of Georgetown University Law Center) helped draft the bill, in conjunction with civil rights nonprofit Color of Change.

The Act forbids discrimination by algorithms that make decisions about credit, education, housing, employment, and public services. Companies must also inform individuals about how they use algorithms to make those decisions.

Organizations must document how they build their algorithms and how they make decisions. They must file annual audit reports with the Attorney General in which they check their algorithms for discrimination.

The proposed legislation comes with teeth, as the it allows the Attorney General to penalize companies that violate the rules by up to $10,000 per violation. It also permits private lawsuits.

The text of the bill warned that algorithmic decision-making systems that don't account for bias can harm marginalized groups. "Despite their prevalence and the potential problems they pose, algorithms are poorly understood by most individuals, in part because of the many entities involved and the lack of accountability among those entities," it said.

The move prompted support from organizations and individuals including Timnit Gebru, the AI researcher who complained that Google silenced her concerns about its AI algorithms.

"At this point it should be clear that multinational corporations will not self regulate," said the scientist, who this month launched the Distributed Artificial Intelligence Research Institute. "To the contrary, they push out people with the slightest criticism of their proliferation of harmful systems. Without laws requiring companies to assess the potential for discriminatory impact of their algorithms, what they do instead is eject people like me who attempt to do that internally, even though this was literally in my job description."

The proposed legislation mirrors efforts at the federal level. In 2019, Democrats introduced an Algorithmic Accountability Act that would have pressed the Federal Trade Commission to create rules for assessing bias in automated systems. In May this year, Democrats tried again with the Algorithmic Justice and Online Platform Transparency Act of 2021.

The FTC has already warned organizations to use AI responsibly, threatening potential action for those that fail to do so. It has issued guidance for companies to follow.

To truly be effective, today’s boards need to keep pace with new technologies, security threats, and economic developments. Board management software can drive efficiency and collaboration, while remaining secure and adoptable across the organisation.

When evaluating board management software providers, it’s critical to find a solution that provides a streamlined, secure experience not just for board members, but anyone else who will be using it.

Download this whitepaper to learn how the right board management software can:

• Increase efficiency & streamline communications
• Improve security
• Save time and money
• And practice better governance

Provided by

.

As businesses undergo changes in the new post-pandemic world of work in order to stay operational, as well as resilient, these changes are also driven by stakeholders demanding more.

There is an increase in focus on environmental, social and governance (ESG) factors today and as organisations look ahead to next year’s strategy, they need to incorporate sustainable and flexible governance practices in order to be more informed, secure and goal-focussed.

Download this guide to understand five key focus areas that business leaders need to consider as they plan their governance and compliance practices for the coming year.

Provided by

Modern technology is evolving just as fast as the business landscape and to stay ahead, organisations need to remain informed, protected, collaborative and goal-focussed in real time and in all situations.

Having modern governance can enable your business to remain productive while progressing with your digital transformation, so that you can emerge stronger than the competition.

Download this whitepaper to learn best practices and insights in:

• Strategy & governance
• Security & collaboration
• Risk & accountability

Provided by

The US Department of Commerce has created a committee to advise government decision makers on artificial intelligence (AI)-related issues. The Department said the National Artificial Intelligence Advisory Committee (NAIAC) would advise the president and other federal agencies on the technology.

In January, the National AI Initiative Act of 2020 mandated the committee when it was passed as part of the National Defense Authorization Act. It also created a National Artificial Intelligence Initiative, which would promote US leadership in AI research and coordinate AI efforts across federal agencies. As part of the initiative, the Act established a National AI Initiative Office (NAIIO) in the White House Office of Science and Technology Policy (OTSP).

The committee has input from the secretaries of state, defense and energy; the OTSP director; the director of national intelligence; and the attorney general.

The committee's duties include reporting on progress in implementing the national AI initiative. It will also explore various issues, including equity and racial justice, US competitiveness in AI, and how AI affects the workforce. Committee members will advise how the US government can best cooperate with other countries on AI and promote accountability and legal rights.

The Department of Commerce is working with the NAIIO to recruit committee members from academia, industry, nonprofits, civil society, and federal laboratories. As an agency within the Department of Commerce, NIST will also promote responsible AI use while providing administrative support.

This work follows concerns over government competitiveness in AI and cross-agency handling of AI issues. In March, another government-commissioned group sounded the alarm about the dangers to national security if the federal government didn't increase its focus on AI.

The US is considering implementing a 25% tariff on a selection of British goods that enter the country in retaliation to the UK’s digital services tax (DST).

The goods that the tariff will affect include industrial robots, clothing and ceramics, according to a list published by US officials.

The Office of the United States Trade Representative (USTR) seeks to collect duties on UK goods in the range of the amount of DST that the UK is expected to collect from US companies, which it estimates to be approximately $325 million (£236m) per year.

“The United States is committed to working with its trading partners to resolve its concerns with digital services taxes, and to addressing broader issues of international taxation,” said USTR ambassador Katherine Tai.

“The United States remains committed to reaching an international consensus through the OECD process on international tax issues. However, until such a consensus is reached, we will maintain our options under the Section 301 process, including, if necessary, the imposition of tariffs.”

The UK is not the only country affected by this decision, as are Austria, India, Italy, Spain and Turkey who are also under consideration for the 25% tariffs on goods from their countries as they have implemented a similar DST.

The USTR has dropped its investigations against Brazil, the Czech Republic, the EU and Indonesia for now as these countries have not adopted or implemented the DSTs under consideration when the US began its investigations. It made it clear, however, that if these countries adopt or implement a DST in the future, the USTR may initiate new investigations.

A UK government spokesperson told IT Pro that like other countries around the world, the UK wants to make sure tech firms pay their fair share of tax. The spokesperson said the tax is “reasonable, proportionate and non-discriminatory” before revealing that it is also “temporary”.

“We’re working positively with the US and other international partners to find a global solution to this problem and will remove the DST when that is in place. Should the US proceed to implement these measures, we would consider all options to defend UK interests and industry,” added the spokesperson.

The UK announced its DST in October 2018, which is a 2% tax on revenues of search engines, social media platforms and online marketplaces that are profitable, and generate over £500 million per year in revenue.

The US’s plans to challenge the UK’s DST originated in June of last year under the Trump administration, where it made it clear it would investigate all countries that are adopting this new form of tax. The US claimed that the tax schemes were “designed to unfairly target our companies.”

In August 2020, reports emerged suggesting that the UK government was considering dropping its DST to avoid any conflict with the US during its trade talks.

Furthermore, it was reported that Amazon would not be affected by the DST in the UK, but smaller traders using its online marketplace would face increased charges. This was seen as a benefit for the tech giant, which would effectively gain a price advantage on competing goods it sells directly to consumers.

Despite this, last month the UK government was considering implementing an “Amazon tax” to help the country recover from the COVID pandemic. The Treasury reportedly invited tech firms and retailers to discuss a potential Online Sales Tax, following the news that Amazon’s profits skyrocketed by 51% in 2020.

The European Union might force US tech giants such as Amazon, Facebook, and Google to share their vast collection of customer data with smaller rivals, according to a new draft of the Digital Services Act seen by the Financial Times.

The new regulations, which aim to increase responsibility and liability for social media firms and the content on their platforms, are set to be proposed by the end of this year.

According to the draft, which reportedly includes 30 paragraphs of prohibitions or obligations, tech giants will be banned from using “data collected on the platform . . . for [their] own commercial activities . . . unless they [make it] accessible to business users active in the same commercial activities”.

It will also prohibit the so-called ‘gatekeeper’ platforms, which are in charge of online marketplaces, from using “data received from business users for advertising services for any other purpose other than advertising service”.

The draft also suggests that tech giants will be banned from treating their own services on their sites or platforms in a preferential manner that could disadvantage rivals. Companies might be prohibited from pre-installing their own apps on hardware devices, for example.

According to the FT, EU legislators might also force tech giants to allow users to uninstall any pre-installed apps on devices such as smartphones and personal computers.

News of this regulation comes days after the EU internal market commissioner Thierry Breton told the FT that the Digital Services Act could have the power to exclude large tech companies from the single market altogether. However, it is anticipated that the tech giants won’t back down without a fight.

Earlier this month, Google asked the European Commission to "clarify" its expectations towards tech companies regarding the Digital Services Act. The firm submitted a 135 page document calling for the EC to avoid a "one-size-fits-all" approach and hit back at the legislators’ choice to label tech giants as ‘gatekeepers’.

“In certain sectors, the platform may have market power; in others, it may be a new entrant or marginal player. The digital ecosystem is extremely diverse and evolving rapidly and it would be misguided for gatekeeper designations to be evaluated by reference to the position of an entire company or corporate group,” argued Google.

Changes that Uber has made to its systems and internal processes, including the addition of software tools and more automation, mean the company is now “fit and proper” to hold a license to operate in London.

Following an almost year-long regulatory process, the Westminster magistrates court has ruled in favour of Uber after Transport for London (TfL) previously refused the ride-hailing platform a license extension in November 2019.

Part of the reason for the refusal was due to breaches that put passengers at risk, including a change to Uber systems that allowed unauthorised individuals to upload photographs to legitimate drivers’ accounts.

The decision comes three years after TfL first put pressure on the company to improve its systems and its practices, declaring it was “not fit and proper to hold a private hire operator license” in September 2017.

The Westminster magistrates court, however, has concluded after an examination of the evidence that changes to the way Uber operates means the company is not fit to operate in the capital. Notably, Uber has “plugged” the holes in its IT systems that have led to issues over the years, as identified by a report compiled by Cognizant.

Flaws in the release management systems that oversee how Uber’s software is updated have been addressed, according to the report commissioned in April this year, and regulatory breaches are therefore less likely to happen. In particular, Uber has increased the level of automation in these processes, improved software testing, as well as increased overall governance over releases.

“Cognizant instructed by TfL had initially found that ULL’s ITSM processes were not to appropriate standard,” said deputy chief magistrate Tan Ikram. “TfL accept that there have been subsequent changes.

“Despite their historical failings, I find them, now, to be a fit and proper person to hold a London PHV operator’s licence.”

One software issue highlighted by the ruling involved the way in which seven drivers were able to continue driving after their MOTs had expired. Uber became aware of a software issue in January 2020 that was causing this error - and implemented a fix in February. The manner in which the issue was identified and patched serves as an example of an improvement in the way Uber manages its internal processes.

The regulatory battle between Uber and TfL has taken several twists and turns since 2017, with the company handed a 15-month license to operate in London in June 2018. This is after TfL ruled the ride-hailing firm shouldn’t operate due to concerns about public safety and security regarding Uber’s failure to report crimes to the police.

This license was then just extended for two months last September and was attached with conditions to ensure passenger safety. The short duration was so that TfL could closer scrutinise any additional information it was requesting ahead of future licensing decisions.

Uber’s license to operate was then once again denied in November 2019, despite the company making a host of changes to the way it operates. These changes, however, weren’t enough to convince regulators the company wouldn’t put passengers at risk.

The length of the license will be 18 months, according to various reports including that published by ITV News.

Top IT pros understand the value of a well-oiled IT machine that is efficient, safe, abides by compliance regulations, and fully serves the strategic business needs of the organisation through proper IT governance.

Now that Office 365 is running the productivity show, IT managers need to ensure the Microsoft cloud suite helps meet all these goals – and that means supporting true IT governance, regulatory compliance, and that O365 and its end users comply with the organisation’s security policies.

This whitepaper delves into governance as it applies to O365, exploring why it matters and how to achieve compliance, as well as offering advice on overall IT governance.

German property company Deutsche Wohnen has been hit with a staggering data protection fine for hanging onto a treasure trove of personal and financial data of former and current housing tenants.

The firm was fined 14.5 million (approximately 12.5 million) after German data protection investigators found it had been holding information in an archival system from which it was impossible to delete records.

This highly sensitive data, which belonged to former and current tenants, included salary information, extracts from employment and training contracts, tax and health insurance records, as well as bank statements.

This data was stored in the system on an indiscriminate basis, according to German data protection authorities, and without appropriate consents. There was also no legally-defined basis for collecting and storing the data.

Deutsche Wohnen was found to have violated the General Data Protection Regulation (GDPR) under Article 25 (1), which covers the need for businesses to ensure they're adhering to data protection principles such as data minimisation. The firm also violated Article 5, which related to the core ethical principles related to processing data.

Businesses are instructed under GDPR not to keep personal data beyond the legally-established reasons they have identified, and for a period no longer than is required in order to carry out the processing.

The German property firm was first warned about its archive system in 2017, according to the data regulator, and requested to change its archiving system as a matter of urgency.

Although the firm changed the archive system in March 2019, the changes still did not establish a lawful basis for storing the personal data and GDPR proceedings were launched, spanning the period between May 2018, when GDPR came into force, and this point.

The initial financial penalty was actually much higher, at roughly 28 million (24 million) based on the firm's annual turnover at more than a billion euros. GDPR fines can fall anywhere in the order of 20 million, or up to 4% of a firm's annual turnover, depending on the severity of the violation.

This initial fine represented 2.8% of the firm's turnover but was reduced because the company had actually taken concrete steps towards correcting its data storage mechanisms, and co-operated with regulators during the process.

IT Pro approached the property giant for its response to the GDPR fine.

While Brexit has proved a contentious issue for many, the organisation spearheading digital transformation within government has seen it as an opportunity to restore its ailing reputation as a prominent force.

It's generally seen by businesses as disruptive, but Government Digital Service (GDS) is using Brexit as an "accelerator" in achieving its long-term ambitions, with the urgency of civil service preparations also ramping up digital transformation efforts in government.

Since establishing the gov.uk platform in 2012 and branching this system out to more than 2,000 domains and subdomains, GDS fell by the wayside and was effectively "gutted" three years ago. Its former chief Francis Maude even declared GDS all but dead given the changing nature of digital transformation in the public sector.

The Brexit accelerator

GDS is entering a new era under the interim leadership of director general Alison Pritchard, who cited Brexit as a catalyst for the organisation's plans, with the key to these plans being data.

Where the first era for GDS was establishing a disruptive force in government, the second centred on building out the profession. This latest phase, however, involves honing functionality and improving operational capabilities.

"EU exit has been a really important accelerator towards that development and embedding of function," said Pritchard, speaking at GDS' flagship Sprint 19 conference.

"We've seen that come to pass with the operating of the function across boundaries both within the way that we work with colleagues in other departments, and nations, and also the way that other functions have worked together."

GDS sees Brexit as not just a chance to achieve its core aims quicker, but to inject fresh life into an ailing organisation by also orchestrating the way other departments are preparing for EU withdrawal.

The main priority for GDS, now, is collecting volumes of citizen data to analyse behaviour, and service government platforms with insights to provide a more intuitive and tailored experience. The idea is to offer people a seamless digital interface with the government at key moments through their lives, from births to funeral planning, with anything and everything in between like buying a house or starting a business.

No more bumbling along'

Although these aims have been in the pipeline for some time, according to the chief executive of the civil service John Manzoni, it's the desire to adapt to a volatile landscape that's bringing them forward.

"The Brexit opportunity, of course, is forcing the pace on a number of issues, and just to highlight one, the possibility for establishing a single portal through which citizens interact with government, and then joining everything up behind," said Manzoni.

"There are enormous amounts of work being done, particularly around the Brexit thing, being done at real pace; an extraordinary effort. These are some examples of how do we use what's going on in our environment today to accelerate where we really want to get to'.

"We didn't have to do that, of course, we could have done it in the old way. We could have stuck in our existing silos and we could have bumbled along. No. We've got to use these opportunities to accelerate change and be the civil service we ought to be."

Manzoni added this entire process has helped to break down the existing silos across government and bring about a more cohesive approach to digital transformation.

Breaking down barriers by creating agile teams

For now, at least, efforts have centred on ensuring departments and wider society can be as prepared as possible for any disruption caused when the UK leaves the EU. GDS has seen an opportunity to use its flagship gov.uk platform as a key plank in these efforts, with the 60-second Brexit checker tool, hosted by GDS, serving as one key example.

It's largely involved ensuring that relevant people have as much information as possible, according to GDS policy and strategy lead Lyndsay Baker and content lead Jon Sanger. Some government departments, for example, have been reminded they have responsibilities for multiple areas of policy, while by contrast, a set of multiple departments may be told of their responsibility for a single policy area.

This process has involved building agile teams that span communications, content, and policy areas, among other roles and functions, all working together and coordinated by GDS. This has led to the creation of a model for emergency planning' that can then be replicated in the future, particularly in the reams of work to be done post-EU withdrawal.

"Knowing what data and evidence is available to identify and solve problems, and running user research sessions, creates clarity on what you need to build," Sanger said. "Creating the agile, multi-disciplinary teams that use those processes means you know how to build it.

"And the important thing here is empowerment; making sure those teams have the expertise and the ability to decide what good' looks like and that their organisations will support them."

Emulating Netflix for smarter public services

For any of GDS' aims to come to fruition, the organisation needs a rich and substantive dataset of user interactions which can be used to tailor experiences across the entire gov.uk platform to individual users. Civil servants and ministers characterise this as emulating the way Netflix and Citymapper process user data to offer a more intuitive user experience.

Although such models are considered normal, customers and users still value measures to preserve privacy and ensure their data cannot be used to micro-target them with messaging and advertising.

Alarms rang when BuzzFeed News reported the prime minister's most senior aide Dominic Cummings weighed in on GDS' plans to gather user data and subject this to high-quality analytics. However, officials maintain there will remain a complete separation between this work to improve the service offered by the gov.uk platform and political activities.

Given and Cummings' role in the contentious Vote Leave campaign, and the political nature of Brexit, concerns have been inflamed. GDS claims the pace at which this process of data collection and analytics is happening, however, is necessary as it expects hundreds of thousands, if not millions, of people to visit the government website for information in the lead up to 31 October.

"For us to understand whether people, not as individuals but on aggregate level, are taking up services that we know by virtue of the Brexit checker that they might need," Pritchard added, "we also have a need to think about the broader campaign, where there's an iterative journey to understand how prepared, for instance, businesses really are, and whether they're engaging with the services needed.

"So it's that sense of making sure we're able to refine how we are reaching the various stakeholder groups."

The Information Commissioner's Office (ICO) has fired the starting gun for the pilot phase of its "regulatory sandbox", with ten data-dependent projects ranging from biometric tracking to consent management taking part in the initiative.

This scheme offers organisations an environment in which the UK data regulator will provide support and guidance as they develop innovative products and services that heavily rely on the use of personal data.

During the process, the ICO will oversee the planning and implementation of these projects to ensure they're fully compliant with the General Data Protection Regulation (GDPR).

"The ICO supports innovation in technology and exciting new uses of data, while ensuring that people's privacy and legal rights are protected," said the information commissioner, Elizabeth Denham.

"We have always said that privacy and innovation are not mutually exclusive and there doesn't need to be an either-or choice between the two.

"The sandbox will help companies and public bodies deliver new products and services of real benefit to the public, with assurance that they have tackled built-in data protection at the outset."

The ICO will also use this as an opportunity to observethe industry for developments in technology and innovation, and establish both the regulatory opportunities and challenges they will generate.

The first ten pilot projects were selected from 64 applicants and are run by organisations including NHS Digital, Heathrow Airport, the Ministry of Housing and Local Government, and an authentication firm named TrustElevate.

Heathrow Airport will test its Automation of the Passenger Journey programme, which involves using facial recognition technology at each checkpoint throughout the airport from check-in to boarding gates.

NHS Digital aims to work on the design and development of a central mechanism for collecting and managing patient consents for sharing healthcare data for purposes such as medical research and clinical trials.

The Ministry of Housing Communities and Local Government, meanwhile, has partnered with the Department of Work and Pensions and Blackpool Council to match personal information controlled by various parties. This is in order to understand more about the private rented sector in Blackpool and how to improve the quality of properties.

The Greater London Authority's Violence Reduction Unit (VRU), which is also part of the project, aims to integrate various datasets, including health, social and crime data, to better understand how public health and social services can be managed to reduce crime.

The ICO first teased the sandbox last year, before opening the scheme up to applications from the end of March.

The next stage will involve devising detailed plans for each project before work begins on testing the compliance of these ideas. All work is expected to be completed by September 2020, by which point these products and services will have been fully assessed.

The projects developed are expected to be fully GDPR-compliant, and run into fewer regulatory hurdles at launch.

Ambitions to curb bulk data collection practices in the government's Investigatory Powers Act 2016 (IPA) have ended in defeat as judges ruled the bill doesn't infringe on human rights.

The UK-based human rights group Liberty has expressed its disappointment after the High Court quashed its legal challenge against what's commonly dubbed the 'snooper's charter'.

The group's challenge was based on the notion that the IPA violates citizens' right to privacy and freedom of expression as outlined by Article 8 and 10 of the European Convention on Human Rights (ECHR).

Lord Justice Singh and Mr Justice Holgate, however, dismissed the claim at the high court in London today, arguing there are appropriate safeguards in place to protect people against abuse of their fundamental rights.

"This disappointing judgment allows the government to continue to spy on every one of us, violating our rights to privacy and free expression," said Liberty lawyer Megan Goulding.

"We will challenge this judgment in the courts, and keep fighting for a targeted surveillance regime that respects our rights.

"These bulk surveillance powers allow the state to hoover up the messages, calls and web history of hordes of ordinary people who are not suspected of any wrong-doing.

"The Court recognised the seriousness of MI5's unlawful handling of our data, which only emerged as a result of this litigation. The security services have shown that they cannot be trusted to keep our data safe and respect our rights."

Liberty and other human rights and privacy groups have been wrangled in a legal battle with the government over the IPA since its passage through parliament.

This fight has seen the group claim a handful of victories, including a successful challenge last year against the government's power to force communications and internet companies to store data on UK citizens.

Most recently, Liberty challenged the secrecy of the Investigatory Powers Tribunal (IPT), an independent body that judges whether GCHQ, MI5 and MI6 cyber activity remains within the scope of the law.

Previously, complaints received would lead to judgements being made in secret, but a 4-3 majority on the supreme court ruled these agencies' powers be open to judicial review, and openly challenged in court.

The European Union (EU) has, for years, been incensed with the way social media firms have allowed harmful and illegal content to spread like wildfire across their networks. But officials in charge haven't quite settled on a concrete way of tackling this.

Guidelines proposed by the European Commission nearly two years ago suggested a voluntary approach for tech companies in removing hate speech from their platforms. However, while social media sites have been digging their heels in, the threat of enforceable regulation has been growing.

In March last year, the European Commission outlined alternative plans giving these platforms just one hour to remove such content before imposing penalties.

The latest proposals, according to the Financial Times, involve literally rewriting the rulebook on how to engage with big tech. What's being dubbed the "Digital Services Act" is expected to give the EU a raft of legal powers to influence how social media platforms govern hate speech, extremist material and political advertising.

A concentration of power

The European Commission's latest proposals go so far as to wrestle away control from individual member states and funnel this power into a continental regulator.

According to Netz Politik, the German IT publication that originally broke the story, the new laws will substitute the older e-commerce directive, which stretches back to the year 2000. These legacy regulations are, quite simply, not fit for purpose in a modern age, and don't specify how they can be tailored to apply to the tech sector.

Under these new plans, however, officials will have the opportunity to craft sharper rules to fit around all facets of modern tech like cloud computing and social media. Provisions for online political advertising, especially, will have a newfound prominence given how concerned the EU has been about bad actors influencing online political discourse.

The most eye-catching aspect is certainly the creation of a new centralised EU tech regulator with enforcement powers. Where the EU's General Data Protection Regulation (GDPR) entrusted member states with statutory powers to fine organisations for violating strict data protection principles, this will do the opposite.

Once the Digital Services Act comes into effect, member states will be required to repeal any domestic legislation regarding blocking content, or bring this in line with the EU's, partner with White & Case LLP Tim Hickman told IT Pro.

"The boundary between EU law and the domestic laws in this area is complex. In particular, the proposed Digital Services Act aims to tackle the problem of hate speech.

"However, much online speech is protected by the right to freedom of expression and information, in Article 10 of the European Convention on Human Rights, a treaty that the EU does not have the power to amend."

He added domestic laws regarding freedom of expression and freedom of information fall largely outside the EU's purview. This means approaches to tackling hate speech may yet diverge from one Member State to another.

The Brexit factor

The EU's moves could potentially scupper the UK's own plans to enforce regulation of online content, subject to the outcome of the Brexit fiasco and how closely the UK and EU will be regulatorily aligned.

After months of dithering and speculation, the Department for Digital, Culture, Media and Sport (DCMS) jointly-launched proposals with the Home Office in April outlining how the government plans to tackle these very issues.

If proposals outlined in the "Online Harms" white paper come to fruition, the government will establish a statutory regulator with powers to punish internet giants if they neglect to abide by a "duty of care". In extreme cases, the state regulator will disrupt companies' business operations and order internet service providers (ISPs) to block non-compliant digital services or apps entirely.

While the EU's plans aren't too dissimilar, under its model, proposals like these for national bodies will be overridden.

One reason for this could rest with the fact a number of member states have lately elected governments of a far-right persuasion, with Hungary and Italy being notable examples. Authorities in these countries may be less likely to be decisive on the spread of some forms of hate speech and disinformation across social media networks than this proposed legislation would require. Another reason could be that countries are simply lagging behind in the process of establishing ways of monitoring and regulating harmful content online.

Targeting big tech

These plans are nakedly aimed at companies like Facebook and Twitter, with these platforms often rampant with "fake news" and content deemed harmful.

The EU and the UK argue these companies have not been doing enough to get a handle on this issue. The likes of Facebook, Twitter and YouTube have, however, actually shown improvements in the way they tackle harmful content, with a European study published in February showing as much.

For instance, during a six-week period in 2018, 89% of flagged hate speech on platforms like Facebook, YouTube and Instagram were monitored within 24 hours, with 72% of this removed. This is in contrast to a previous study published in 2016 which revealed only 40% of flagged content was examined in the same time frame, and just 28% was removed, during the same period.

There's also the prospect that regulations in this space may disproportionately benefit a select few larger companies against the wider industry. The "Online Harms" white paper, for instance, will hit smaller companies with increased costs and penalties where larger companies can simply absorb these.

"The reality is that it isn't tech companies, broadly, that the government is concerned about - it's a very small number of specific big platforms," Richard Wingfield, legal officer for Global Partners Digital, told IT Pro.

"But if you look at the scope of the white paper, it's about any company or platform that allows users to share or generate content that could be your local online newspaper that has a comments section, or Mumsnet, or blogging platforms.

"One of the unintended consequences is that you risk entrenching the dominance of the big platforms that are causing the government the most problems.

"If you impose these requirements on all of these smaller platforms, it makes them less likely to start-up in the first place - particularly if you have things like criminal liability for management of these companies."

The EU's own proposals are still being drafted, and are not expected to be published until at least the end of the year. Officials with the European Commission will engage with the tech sector about their plans, and are expected to assess the shortcomings of existing rules over the next few months.

The Federal Trade Commission (FTC) will levy a $5 billion fine against Facebook as part of a wider settlement agreed following an investigation into the Cambridge Analytica data-sharing scandal.

Subject to final approval by the US Justice Department, Facebook will face the largest financial penalty a tech firm has been handed by a government regulator for breaching data protection laws. The fine is many multiples larger than the French data protection authority's 44 million fine against Google earlier this year for violating the General Data Protection Regulation (GDPR), which stood as the largest fine officially levied until now.

The agreement, which was reached following months of negotiations between two parties, also sees Facebook subject to greater oversight, according to the New York Times (NYT). But the social media giant will not be restricted in the ways it shares users' data with third-parties.

Many, including the Observer journalist Carole Cadwalladr who initially broke the Cambridge Analytica story, have branded the settlement inadequate. Cadwalladr herself described the agreement as "a sweetheart deal", declaring that Facebook "is well and truly out of control".

The $5 billion fine represents approximately 9% of Facebook's annual turnover for 2018, more than double the maximum GDPR penalty an EU regulator can levy against the company.

But Facebook's share price actually rose as the news broke on Friday, with investors pleased the FTC's investigation will soon conclude without spilling out into a lengthy saga that dominates newspaper headlines. Moreover, the company has cash reserves of more than $40 billion, the NYT claims.

The settlement was agreed by a 3-2 majority vote of the FTC's board split based on party lines, with Republicans in favour and Democrats against.

Facebook was also found to have violated a previous settlement with the FTC struck in 2011 after the firm was required to change its privacy policies following widespread criticism.

Following the launch of its investigation into Facebook's data practices in March 2018, the US regulator had been expected to levy a fine against Facebook in the region of $3 billion to $5 billion. The outcome of the settlement negotiation was also previously thought to include a clause in which federally-appointed privacy executives would be injected into the highest levels of the company, yet this has yet to materialise.

The UK's Information Commissioner's Office (ICO) previously fined Facebook 500,000 for violating the Data Protection Act 1998 in the wake of the Cambridge Analytica scandal. This was the maximum fine that could be handed to the firm under legislation that applied prior to GDPR's introduction.

Data protection authorities in the EU, meanwhile, are still probing Facebook for a handful of GDPR violations, namely the Irish data regulator which is currently pursuing ten investigations against the firm.

Among the family of ISO 27000 international family of standards for IT systems is ISO 27001, which a security standard for computer systems that offer the procedures for keeping an organisation’s assets safe.

The broader family of standards refer to information security management systems, although this particular standard handles bundling a company’s security processes into a single management platform. Organisations that meet the requirements can be certified under the ISO 27001 standard by an accredited organisation after completing an audit.

ISO 27001 offers a framework which aims to maintain a company’s risk management strategy and ensure this is free of any policy gaps or security holes. The standard will help businesses find any gaps that may arise, which if left unchecked would create a risk to the organisation’s data. Implementing the standard in full would, in practice, ensure processes are put into motion that prevents such data risk in future.

The standard itself comprises a swathe of guidelines, certifications and systems required to help any business assess its internal procedures. Organisations may otherwise have to rely on separate services for handling the dynamic and multi-faceted risk to data, rather than the single unified approach which ISO 27001 offers.

Elements of a business may, for example, be identified as being high-risk, and may already have some procedures in place to ensure there are no missteps. Other areas within a business may, by contrast, pose less risk and may, therefore, have historically never been properly assessed or audited.

When ISO 27001 was first outlined in the 90s, it allowed for the wealth of separate processes to be brought under a single umbrella, with the standard designed to handle multiple components within a single management system. This allows managers to examine such assessments across an entire organisation as a whole.

Since its inception, ISO 27001 has been updated significantly, with a major overhaul in 2013. There were initially just five clauses, which served as the main objectives for the standard, with the update raising this to ten. They are as follows:

The standard itself comprises a swathe of guidelines, certifications and systems required to help any business assess its internal procedures. Organisations may otherwise have to rely on separate services for handling the dynamic and multi-faceted risk to data, rather than the single unified approach which ISO 27001 offers.

Elements of a business may, for example, be identified as being high-risk, and may already have some procedures in place to ensure there are no missteps. Other areas within a business may, by contrast, pose less risk and may, therefore, have historically never been properly assessed or audited.

When ISO 27001 was first outlined in the 90s, it allowed for the wealth of separate processes to be brought under a single umbrella, with the standard designed to handle multiple components within a single management system. This allows managers to examine such assessments across an entire organisation as a whole.

Since its inception, ISO 27001 has been updated significantly, with a major overhaul in 2013. There were initially just five clauses, which served as the main objectives for the standard, with the update raising this to ten. They are as follows:

1. Scope of the standard
2. How the document is referenced
3. Reuse of the terms and definitions in ISO/IEC 27000
4. Organizational context and stakeholders
5. Information security leadership and high-level support for policy
6. Planning an information security management system; risk assessment; risk treatment
7. Supporting an information security management system
8. Making an information security management system operational
9. Reviewing the system's performance
10. Corrective action

History of ISO 27001

Guidance around IT security was first introduced in 1992 when the Department of Trade and Industry (DTI) published a code of practice or IT security management.

In 1995, the British Standards Institute republished it as BS7799. This was revised over the years and in 2000, it was fast-tracked as an ISO and became ISO 17799.

In 2002, this was updated and a second part introduced - BS7799-2, an Information Security Management Specification, rather than a code of practice. This update entered the ISO fast track in 2005 and became the ISO27001.

It was updated significantly in 2013, overhauling how ISO27001 works. One major change was addressing the trend of using databases to store information rather than only physical documents.

Key guidelines in ISO 27001

Although there are many requirements of ISO 27001, the primary concerns (and those that are audited in order for an organisation to become certified) are that management must continuously analyse the businesses security risks, design and implement a collection of security controls and how to manage risks and adopt an overall management process that ensures the business is never left open to risk and that security needs are continuously addressed. Specifically, ISO 27001 requires management to:

• Examine the organisation's security holes through risk assessments
• Design and implement a comprehensive suite of security controls
• Define the scope of the ISMS
• Adopt new processes to ensure new security controls meet the needs of the business

How to become certified for ISO 27001

Gaining certification in ISO 27001 is a great way to demonstrate your company's commitment to data security, and show that you take security management seriously. When faced with two organisations, clients will usually pick the one that's certified over the one that isn't.

ISO 27001 certification is undertaken by third-party certification bodies and the processes each will analyse varies greatly.

Before the audit begins, the company's management will decide upon the parts of a business that will be certified upon completion. This can be the entire organisation or just a department or division, depending on what the management deems suitable.

Anything not included in this initial scope will not be certified and therefore, if only part of the business is certified, there are no guarantees the rest of the organisation is sticking to the guidelines.

Google, Apple, WhatsApp and Microsoft have signed an open letter with 43 other signatories opposing GCHQ's plans to embed itself in every encrypted messaging service in the UK.

The proposal put forth by the British cyber security agency would entail adding a "ghost" user to an end-to-end encrypted messaging service to oversee the content of messages, much like how a group chat would work within the service.

The 47 signatories which include privacy advocate groups, tech giants and Ivy League academics all say that while the principles outlined by GCHQ in November 2018 regarding the need to protect privacy and security are "a step in the right direction", but putting them in practice "would violate important human rights principles".

"The ghost proposal would create digital security risks by undermining authentication systems by introducing unintentional vulnerabilities and by creating new risks of abuse or misuse of systems," read the open letter. "Importantly, it would undermine the GCHQ principles on user trust and transparency."

"Any functioning democracy will ensure that its law enforcement and intelligence methods are overseen independently and that the public can be assured that any intrusions into people's lives are necessary and proportionate," said Ian Levy and Crispin Robinson of GCHQ in a joint essay.

"In the UK, under the Investigatory Powers Act 2016, that means a Secretary of State and an independent judge must both sign-off the use of the most intrusive powers," they added. "We believe this provides world-class oversight of our law enforcement and intelligence agencies."

You can think of end-to-end encryption of messages like an archaic tin can and rope method of communication. Only those with access to that rope can send or receive the communication, keeping everyone else out. That's how messages over services such as WhatsApp and iMessage are conducted, using public key cryptography.

GCHQ plans to embed a "ghost" agent within these messages, creating a three-way communication line with one invisible participant so the agency can oversee messages that would usually be hidden from them.

"It's relatively easy for a service provider to silently add a law enforcement participant to a group chat or call," said Levy and Robinson. "You end up with everything still being end-to-end encrypted, but there's an extra 'end' on this particular communication."

"We're not talking about weakening encryption or defeating the end-to-end nature of the service," they added. "In a solution like this, we're normally talking about suppressing a notification on a target's device, and only on the device of the target and possibly those they communicate with. That's a very different proposition to discuss and you don't even have to touch the encryption."

The reason why GCHQ wants access to these messaging services isn't to spy on regular civilians' personal conversations out of perversion, it's to reduce the powers held by criminal and terrorist organisations that can use these services to plan crimes without law enforcement knowing.

While most can agree that GCHQ should have these powers to protect national security, it does present a conflict, namely between protecting the interests of national security against the fundamental human rights of freedom of expression and privacy of one's own correspondence.

It's a similar conflict of rights that Google had to wrestle with when drafting and imposing its 'right to be forgotten' after a lengthy legal battle with the European courts.

It isn't the first time Apple, in particular, has openly opposed breaking end-to-end encryption of messages sent between members of the public. In a famous legal battle with the FBI, the company refused to unlock an iPhone belonging to the terrorists who committed the San Bernadino shootings in 2015.

Apple wasn't prepared to sacrifice user privacy, their trust in the company's commitment to user security and the sacrosanct encryption of their devices, despite heavy pressure from the FBI amid a major case of national security.

Huawei is facing a host of challenges as more of its partners strip its products from their stores and exclude them from the latest lucrative deals.

A swathe of companies and partners to Huawei have announced this week that they won't be supporting the sales of Huawei devices, further damaging the company's chances of success outside of China.

The company has said that it will be working on its own mobile operating system as doubt is cast over its future with Android in the wake of President Trump's executive order imposed last week.

The restrictions have been loosed for the next 89 days, but after that time, all future Huawei devices released may not have a license to use the Android OS, meaning it must develop its own or use something else.

The problem with this is that whatever mobile OS it chooses to use, it's likely to cause difficulty for the company and its users with regards to the effectiveness of its functionality without a diverse ecosystem of apps made available for the freshly-developed OS in its infancy.

"This move will have critical impact toward Huawei's business around smart phones," said Charlie Dai, principal analyst at Forrester. "Huawei has its own mobile OS as a backup, but it's not fully ready yet and it's very difficult to build up the ecosystem as what Huawei has been doing on Android."

"Eventually, it's no good toward consumers around the world, and It's a pity that customer value facilitated by open-source spirit is now ruined by the politics," he added.

Speaking at an event in Brussels on Tuesday, Huawei's representative to the European Union institutions Abraham Liu said that current Huawei users needn't worry, but emphasised that future devices that will be launched are under threat.

"For existing models already in market - there is no major impact," he said, reported Bloomberg. "For the future [devices], both teams (Huawei and Google) are still working together to figure out what to do."

In other news, EE announced today that despite using Huawei equipment in its 5G launch next week, it will not be supporting Huawei phones for its initial 5G plans that are available for preorder today.

"Until we get the information and confidence that gives us the long term surety that our customers, when they buy those devices, are going to be supported for the lifetime they've got the device with us," said Marc Allera, CEO of BT's consumer brands.

Microsoft also stripped Huawei's MateBook X Pro laptop from its online store today, seemingly in response to the executive order against Chinese technology companies.

In a statement issued on Wednesday, a Huawei spokesperson said that the company valued its partners but "recognised the pressure some of them are under, as a result of politically motivated decisions".

"We are confident this regrettable situation can be resolved and our priority remains to continue to deliver world-class technology and products to our customers around the world."

It's the first sign of Microsoft's compliance with the order since the order took effect and also marks another challenge Huawei must overcome in order to stay competitive in the laptop market. It could signal the possibility that Huawei laptops may lose their license to support Windows OS, in which case Huawei may have to ship devices with a Linux-based OS or create their own for PCs too.

To make matter worse, the chipmaker ARM has instructed employees to suspend business with Huawei, according to an internal memo obtained by the BBC.

ARM produces technology that plays a strong role in the architecture of most mobile processors in the world. The memo reads that the company's designs contained "US origin technology" and could thus be affected by Trump's order.

One analyst speaking to the BBC said that if the move became permanent, then the consequences on Huawei's business would be "insurmountable".

The UK has thrown its weight behind a move to make the Article 13 copyright legislation a law.

Alongside the UK, 18 other EU nations gave the directive, which includes the hotly debated Article 11 and Article 13, their approval. However, the Copyright Directive was opposed by Italy, Finland, Sweden, Luxembourg and the Netherlands.

Given the European Council has approved the Copyright Directive, EU member states will now have two years to implement it into their national laws.

Once that happens it could pave the way for the imposition of large fines on businesses that allow users to upload copyrighted content illegally.

For example, if a user uploads a video to YouTube that includes music they don't have the rights to include, YouTube will have to seek out the copyright owner to seek their permission. If they don't do so, they will need to remove the content.

It's a very controversial directive, which many publishers and other sources that rely upon shared content disagree with. It's unlikely that smaller firms will have the resource to find the copyright owner or afford fees and therefore, they will have to remove the content instead.

Although non-profit encyclopedias (such as Wikipedia) are exempt from the Copyright Directive, that didn't stop the tech giant switching its service off in four European markets last month in protest. Google objected as well, warning its users via a pop-up that the law could have "unintended consequences" such as blocking content its users had uploaded.

However, the music and creative arts industry has welcomed the move, saying it's a huge milestone for creators.

"It was a long road and we would like to thank everyone who contributed to the discussion," Helen Smith, executive chair of the Independent Music Companies Association said. "As a result, we now have a balanced text that sets a precedent for the rest of the world to follow, by putting citizens and creators at the heart of the reform and introducing clear rules for online platforms."

Another aspect of the rules state that search engines and social media providers will need to pay new publishers if they want to include snippets of content on their sites.

The government will establish a statutory regulator with powers to punish internet giants as part of new measures to crack down on the spread of harmful and extremist content online.

Tech companies and social media platforms will be compelled to abide by a 'duty of care' at the behest of a digital regulator, according to draft proposals, to rival Ofcom and the Information Commissioner's Office (ICO).

The government's long-awaited 'Online Harms' white paper, released today, has also set out a regulatory framework that hands this proposed body the power to levy fines against companies for breaching standards. Senior managers will also be subject to these fines and held liable in a criminal context.

In extreme cases, the regulator will also disrupt offending companies' business operations, and order internet service providers (ISPs) to block non-compliant platforms or apps entirely from UK markets as a last resort.

"The era of self-regulation for online companies is over. Voluntary actions from industry to tackle online harms have not been applied consistently or gone far enough," said the government's digital secretary Jeremy Wright.

"Tech can be an incredible force for good and we want the sector to be part of the solution in protecting their users. However, those that fail to do this will face tough action."

Home Secretary Sajid Javid also reinforced the notion that large tech firms have a "moral duty" to protect their younger users from harmful and extremist content.

"Despite our repeated calls to action, harmful and illegal content - including child abuse and terrorism - is still too readily available online," he said. "That is why we are forcing these firms to clean up their act once and for all."

Putting big tech firmly in the government's sights

As to which firms will be subject to these rules, the government cites companies that "allow users to share or discover user-generated content or interact with each other online". This translates to social media platforms, file hosting sites, messaging services, public discussion forums, and search engines.

The government has also hinted it would target the biggest companies first, with the regulator's initial 'risk-based' focus hitting companies that pose the clearest risk of harm to users. This will either be due to the scale of the platforms, or issues with online content that have already been identified.

Powers will span issuing notices to companies for breaching standards, to "substantial" fines for failures to remove harmful or extremist content. The scale of these fines, however, have not been defined. Senior managers, too, will be individually subject to regulatory action if found to have led their companies to breach standards.

Underpinning the regulations will be a duty of care and several codes of practice. These latter documents are particularly relevant to minimising the spread of disinformation, and extremist content online. A 'safety by design' framework too will inform developers when they create any new digital products or services from scratch.

The white paper insists that any action taken will be proportionate and designed not to stifle innovation in the digital economy. Legislative action, therefore, will be coupled with measures to promote 'tech safety', for example, as well as digital literacy to empower users to manage their own online activity and the risks this involves.

The overall package of measures, however, has been branded by critics as too "vague". Although the trade organisation techUK, for instance, said the measures were a "significant step forward", this vision will not be achieved if difficult problems are trade-offs are ignored.

"A regulator, whether new or existing, will not thank anyone for being handed a vague remit," said techUK's head of policy Vinous Ali.

"It is vital that the Government is clear about what it wants to achieve and the trade-offs necessary to do it. That means providing clear definitions of online harms and setting out how difficult boundary issues should be addressed."

The information commissioner Elizabeth Denham, meanwhile, said the need for these proposals reflected users' growing mistrust of online services.

"People want to use these services, they appreciate the value of them, but they're increasingly questioning how much control they have of what they see, and how their information is used," said Denham.

"That relationship needs repairing, and regulation can help that. If we get this right, we can protect people online while embracing the opportunities of digital innovation."

How these plans compare against other ideas

These proposals jointly-devised between the Home Office and the Department for Digital Culture Media and Sport (DCMS) have been several months in the making. Although the plans are subject to change, they set out for the first time how the government intends to reign in the worst tendencies of internet giants like Facebook and Google.

Ideas such as an internet regulator and a statutory 'duty of care' have been explored extensively by a chorus of policymakers, including the Labour opposition, the House of Lords' communications committee, and the DCMS select committee.

But the government's white paper sets out how such measures could translate into legislation, and what this means for many companies subject to these rules. However, there are a handful of differences between what organisations such as the DCMS select committee are proposing, and what the government is.

"Disinformation is clearly harmful to democracy and society as a whole. The social media companies must have a responsibility to act against accounts and groups that are consistently and maliciously sharing known sources of disinformation," said chair of the committee Damian Collins MP.

"The white paper does not address the concerns raised by the select committee into the need for transparency for political advertising and campaigning on social media. Again, it is vital that our electoral law is brought up to date as soon as possible so that social media users know who is contacting them with political messages, and why."

The House of Lords' communications committee, meanwhile, wouldn't have gone as far as the government in establishing a fully-fledged regulator; instead suggesting an interim Digital Authority. This body would oversee the work of existing regulators, nullify regulatory overlaps and suggest any changes to future processes so the raft of problems can be tackled now.

"If you make a new regulatory body then you will waste a long time before anything happens," its chair Lord Gilbert told IT Pro in March. "In the meantime, all of these bodies need to be brought together, they need to be forward-thinking, and they need to be de-duplicated.

"In time the new powerful Digital Authority may say the existing regulatory structure is not quite right and we need to either merge, change or set up some new bodies. But we don't want that to get in the way of doing stuff."

As for the Labour Party, these plans just don't go far enough. Its shadow digital secretary Tom Watson MP would also establish an independent regulator, in the same mould as this government's, but give this organisation the power to break up monopolies, among a suite of tougher powers.

"The public and politicians of all parties agree these platforms must be made to take responsibility for the harms, hate speech and fake news they host," he said. "The concern with these plans is that they could take years to implement. We need action immediately to protect children and others vulnerable to harm.

"These plans also seem to stop short of tackling the overriding data monopolies causing this market failure and do nothing to protect our democracy from dark digital advertising campaigners and fake news."

Yet another punt into the long grass?

The government is spinning these proposals as decisively tough, and a world-first in regulating some of the biggest companies on the planet. This is indeed, as the government claims, the prelude to the world's first 'online safety' laws of its kind. And it's remarkable to chart the journey that ministers have been on.

They'll be glad, therefore, to hear the plans have largely been welcomed by the industry, in principle at least. NCC Group, for example, says these proposals strike "the right balance". Specifically, the security firm's global CTO Ollie Whitehouse says that appointing an independent regulator will ensure regulation will keep pace with an evolving online environment.

But organisations on all sides of the debate have found quibbles with these plans, ranging from techUK's charge of being too vague to the Labour Party's accusations that these do nothing to resolve deep-rooted and systemic issues in the tech sector. Even NCC Group's Whitehouse believes the regulations won't be effective unless they are underpinned with online safety awareness and education in schools.

This, of course, also comes in the wake of the fallout from a mass shooting in New Zealand, and voices critical of tech companies for not removing a live stream of the tragedy quickly enough. Just in the last few hours, the country's privacy commissioner John Edwards branded Marck Zuckerberg and his company Facebook "morally bankrupt pathological liars who enable genocide (Myanmar), facilitate foreign undermining of democratic institutions".

His comments, posted onto Twitter and now deleted, are indicative of an incredibly emotionally-charged debate. It also brings into perspective what the phrase 'online harms', something that has not up to now been adequately defined, means to people in reality.

The government has now, at least, released a chart outlining three categories of online harms, as it sees things, including harms with a clear legal definition, harms with a less clear legal definition, and underage exposure to legal content. But it's still uncertain how the government, and its new regulator, will effectively enforce these laws.

The chorus of voices reacting critically to these proposals shouldn't be seen as disparaging, rather it betrays the idea of just how complex an issue online regulation is. There's perhaps a good reason that no country has yet attempted to reign in the ever-ballooning tech sector. So it's just as well that the government has opened their plans up to an extensive period of public consultation, immediately after putting their cards onto the table.

But given the white paper's release was already delayed, having been touted for 'winter 2018/19', some may see the 12-week consultation as kicking the issue into the long grass, as the government has arguably done with Brexit.

This is justified, as we probably won't see any finalised proposals until the end of the year. But if the government uses this time to finetune and clearly establish the implementation of these measures, as against just playing for time, the sector might well be in a healthier place for it.

Social media platforms have generally become more effective at removing online hate speech and harmful content within 24 hours, but are providing feedback to their users less frequently.

Tech firms are reviewing the majority of notifications they receive on hate speech in a timely way, according to a European study, with an average of 89% of flagged content across several platforms examined within 24 hours. These social networks, including Facebook, Twitter, YouTube, Instagram and Google+, are also removing 72% of the illegal hate speech notified to them.

The figures, outlined in the latest European Commission's (EC) monitoring report on its voluntary Code of Conduct, mark a significant improvement since the first such study in 2016. The first of now four monitoring reports saw 40% of flagged content examined within 24 hours, and 28% removed.

The study saw dozens of organisations raise thousands of queries across the social media platforms in question during a six-week period, with the latest monitoring report conducted in late 2018.

Despite the pan-European improvement, however, the UK still lags well behind the continental average, representing the nation with the third-lowest rates of content removal across all member states.

Just 54% of content flagged is removed in the UK, according to the figures, which is actually a drop on the previous monitoring report, measured in December 2017, which saw 66% of illegal content removed.

Facebook is the best-performing platform on the reviewing front, with 92.6% of cases seen within 24 hours, and a further 5.1% seen within 48 hours. The corresponding figures for Youtube and Twitter are 83.8% and 7.9%, and 88.3% and 7.3% respectively.

Meanwhile, supplying feedback to users and a rationale behind these decisions, are being provided less frequently, with 65% of users receiving notifications in 2018 against 69% being informed in 2017's survey.

Facebook is the only company informing users systematically, the report says, with 92% of notifications receiving feedback, but this is a reduction from almost 95% last year.

The latest figures are released in light of mounting pressure in the UK for social media companies to do more to monitor harmful content and hate speech posted on their platforms.

An influential parliamentary committee of MPs just last week published a report recommending that policymakers construe a set of new laws to subject social media companies to a legally-enforceable duty of care'.

The European Union (EU) has even proposed limiting the statutory deadline for tech giants to remove illegal content to just one hour.

The NHS is struggling to retain critical cyber security expertise and expenditure is being allocated erratically, with some Trusts spending as little as 250 in the last year, it has emerged.

Despite the Department for Health and Social Care (DHSC) having committed an additional 150 million on NHS cyber security a year after the WannaCry attack, research by Redscan has exposed a prominent gap in both funding and staffing.

The average spend on data security training across 159 Trusts surveyed was 5,356 in the last 12 months, but this ranged widely from between 238 and 78,000 with no correlation to the size of Trust, or its location.

For a mid-sized Trust of between 3,000 and 4,000 employees, for example, training spend ranged from 500 to 33,000. But the research also notes a significant amount of training was conducted in-house using NHS Digital resources.

GDPR training was the most common programme taken up, with other prominent courses including BCS Practioner Certificate in Data Protection, and Senior Information Risk Owner.

However, it was found that NHS Trusts have only employed an average of one qualified security professional per 2,582 staff.

Alarmingly, almost a quarter of Trusts, 24 out of 108, retain no staff with security qualifications despite some employing around 16,000 full-time and part-time workers. A handful of Trusts also reported having employees in the process of obtaining security qualifications.

"These findings shine a light on the cyber security failings of the NHS, which is struggling to implement a cohesive security strategy under difficult circumstances," said Redscan's director of cyber security Mark Nicholls.

"Individual trusts lack in-house cybersecurity talent and many are falling short of training targets; while investment in security and data protection training is patchy at best. The extent of discrepancies is alarming, as some NHS organisations are far better resourced, funded and trained than others."

The findings, released following a Freedom of Information (FOI) campaign which saw responses from 159 NHS Trusts, have been released a year-and-a-half after the devastating WannaCry attack that DHSC estimated to cost 92 million.

Several parliamentary reports have since savaged the NHS' record on cyber security resilience, with among the latest in April showing zero Trusts passed the government's cyber security assessments.

A separate FOI request Redscan sent to NHS Digital revealed signs of improvement, as 139 Trusts had now undertaken a Data Security Onsite Assessment, compared to just 60 Trusts last year.

Beyond announcing an additional 150 million over the next three years, the DHSC also committed to upgrading all Windows XP devices to Windows 10 by 2020 in a deal struck with Microsoft earlier this year.

"Cyber security is a priority for this government and funding is provided to NHS Trusts based on their specific needs and capabilities," a DHSC spokesperson told IT Pro.

"Over 60m was invested last year for critical infrastructure, and there will be a further 150m over the next three to improve resilience across the health and care system.

"Where Trusts do not take sufficient action to secure their networks and systems, we will use strong enforcement powers to ensure they improve."

Redscan's Nicholls added that as the skills gap continues to grow, it'll become harder for organisations across all sectors to find the people with the right knowledge and expertise.

"It's even tougher for the NHS, which must compete with the private sector's bumper wages," he continued, "not to mention the fact that trusts outside of traditional tech hubs like London and Cambridge have a smaller talent pool from which to choose from."

Kaspersky's principal security researcher David Emm told IT Pro that given how very attractive health data is to criminals, it is vital the NHS invests money in robust protections.

"Healthcare providers must also work closely with their IT security teams to implement sophisticated, high-quality protection that will allow them to manage and protect customer data," he said.

"Not just for the sake of tick-box' compliance, or to avoid hefty fines and embarrassing, often irreparable reputational damage, but to enable them and their patients to reap the many rewards of advanced digital healthcare, confident in the knowledge that data, devices and networks are secure."

IT Pro also approached NHS Digital, NHS England and NHS Improvement for comment.

In the early hours of the morning, it was reported that China's primary security authority has deleted 9,800 social media accounts due to inappropriate content, reported Reuters.

The Cyberspace Administration of China (CAC) made a statement in relation to its campaign launched on 20 October 2018, saying it had erased a massive amount of the increasingly prevalent 'self-media' accounts that emerged in recent months.

The accounts were erased for "spreading politically harmful information, maliciously falsifying (Chinese Communist) party history, slandering heroes and defaming the nation's image".

The wiped accounts had appeared on two of China's premier social media platforms, WeChat and Weibo. Tencent and Sina, the two companies who own and operate the platforms were also summoned by the CAC and admonished for failing to prevent "uncivilized growth" and causing "all kinds of chaos".

The term 'self-media' is used to refer to social media channels, much like ones found on Snapchat's stories, posing as genuine media outlets. The channels produce original content which spans a breadth of topics but aren't officially registered with authorities.

The prevalence and popularity of these accounts have been largely attributed to the interesting and sometimes sensational content that they churn out, which comes as a breath of fresh air from the state-regulated official sources which like to keep content produced in Chinese cyberspace in-line with communist party ideals.

Despite freedom of expression being codified in China's constitution, the one-party state does allow some leniency but keeps a strict limit on the extent to which the party can be criticised.

The government has announced a new revenue-based tax on the likes of Google, Facebook and Amazon which is expected to raise 400 million per year.

The UK Digital Services Tax (DST), which will come into effect from April 2020, is a 2% tax on the revenues of search engines, social media platforms and online marketplaces that are profitable, and generate more than 500 million per year in revenue.

Announcing the measure in this year's Budget, Chancellor Philip Hammond said the DST will restore "sustainability and fairness" to the UK tax system, which he suggested tech giants have exploited in the past.

"There is one standout example of where the rules of the game must evolve now if they are to keep up with the emerging digital economy," Hammond told the House of Commons.

"Digital platforms delivering search engines, social media, and online marketplaces have changed our lives, our society and our economy. Mostly for the better. But they also pose a real challenge for the sustainability and fairness of our tax system.

"The rules have simply not kept pace with changing business models and it is clearly not sustainable or fair that digital platform businesses can generate substantial value in the UK without paying tax here in respect of that business."

The UK DST is expected raise just 5 million in its first year, according to Budget papers, and is not projected to bring in the touted 400 million of tax revenue until at least 2022/23.

'We cannot simply talk forever'

The measure represents a major shift in the Conservative government's approach to handling an industry that is becoming increasingly influential in the UK economy.

But it has been met with criticism on both sides; either feeling it could hamper the tech sector, or that the announcement doesn't actually go far enough.

"As more and more businesses digitise, the way we levy taxes on companies must evolve and the UK is well-placed, with the strongest tech sector in Europe, to be a leader in this area," said Gerard Grech, chief executive of Tech Nation, an industry trade body.

"However, the announcement by the Chancellor, Philip Hammond, of a 2% tax on revenues of multinational technology companies risks stifling entrepreneurialism and innovation, which recent governments have done much to encourage."

Santosh Sahu, CEO of delivery platform On the dot, branded the tax a "punch into the pockets of tech giants", as well as "stab in the back" for retailers with successful multi-channel strategies.

During his Budget speech, Hammond made reassurances the measure will not be "an online sales tax on goods ordered over the internet", as such a tax would naturally fall on consumers.

Labour's shadow secretary for digital, culture, media and sport (DCMS) Tom Watson, meanwhile, derided the measure's "lack of ambition".

"The tech giants do need to pay more in tax," he said, "but the measure announced today is a pittance for these massive international companies.

"Under the Tories, the percentage of tax paid by the big five tech companies has halved since 2013. The new tax isn't even set to be implemented until 2020 at which time the tech giants will start to enjoy a 2% cut in their corporation tax rate."

The Chancellor added that the UK will continue to consult with nations which comprise the OECD and G20 in order to establish an international, cross-border set of measures, with any agreement potentially superseding the UK's unilateral measure.

"The UK has been leading attempts to deliver international corporate tax reform for the digital age," he continued, adding: "a new global agreement is the best long-term solution, but the pace is painfully slow.

"We cannot simply talk forever."

Rolling out full fibre and 5G

Elsewhere the government announced a series of investments into digital tools to support the industry, including a 20 million fund for local peer-to-peer networks geared towards business improvement, and technological adoption.

Hammond also announced the government would work in partnership with large banks, professional services firms and tech companies to support the productivity of their small business customers.

The government's National Productivity Investment Fund will also expand to 37 billion nationwide, including a significant portion dedicated to building the UK's digital infrastructure and research and development (R&D).

The UK's growing fibre and 5G network will see an additional 715 million between now and the end of 2021, on top of 25 million investment last year, geared towards rolling out full fibre broadband nationwide.

This includes 200 million to pilot innovative approaches to deploying full fibre in rural locations, starting with primary schools, as well as rolling out a voucher scheme for nearby homes and businesses.

R&D and digital transformation set to benefit

R&D funding, meanwhile, will receive a further 1.6 billion next year in areas such as nuclear fusion, quantum computing, and artificial intelligence, with the government expecting to have spent 9 billion more by 2021 than it had in 2015.

An additional 235 million for the development and commercialisation of UK quantum computing, meanwhile, in addition to 80 million announced earlier this year, would represent a welcome sigh of relief for the industry.

Scientists and experts previously slammed the government for scrimping on quantum computing investment when it had offered just 80 million, instead of the 338 million demanded so the UK "does not lose ground against international competitor programmes".

The Budget also set out a handful of ways the government may use AI to drive growth, including a review into the use of automation and data in the public sector conducted by the Government Digital Service (GDS) and the Office for AI.

The UK's Center for Data Ethics and Innovation has also been commissioned to study the use of data in shaping people's online experiences, and the potential for bias in decisions made via black box algorithms.

But according to research the UK's AI strategy still lags behind European rivals, with findings from analytics firm Exasol showing German businesses are 45% more focused on building AI into their strategies than UK companies.

"While there is room for improvement," said Exasol CTO Mathias Golombek, the announcement of a 1.6 billion investment is "promising" for the UK's industrial strategy.

Twitter is being investigated for a potential General Data Protection Regulation (GDPR) breach after refusing to provide an academic with information about how he is tracked on the platform.

The social media network uses shortened t.co links as a way to track a handful of data points, including how many clicks longer links receive. They also help to curb the spread of malware and phishing attacks, the platform says.

Michael Veale, a researcher based at University College London (UCL), lodged a subject access request (SAR) to find out whether these links track more data on users than Twitter lets on.

But according to Fortune, the social media company denied his request on the grounds that providing this information would take "disproportionate effort".

Veale then escalated the issue with a complaint to the Irish Data Protection Commission (DPC), which confirmed in a letter last week that it would investigate whether Twitter's refusal to fulfill the request constitutes a GDPR breach.

The DPC also said it would consider engaging the European Data Protection Board, an independent advisory body that works to apply the consistent application of GDPR across the continent.

"The DPC has initiated a formal statutory inquiry in respect of your complaint," the regulator wrote.

"The inquiry will examine whether or not Twitter has discharged its obligations in connection with the subject matter of your complaint and determine whether or not any provisions of the GDPR or the [Irish Data Protection] Act have been contravened by Twitter in this respect."

Ireland's data watchdog is handling the case under GDPR's One Stop Shop principle, in which a lead investigator is nominated to investigate cross-border breaches.

The rights of data subjects have considerably strengthened since GDPR came into force on 25 May. Under the new regulations, organisations are required to provide any data held on their users or customers within 30 days, subject to exceptions in the law.

These subject access requests (SARs) also operate in tandem with the right to be forgotten, which gives data subject the right to request that data held on them by any organisation is deleted, under reasonable circumstances.

Research published last month showed just 35% of EU-based companies are fulfilling SARs within the legal 30-day timeframe, which is true for 50% of firms based outside of Europe.

This case is being handled under GDPR since the request was made after the new regulations came into force.

IT Pro approached Twitter for comment, but did not get a response at the time of writing. A spokesperson for the DPC said a statement would follow.

The European Union (EU) will draw up new plans to fine social media companies over their failure to remove extremist content from their services.

Under new proposals, companies such as Facebook and YouTube will be compelled to remove terrorist propaganda within one hour or face hefty fines, according to European commissioner for the security union Julian King, who spoke with the Financial Times.

"We cannot afford to relax or become complacent in the face of such a shadowy and destructive phenomenon," King said, adding that new regulations would create legal certainty for websites of all sizes.

"The difference in size and resources means platforms have differing capabilities to act against terrorist content and their policies for doing so are not always transparent.

"All this leads to such content continuing to proliferate across the internet, reappearing once deleted and spreading from platform to platform."

The draft proposals, set to be published next month, signal a shift from the EU's current regulatory outlook which allows companies to voluntarily remove content deemed to incite terrorist violence or radicalise users.

The EU's decision to make its guidelines legally enforceable mirrors a change in heart in terms of the UK's strategy, with the government earlier this year hinting at new rules that represent a clear shift from voluntary guidelines and self-policing.

After ten companies failed to turn up to government talks, of 14 invited, the then-secretary of state for digital, culture, media and sport (DCMS) Matt Hancock said in May the UK would draft laws to fine firms that failed to tackle online abuse or remove inappropriate content.

"The fact that only four companies turned up when I invited the 14 biggest in; it gave me a big impetus to drive this proposal to legislate through," Hancock said on BBC One's the Andrew Marr Show.

"Before then, and until now, there has been this argument - work with the companies, do it on a voluntary basis, they'll do more that way because the lawyers won't be involved.

"And after all, these companies were set up to make the world a better place. The fact that these companies have social media platforms with over a million people on them, and they didn't turn up [is disappointing]."

The wider movement towards tougher and more meaningful regulation has in-part been motivated by the continuously-unfolding data misuse scandal involving Facebook and the now-defunct Cambridge Analytica. The DCMS select committee, for instance, has proposed several new laws in an interim report published last month that make social media companies, like Facebook, liable for misinformation that is allowed to spread on their platforms.

Meanwhile, in February the former home secretary Amber Rudd revealed an auto-blocking tool the government is hoping can automatically detect and flag extremist content without human intervention. Developed by the London-based artificial intelligence company ASI Data Science, the tool was trained by analysing thousands of hours of ISIS-produced content and forms part of the government's wider efforts to tackle online hate speech and extremist material.

The Information Commissioner's Office (ICO) has published its first strategy paper outlining how it will adapt its regulatory approach in light of new challenges presented by rapidly changing technology.

Among the key goals outlined in the paper, drafted to enhance the regulator's overall technical expertise and understanding, the ICO will educate staff on technological issues, and ensure businesses and the wider public are kept informed on new data protection risks.

The ICO also established, in its plans, three priority areas for 2018/19, including cyber security, AI, and web and cross device tracking. The data regulator will develop an action plan for each area which it plans to review and update annually.

The new three-year strategy is part of the ICO's wider efforts to strengthen its commitment to technology and innovation, which includes the appointment of Simon McDougall as the first executive director for technology policy and innovation.

McDougall, the former managing director of IBM-owned consultancy firm Promontory, is a "well-known international figure in the world of information rights," according to the ICO, and has also served on the board of a number of international bodies committed to upholding citizens' data and information rights.

"I am honoured to have the opportunity to join the ICO and lead their work in this critical area," McDougall said. "Technological change continues to accelerate, and it is vital that the ICO remains constructively and robustly engaged as organisations innovate in the use of personal data."

Also among the ICO's plans is the launch of a 'regulatory sandbox' in which organisations can develop innovative tools and services with assistance and guidance from the ICO. The regulator plans to consult on the implementation of this scheme later in 2018.

"Technology is driving changes to the societal, political, legal and business environment that the Information Commissioner's Office (ICO) needs to regulate," Information Commissioner Elizabeth Denham wrote in the foreword of the new strategy.

"The most significant data protection risks to individuals are now driven by the use of new technologies. The risks are broad - from cyber-attacks to the growth of artificial intelligence and machine learning."

"The GDPR contains new provisions to better regulate the risks arising from technology, including data protection by design and data protection impact assessments.

"These advances need not come at the expense of data protection and privacy rights - the ICO's approach to technology will be underpinned by the concept that privacy and innovation are not mutually exclusive."

The ICO has faced numerous challenges in the last few months in light of a massive data misuse scandal involving Facebook and the now-defunct Cambridge Analytica, which perhaps gave the regulator a taste of the issues it could expect to face in an increasingly-digitised landscape.

Its investigations into the misuse of personal data in political campaigns, which spans a vast number of organisations, led to Facebook last month being fined 500,000 - the maximum under the Data Protection Act 1998. The full results of the ICO's investigation are expected to be published by the end of the year.

The government has announced it will expand the scope of the UK Council for Child Internet Safety (UKCCIS) to cover the wider UK population.

Focusing on reinforcing digital safety for everyone across the country, the new UK Council for Internet Safety (UKCIS) will prioritise areas of online harm such as cyberbullying and sexual exploitation, as well as tackle the spread of radicalism and extremism across the internet.

Also trying to mitigate violence against girls and women, hate crime and hate speech, as well as discrimination that contravenes the Equality Act 2010 manifesting online, the UKCIS will encourage collaboration between more than 200 organisations representing the government, regulators, the digital industry, law enforcement, academia and charities.

"Only through collaborative action will the UK be the safest place to be online," said Margot James, minister for digital and the creative industries.

"By bringing together key stakeholders, from the tech giants to the third sector, UKCIS will be the cornerstone of this effort; driving the development of technical solutions and equipping UK citizens to tackle online harms."

Since its conception in 2008, the UKCCIS has run a wide array of campaigns and put forward policy proposals that aim to improve the online safety and welfare for children in schools and colleges across the UK.

Notable work includes infamous proposals for the default filtering of online pornography, introduced in 2012, while more recently the organisation has issued guidance on 'sexting'.

Plans to expand the UKCCIS were first outlined in the government's Internet Safety Strategy green paper in October last year, with an application process now underway to appoint board members to the new, beefier organisation. The consultation also covered introducing a social media code of practice, a social media levy, examining young people's use of dating websites, and exploring how new technology can be used to curb online home.

Comprising co-ministerial chairs from the department for culture, media and sport, the home office and the department for education, the board will retain an interest in combating online threats posed to the safety and welfare of children. Its remit will also expand, however, in a variety of areas to improve the online experience for the adult population.

The deadline for applications to sit on the UKCIS' executive board will close on 3 September.

US Congress has requested that ex-Cambridge Analytica employee Matt Oczkowski answer questions regarding the use of data by his new company Data Propria.

Oczkowski has been asked to explain whether the data being used by Data Propria was supplied by researcher Aleksandr Kogan, who collected data from millions of Facebook users in 2016, according to a letter sent by Democrats on the House Energy and Commerce Committee last week.

"Given news reports indicating that Data Propria is being led by former Cambridge Analytica employees, including yourself, we believe the American people must be assured that Data Propria is not using consumer data wrongfully obtained by Cambridge Analytica or engaging in other inappropriate practices," the letter said.

Not only does Congress want Oczkowski to spill the beans on whether the data it's using as collected via Facebook, Democrats including Frank Pallone, Jr., Mike Doyle and Jan Schakowsky want to understand exactly how Data Propria is getting its data from Facebook, data brokers or other means.

It also requested that Data Propria advise Congress on whether or not it's telling consumers how their data is being used and if it's using the data for consulting purposes. For companies in the US, there's no legal requirement to disclose this information if customers request it, unlike the stringent rules imposed on those in the EU by GDPR.

"You have acknowledged in interviews with press that the work of Data Propria will be very similar to Cambridge Analytica," the group continued in their letter. "The admitted overlap between the personnel and work of Cambridge Analytica and Data Propria raises serious concerns about Data Propria's practices regarding the collection and use of Americans' personal information."

05/06/2018: SCL Elections ignores watchdog order to hand over user's data

Cambridge Analytica has refused to comply with a deadline to hand over the data it holds on a US citizen, throwing a regulatory battle between itself and the Information Commissioner's Office (ICO) into "uncharted waters".

The ICO had given the now-defunct political consultancy firm until Monday to comply with a legal notice after Professor David Carroll filed a Subject Access Request (SAR) under the Data Protection Act 1998 to discover what information the company held on him.

But the organisation's data controller, SCL Elections, failed to respond to the ICO's enforcement order - with the UK data regulator now considering prosecution.

"We are looking at the apparent failure to comply with our Enforcement Notice by SCL Elections Limited and its directors," an ICO spokesperson told IT Pro. "A decision on options for next steps, including any decision on prosecution, will now be taken in line with the prosecutors code."

Despite being a US citizen, Professor Carroll launched a landmark test case in 2017 under UK data protection law, after learning that Cambridge Analytica had processed his personal data in the UK as part of its alleged profiling of US voters for work on the Trump presidential election campaign. His case, separately filed with the High Court, was backed by the ICO, with its outcome bearing implications for millions of Americans whose data had also been harvested by the company.

However, Cambridge Analytica did not recognise his right to submit a SAR as a non-UK citizen, and refused to provide the full extent of the data it held. Consequently the ICO last month issued a legal notice for SCL Elections to comply in full - or face prosecution.

"My story is a peculiar example of how the typically American deference to the tech companies and a reluctance to consider comprehensive privacy rules contrasts with strong data protection regimes, enforced by a muscular regulator equipped with the necessary tools," said Carroll, giving evidence before the European Union's (EU) Civil Liberties, Justice and Home Affairs (LIBE) committee yesterday.

He revealed that Cambridge Analytica administrators had not yet provided the ICO with the login credentials to recover his data from its servers, which the regulator seized earlier this year as it investigates the use of data in political campaigns.

He later tweeted: "The company did not respond to the @ICOnews Enforcement Order due today. We are now in uncharted waters."

Information commissioner Elizabeth Denham, also giving evidence before the LIBE committee, outlined the scale of the ICO's probe into the misuse of data in political campaigning, branding it the "largest investigation ever undertaken by a data protection authority".

Involving 40 full-time ICO staff as well as a further 20 external legal and forensic IT recovery experts, the enquiry is examining more than 30 separate organisations, and the actions of around a dozen individuals.

"We are investigating social media platforms, data brokers, analytics firms, political parties and campaign groups and academic institutions," she told the committee, adding: "We are looking at both regulatory and criminal breaches. We are working with other regulators, EU Data protection authorities and law enforcement in the UK and abroad."

Denham added the ICO has seized dozens of servers containing hundreds of terabytes of data from several searches, and has conducted dozens of interviews.

"We are looking at the complete range of sanctions at our disposal at this time including our new powers under the new UK Data Protection Act for no-notice inspections, quicker warrants, to compel delivery of evidence and to seal digital evidence where it cannot be immediately recovered," she continued.

Cambridge Analytica, which specialised in data analysis and strategic communication, shut down in early May, blaming "a siege of media coverage" that drove away its customers and suppliers, as it commenced parallel bankruptcy proceedings in the US.

"Over the past several months, Cambridge Analytica has been the subject of numerous unfounded accusations," the company said at the time, adding that despite trying to "correct the record" it has has been "vilified for activities that are not only legal, but also widely accepted as a standard component of online advertising in both the political and commercial arenas".

The ICO has made clear that companies shutting themselves down must still comply with subject access requests like Professor Carroll's. The regulator will publish a report outlining the wider implications of its ongoing investigations before the end of June, which will include a series of recommendations on regulatory gaps in areas such as data protection.

Picture: Shutterstock

08/05/2018: ICO orders firm to hand over data to US citizen

The UK's data protection watchdog has served a legal notice to Cambridge Analytica, ordering it to give a US academic all of the personal data it holds on him.

Professor David Carroll, who is based at the Parson School of Design in New York, had filed a Subject Access Request (SAR) under the terms of the Data Protection Act 1998 to Cambridge Analytica after the scandal broke that the data modelling company had allegedly amassed 240 million Americans' Facebook profile data.

However, he only received information that showed how the company had scored him on certain political categories, such as gun control and national security, leading him he to believe the information was incomplete and launch legal action.

Cambridge Analytica's data controller is UK-based company SCL Elections, and Professor Carroll took his case to England's High Court, and also filed a complaint with the UK Information Commissioner's Office (ICO).

The ICO said that not only does it believe Cambridge Analytica held back information, but pointed out that the firm did not offer an adequate explanation of where it had obtained Professor Carroll's data, or how it would be used.

However, in a statement, information commissioner Elizabeth Denham, said that SCL Elections was unwilling to cooperate with its investigation over Professor Carroll's personal data.

"The company has consistently refused to cooperate with our investigation into this case and has refused to answer our specific enquiries in relation to the complainant's personal data - what they had, where they got it from and on what legal basis they held it," she said.

"The right to request personal data that an organisation holds about you is a cornerstone right in data protection law and it is important that Professor Carroll, and other members of the public, understand what personal data Cambridge Analytica held and how they analysed it."

The regulator's decision means potentially millions of US Facebook users whose data was harvested by Cambridge Analytica could make similar demands of the organisation.

Both Cambridge Analytica and SCL Elections have filed for insolvency after the Facebook data harvesting scandal and have questioned the ICO's jurisdiction given the data in question belongs to an American citizen, but the ICO doesn't agree and has warned the companies could face criminal charges for withholding the information.

"We are aware of recent media reports concerning Cambridge Analytica's future but whether or not the people behind the company decide to fold their operation, a continued refusal to engage with the ICO will potentially breach an Enforcement Notice and that then becomes a criminal matter," Denham added.

While Cambridge Analytica is closing, some of the people involved in the firm have started another venture called Emerdata.

Picture: Shutterstock

19/04/2018: Alexander Nix may face formal summons to Parliament

Alexander Nix, the suspended CEO of Cambridge Analytica, may face an official summons to appear before the Digital, Cultural, Media and Sport Committee after refusing to attend voluntarily.

The committee wanted him to address inconsistencies in testimony he gave in February stating that Cambridge Analytica did not have or work with Facebook users' data. Shortly afterwards, The Observer revealed that Cambridge Analytica allegedly had access to tens of millions of Facebook profiles.

Nix's lawyers said on Tuesday, however, that Nix was "not able to give evidence tomorrow as a consequence of him having been served with an information notice and being subject of a criminal investigation by the Information Commissioner's Office".

In response, committee chairman Damian Collins said he may order Nix to give more evidence to the committee.

"It is certainly the intention of the committee to take this further and consider issuing a summons for Mr. Nix to appear on a named day at some point in the near future," said Collins, who warned Nix last month on the severity of giving false statements to a select committee.

Though Nix did not appear, Cambridge Analytica whistleblower Brittainy Kaiser delivered written testimony and documents to the committee on Tuesday.

Kaiser wrote that Arron Banks of Leave.EU collected the personal data of people he sold car insurance to through his company GoSkippy, and that this data may have been used to target possible Brexit supporters.

"I do not believe Banks's written evidence to this inquiry is a full account of what happened," said Kaiser, submitting proposals for projects under Banks, along with supporting emails.

Cambridge Analytica also used quizzes to mine data on users, including a "sex compass" quiz, according to Kaiser's testimony.

"I do not know the specifics of these surveys or how the data was acquired or processed," said Kaiser.

She started the #OwnYourData campaign to push Mark Zuckerberg to change Facebook's terms of service so users get more rights over their own data. The campaign, which has 147,000 signatures, asks Zuckerberg to respond by the end of April. Facebook today introduced changes to its terms and conditions that bring them in line with the EU's impending GDPR data protection legislation.

12/04/2018: Zuckerberg claims ignorance about 'shadow profiles'

Facebook founder Mark Zuckerberg was grilled by members of a US congressional committee over the social network's use of so-called "Shadow Profiles".

Shadow Profiles are said to be data collected by Facebook about non-users of the network, such as email addresses, names tagged in photos, or details in a smartphone contact list. This data is hidden from users but used to recommend friends and new connections as well as social data analysis. This data is not normally disclosed to account owners but is used in Facebook's "People You May Know" feature.

The existence of shadow profiles came to light in 2013 when a bug in Facebook showed not just contact details of a user's friend's in a download file but also their friend's shadow contact information.

At the hearing, of the US House Energy and Commerce Committee, New Mexico Representative Ben Lujan asked Zuckerberg about these profiles.

Zuckerberg replied that "in general we collect data on people who have not signed up for Facebook for security purposes to prevent the kind of scraping you were just referring to."

Zuckerberg denied he was familiar with the term "Shadow Profile". Lujan then asked how many data points on average Facebook collects on its users. Zuckerberg replied that he did not know.

Lujan then asked how many data points Facebook collected on non-users. Again, Zuckerberg said he did not know. Lujan then asked how someone who does not have a Facebook account opt out of Facebook's involuntary data collection?

The Facebook CEO responded that "anyone e can turn off and opt out of any data collection for ads, whether they use our services or not." He then suggested that Facebook still needed to collect non-user data for security reasons.

"In order to prevent people from scraping public information [...] we need to know when someone is repeatedly trying to access our services," he told the committee.

Lujan pointed out to Zuckerberg that non-users wanting to request what data it has on them need to go a Facebook page and sign up for an account to access their data.

11/04/2018: Zuckerberg deflects US regulations in first Senate hearing

Facebook CEO Mark Zuckerberg emerged relatively unscathed from the first of two US Senate hearings, managing to deflect attempts to enforce tougher regulations on the social media platform.

During a grilling by a joint committee of 44 US Senators, the 33-year-old internet mogul took full responsibility company failings that led to the improper sharing of data on approximately 87 million Facebook users, however, made no commitments to supporting any specific reactionary legislation drawn up by Congress.

Zuckerberg began with an opening speech that was released ahead of schedule, followed by a series of questions aimed at probing Facebook's business model and the events leading to the exploitation of the platform by Cambridge Analytica.

He admitted that the company had failed to audit the agreement drawn up with Cambridge Analytica, and said that it had become apparent that the firm had misled Facebook to exploit its algorithms.

He also conceded that following the discovery of the data breach in 2015, failing to notify both the Federal Trade Commission and the public immediately was a mistake, though he believed the case to be "closed" after dealing with the issue internally.

On the question of whether Zuckerberg would support the introduction of legislation Zuckerberg said:

"I'll have my team follow up with you so that way we can have this discussion across the different categories where I think this discussion needs to happen."

Shares in the company fell sharply on the news of the Cambridge Analytica scandal, however, investors were clearly happy with Zuckerberg's performance on Tuesday, as shares saw the single biggest daily jump in almost two years, up by 4.5%.

It could be argued that some Senators' questions failed to probe enough into the failings behind the scandal, as many were targeted at Facebook's business model or the way it currently manages data on the platform.

At one point, it appeared Zuckerberg was answering basic questions on how an internet company operates. Senator Orrin Hatch asked: "How do you sustain a business model in which users don't pay for your service?"

"Senator, we run ads," said Zuckerberg.

This was shortly followed by a question by Senator John Kennedy on whether the company would work on providing better ways for users to delete their data, only for Zuckerberg to highlight that such functions already exist.

It wasn't all smooth sailing for the CEO however. At around 2 hours into the hearing, Senator Lindsey Graham from South Carolina launched a barrage of questions on the subject of market monopolies and customer choice, frequently interrupting Zuckerberg before he could finish answering.

On the question of what competitors Facebook has, Zuckerberg attempted to offer up rival tech companies such as Google, Apple and Twitter, only for the Senator to dismiss them as he believes Facebook offers a unique service.

Graham: "I'm talking about is there real competition you face. Because car companies face a lot of competition. If they make a defective car, it gets out in the world, people stop buying that car, they buy another one. Is there an alternative to Facebook in the private sector?"

Zuckerberg: "Yes Senator, the average American uses 8 different apps...to communicate with their friends and stay in touch with people, ranging from text to email."

Graham: "OK, which is the same service that you provide."

Zuckerberg: "Well, we provide a number of different services."

Graham: "Is Twitter the same as what you do?"

Zuckerberg: "It overlaps with a portion of what we do."

Graham: "You don't think you have a monopoly?"

Zuckerberg responded with a pause, before adding that "it certainly doesn't feel like that to me!", prompting laughter from the chamber.

While this moment was perhaps the toughest for Zuckerberg, other Senators were clearly displeased with his answers.

Writing on Twitter after the hearing, Senator Kamala Harris said: "Mark Zuckerberg's failure to answer several critical questions during his appearance before the Senate today leaves me concerned about how much Facebook values trust and transparency."

Tuesday's hearing was the first of two for Zuckerberg, who is also due to appear before the House Energy and Commerce Committee on Wednesday.

Speaking on Tuesday, Senator John Thune said a separate hearing would be held specifically on Cambridge Analytica, and other companies that may have been involved with the improper sharing of data on Facebook.

10/04/2018: Zuckerberg apologises for data scandal ahead of Congress hearing

Facebook CEO Mark Zuckerberg has apologised for failings in his company's data protection policies that led to 87 million users having their information improperly shared to third-parties, according to documents released yesterday ahead of his Congressional hearing on Tuesday.

Zuckerberg, who is due to appear before Congress to answer questions relating to improper data sharing deals on the social media site, also took responsibility for failing to stop the spread of fake news to influence public opinion.

"Facebook is an idealistic and optimistic company," said Zuckerberg, in a transcript compiled by CNBC. "For most of our existence, we focused on all the good that connecting people can bring.

"But it's clear now that we didn't do enough to prevent these tools from being used for harm as well. That goes for fake news, foreign interference in elections, and hate speech, as well as developers and data privacy."

"We didn't take a broad enough view of our responsibility, and that was a big mistake," he added. "It was my mistake, and I'm sorry. I started Facebook, I run it, and I'm responsible for what happens here."

In the documents released ahead of Tuesday's hearing, Zuckerberg said the company was committed to making changes to policy that would "significantly impact our profitability", but these would take some time to implement.

The scandal surrounding Facebook and its data policies show no sign of abating. Recent reports from New Zealand suggest that as many as 63,714 users could have had their information exposed to Cambridge Analytica's data harvesting, after only 10 people took part in an online personality quiz.

John Edwards, New Zealand's data protection commissioner, said he was urgently reviewing the case and would seek answers from Facebook on how the data was being used by Cambridge Analytica, according to the Guardian.

Edwards reportedly deleted his Facebook account upon hearing news of the incident and has said that New Zealanders should consider doing the same.

Apple's co-founder, Steve Wozniak, told USA Today that he would also be deleting his Facebook account over concerns that the social media site was becoming increasingly careless with user data.

"Users provide every detail of their life to Facebook and ... Facebook makes a lot of advertising money off this," he said to the newspaper. "The profits are all based on the user's info, but the users get none of the profits back."

Zuckerberg will appear before a joint hearing of the US Senate Judiciary and Commerce committee on Tuesday 10 April at 2:15 pm ET (7.15pm BST), and again before the US House Energy and Commerce Committee on Wednesday at 10 am ET (3 am BST). Details on how to watch Tuesday's hearing can be found here.

06/04/2018: Sheryl Sandberg admits 'mistakes'

Weeks after the Cambridge Analytica scandal first started making headlines, Facebook's chief operating officer (COO), Sheryl Sandberg, has finally broken her silence on the matter.

Speaking to the Financial Times, Sandberg admitted the company had underinvested in safety and security but added that this attitude was changing. Indeed, there has been a flurry of announcements this week from senior figures detailing changes that have been made to the way the company shares data and giving users more granular control over what data Facebook holds on them (read on below).

"We made mistakes and I own them and they are on me," Sandberg told the FT, adding: "There are operational things that we need to change in this company and we are changing them ... We have to learn from our mistakes and we need to take action."

Although Facebook admitted earlier this week that around 87 million of its 2.2 billion users are thought to have had their data scraped by Cambridge Analytica, Sandberg said the company is in the dark as to what exactly was taken, because it can't undertake an internal probe until the one being conducted by the Information Commissioner's Office (ICO) in the UK is completed.

Sandberg also acknowledged that she and CEO Mark Zuckerberg should have spoken out on the matter sooner, but added that they "wanted to make sure [they] knew exactly what happened" before making any public statements.

She also claimed that Russian meddling in the US election in 2016 through disinformation and incendiary posts took the social platform's top executives by surprise.

"Things happened in 2016 which we were too slow to understand. Now we are following and investigating very thoroughly," she said.

Her comments come after Zuckerberg held a press Q&A in which he admitted the company hadn't done enough to ensure third-party apps were using people's data responsibly and in line with Facebook's terms and conditions.

"In retrospect, I think we clearly should have been doing more all along," he said.

Facebook yesterday revealed new measures to bring Facebook's data protection policies in line with the EU's tougher rules coming into force next month, including making the policy easier to understand, and explaining how and why Facebook uses people's information.

05/04/2018: Facebook admits it 'could have done more' to scrutinise third-party apps

Mark Zuckerberg has admitted that Facebook "should have been doing more" to ensure third-party companies were using the social network's data responsibly, as revised figures suggest as many as 87 million users may have been affected by the Cambridge Analytica scandal.

The admission came as Facebook's chief faced a grilling from the press over the company's data protection practices and how much it scrutinised those services accessing social media data.

"In retrospect, I think we clearly should have been doing more all along," said Zuckerberg, speaking at the conference on Wednesday. "I'm not trying to defend this now: I think our view in a number of aspects of our relationship with people is that our job is to give them tools, and that it was largely people's responsibility how they chose to use them.

"I think it was wrong in retrospect to have that limited of a view," he added. "I think we need to take a broader view of our responsibility."

Facebook now believes as many as 87 million users may have had their data improperly shared with Cambridge Analytica as a result of past policies, some 37 million more than previously thought.

"We wanted to take a broad view that is a conservative estimate," said Zuckerberg. "I am quite confident that given our analysis that it is not more than 87 million. It very well could be less, but we wanted to put out the maximum we felt that it could be as that analysis says."

In response to concerns about its data protection policies, Facebook has said it now intends to roll out EU General Data Protection Regulations worldwide, dismissing earlier reports that the measures would be diluted for US users.

Facebook also announced a string of updates to its API that aim to restrict the access third-parties have to user data. This includes a new App Controls link at the top of a user's news feed that gives an overview of the data they're sharing with third-party applications. As part of this addition, Facebook will also be telling users if their data had been improperly shared with Cambridge Analytica.

From now on, if a user allows an app to access data on the events they're attending, that app will no longer have free reign to scrape information from the list of users also interested in the event.

Apps will also no longer be able to use the Pages API to access posts or comments on any page by default, and instead only those "providing useful services to our community" will be able to petition Facebook for approval.

The ways in which Facebook groups work are also changing. Instead of a single member being able to give permission for an app to access group content, any third-parties using the API will need to be approved by Facebook first.

The ability to search for a person using their phone number or email address has also been scrapped, after it was found that the feature was being abused to harvest profile data, and any application seeking to access a user's feed, including likes, posts and photos, will need to first ask Facebook.

Last week it was revealed that Facebook had been storing user call and text histories as part of an opt-in feature on the Android version of Facebook. Although it appears the company will still maintain this practice, Facebook has said it will review the data it collects to ensure no message content is stored, and that it will delete all logs older than one year. Broader data, such as the time of calls, will now no longer be collected.

Zuckerberg revealed that his company had opened an investigation into the data Cambridge Analytica data agreement, as it still doesn't know exactly what information the firm held on its systems. However, this has since been put on hold while the UK's Information Commissioner's Office conducts its own investigation, which includes the examination of files taken during a raid on Cambridge Analytica's London headquarters in March.

Zuckerberg is due to appear before Congress next week to defend company policies, having already refused to testify before a UK parliamentary committee.

26/03/2018: Cambridge Analytica: Watchdog examines 'evidence' after London office raid

The UK's data watchdog raided Cambridge Analytica's London headquarters on Friday evening after finally getting a search warrant approved by a High Court judge.

Twenty officials from the Information Commissioner's Office entered the Oxford Street address at 8pm to look for evidence relating to allegations the analytics firm harvested data from 50 million Facebook users without their consent.

The property search lasted seven hours, and an undisclosed volume of evidence was taken from the property, the ICO said.

"We will now need to assess and consider the evidence before deciding the next steps and coming to any conclusions," an ICO spokesperson said in a statement. "This is one part of a larger investigation by the ICO into the use of personal data and analytics by political campaigns, parties, social media companies and other commercial actors."

The ICO announced it was investigating the allegations against Cambridge Analytica on 17 March, and issued a Demand for Access to records two days later. However, the judge adjourned the case from last Wednesday to last Friday, meaning a warrant wasn't granted until late that evening. Media reports showed pictures of boxes being carried out of Cambridge Analytica's shared offices prior to the warrant hearings.

The search forms part of wider public scrutiny into whether Facebook did enough to secure the data it held on its users, as well as whether data was abused to influence elections.

A former Cambridge Analytica director told the Guardian on Friday that the firm's management deliberately misled the British public about its involvement with a pro-Brexit group, Leave.EU, during the referendum campaign period.

In an attempt to mitigate fallout, Facebook took out full-page adverts in both UK and US newspapers over the weekend, in which CEO Mark Zuckerberg said the incident was a "breach of trust" and said he was "sorry we didn't do more at the time".

His comments were later echoed by COO Sheryl Sandberg, who told CNBC on Friday that the case "was a critical moment for our company". "We are going to do everything we can," added Sandberg. "I would definitely have had Mark and myself out speaking earlier, but we were trying to get to the bottom of this."

Friday's raid kicked off a turbulent weekend for the social media company, which saw scathing opinion polls and fresh revelations of data misuse.

A Reuters poll in the US found that less than half of Americans now trust Facebook to adhere to US privacy laws, while 60% of users in Germany believe social networks are negatively impacting the democratic process, according to national newspaper Bild am Sonntag.

There were also multiple reports of users downloading their account files stored on Facebook's website, only to discover that call data from mobile phones was also being logged, including who they called and for how long, seemingly without their knowledge.

Facebook has since refuted the claim that this was done secretly, pointing to a usage agreement as part of its Messenger platform that allows users to opt-in to call and text history logging.

Zuckerberg has now been called to appear before a UK parliamentary committee to give evidence on the Cambridge Analytica's use of personal data. The committee has demanded a response by the end of today.

22/03/2018: ICO must wait for warrant

UK data watchdog the Information Commissioner's Office (ICO) will not get access to Cambridge Analytica's London offices until Friday at the earliest, after its demand for a warrant to search the premises was adjourned.

In a statement today, an ICO spokesperson said: "A High Court judge has adjourned the ICO's application for a warrant relating to Cambridge Analytica until Friday. The ICO will be in court to continue to pursue the warrant to obtain access to data and information to take forward our investigation."

While IT Pro asked the regulator why it was adjourned, a spokesperson declined to comment further. However, Guardian journalist Carole Cadwalladr reported that the judge granted an extension because Cambridge Analytica's legal counsel was unavailable.

It means the ICO's planned raid of Cambridge Analytica's offices is further delayed, despite reports earlier this week claiming boxes were being removed from the firm's shared premises on Tuesday.

Meanwhile, Facebook CEO Mark Zuckerberg has finally broken his silence over allegations that Cambridge Analytica accessed the data of 50 million Facebook users without their consent, seeking to reassure users that a similar abuse of people's information could never happen again.

The scandal, which broke earlier this week, surrounds the use of a quiz developed for data mining and an analytics firm that harvested the data not just of those who used the app (thisisyourdigitallife), but also of all their Facebook friends.

Several days after the story first broke, Zuckerberg finally issued an official response through Facebook, which includes a timeline of events and an explanation of how an app could have accessed data from individuals who didn't have any direct contact with it.

The Facebook CEO said: "The good news is that the most important actions to prevent this from happening again today we have already taken years ago.

"In 2014, to prevent abusive apps, we announced that we were changing the entire platform to dramatically limit the data apps could access. Most importantly, apps like [thisisyourdigitallife] could no longer ask for data about a person's friends unless their friends had also authorized the app.

"We also required developers to get approval from us before they could request any sensitive data from people. These actions would prevent any app ... from being able to access so much data today."

However, he added that the company is taking further steps to tighten up how it guards user data, including revoking apps' access where users haven't used them for three months, and reducing the data first given to apps on sign in to just the user's name, profile picture and email address.

This is particularly significant as part of the broad range of data collected by Cambridge Analytica included very sensitive data such as sexuality, location, religion and political leanings, and apps could access this data indefinitely.

Zuckerberg also claimed that Cambridge Analytica has once again affirmed that it has deleted all the data linked to this case something it previously said it had done in 2015, but which an Observer article subsequently contradicted with the account of former employee and whistleblower Christopher Wylie.

Cambridge Analytica has voluntarily agreed to a full forensic audit to ensure this is the case, Zuckerberg added.

Meanwhile, Wylie, the ex-director of research at Cambridge Analytica who blew the whistle on this scandal, took to Twitter to confirm he would be accepting invitations to testify in front of several legislative bodies in the US and UK.

20/03/2018: ICO seeks warrant to raid London offices

The UK's data privacy watchdog is seeking a warrant to raid Cambridge Analytica's London headquarters in order to investigate allegations that the company illegally harvested the information of 50 million Facebook profiles.

The Information Commissioner's Office (ICO) confirmed to IT Pro this morning that it is seeking an urgent warrant following the company's failure to comply with its request on 7 March for access to its databases and records.

"Cambridge Analytica has not responded to the commissioner by the deadline provided; therefore, the information commissioner is seeking a warrant to obtain information and access to systems and evidence related to her investigation," an ICO spokesman said.

The news follows an expos by the Observer that claimed Cambridge Analytica had used the Facebook data of more than 50 million people in order to build a powerful predictive analytics algorithm that could accurately predict political preferences, sexuality and other personal traits.

It has also emerged that Facebook was in the process of conducting its own internal investigation into Cambridge Analytica's actions separately to the ICO, which it ceased yesterday at the regulator's behest. Damian Collins, chair of the culture select committee, expressed doubt as to Facebook's motives in conducting its own investigation, telling the BBC that "This is a matter for the authorities".

"The concern would have been, were they removing information or evidence which could have been vital to the investigation? It's right they stood down but it's astonishing they were there in the first place."

Facebook is planning an open meeting today, to let staff grill the company's management on the unfolding incident. According to the Verge, the meeting will be led by Facebook deputy general counsel Paul Grewal, who will give staff background information on the case and field questions from staff.

It will mark the first time that staff have had an official opportunity to ask questions of the company's leadership since the scope of Cambridge Analytica's use of Facebook data was publicly revealed - although Facebook has admitted it was aware of the issue in 2015, a year after it happened.

The meeting is planned to last just half an hour, and an employee told the Verge that the move felt like a temporary solution to buy time until Friday's all-hands meeting where founder and CEO Mark Zuckerberg - who has thus far been silent on the issue - is expected to address employees. Collins has called on Zuckerberg or a senior Facebook executive to give evidence to his Parliamentary committee on the scandal.

To understand what the Cambridge Analytica and Facebook scandal is all about, read our explainer.

Facebook maintains that this is not a data breach in the traditional sense, and is instead a misuse of legitimately-obtained data. Security expert Graham Cluley agreed with the assessment, but said it shows fundamental issues with Facebook's design. "From Facebook's point of view, it's not a traditional data breach," he told IT Pro. "That's because this is how Facebook was designed, and many apps over the years have scooped up users' information and (privacy settings permitting) those of their friends as well."

"Hundreds of millions of times every day Facebook hones the content it displays to you based on what it has determined you are interested in, who you are, and what it thinks will be most effective. So, it's not that different from what Cambridge Analytica does with the same access to the data," he added.

"None of this is news. Facebook has been working this way for years. The only way to reduce your exposure is to refuse to play Facebook's game and not be a member of the site. If you can't bring yourself to leave, at the very least lock down your privacy settings and reduce the level of information that you share."

Cambridge Analytica's CEO, Alexander Nix, was also caught in an undercover sting by Channel 4, which recorded Nix seemingly bragging about using ex-intelligence operatives, micro-targeted propaganda and 'honeypot' traps to influence elections and other political proceedings.

"We're used to operating through different vehicles, in the shadows, and I look forward to building a very long-term and secretive relationship with you," Nix told undercover reporters posing as potential clients in an initial phone call.

"We have two projects at the moment, which involve doing deep, deep depth research on the opposition and providing... really damaging source material, that we can decide how to deploy in the course of the campaign," he said as part of a later meeting recorded by Channel 4.

Cambridge Analytica denied that it uses any of the methods alleged by the investigation, and stated that it was simply 'humouring' the potential client.

19/03/2018: Millions of Facebook profiles 'mined illegally' by Cambridge Analytica

The personal data of 50 million Facebook users was leaked to a data analytics firm and used to help Donald Trump win the 2016 US presidential election, it has been claimed.

Cambridge Analytica used this information to build sophisticated software models in 2014 to target US voters with political advertising, according to a whistleblower who said he helped collect the data.

Facebook, which denied the incident amounted to a data breach, confirmed it knew about it in 2015 but didn't inform affected individuals or data protection regulators.

Whistleblower Christopher Wylie said he worked with a Cambridge University academic to collect user data via a third-party Facebook app called thisisyourdigitallife.

Aleksandr Kogan created the app through his company Global Science Research (GSR) and worked with Cambridge Analytica to pay 270,000 Facebook users to take part in a personality test. They also agreed to have their data, such as their home city and Facebook 'likes', collected for academic use.

But then-Analytica employee Wylie told the Observer, which broke the story, that the app also collected data belonging to Facebook friends of the users who signed up to the quiz, producing a pool of data of tens of millions of people.

"We exploited Facebook to harvest millions of people's profiles," Wylie told the newspaper. "And built models to exploit what we knew about them and target their inner demons. That was the basis the entire company was built on."

Cambridge Analytica claimed it had deleted all the data shared by GSR when it discovered this information was collected in breach of Facebook's terms of service and had no reason to believe the data was obtained illegally.

"In 2014, we contracted a company led by a seemingly reputable academic at an internationally-renowned institution to undertake a large scale research project in the United States," its statement read.

"No data from GSR was used by Cambridge Analytica as part of the services it provided to the Donald Trump 2016 presidential campaign."

On the eve of the story breaking, Facebook said it has banned Cambridge Analytica from its platform.

In explaining its decision, Facebook said that while Kogan obtained people's data legitimately, by then sharing that information with Cambridge Analytica he had "lied" to the company and broken platform rules about not sharing such information with third-parties. Kogan maintains he acted legally and had a "close working relationship" with Facebook, the Guardian reports.

Facebook learned of this violation in 2015 and subsequently removed the app from its platform. It also "demanded certifications" from Kogan, Wylie and Cambridge Analytica that they had deleted the data.

However, while Wylie said he received a letter from Facebook lawyers in August 2016 to this effect, he claimed they never followed up to verify the data was deleted.

"That to me was the most astonishing thing," he said. "They waited two years and did absolutely nothing to check that the data was deleted. All they asked me to do was tick a box on a form and post it back."

The social network also failed to report the leak of data to the affected users or to US state regulators, because it claimed the event was not a data breach.

Facebook said: "Several days ago, we received reports that, contrary to the certifications we were given, not all data was deleted. We are moving aggressively to determine the accuracy of these claims.

"If true, this is another unacceptable violation of trust and the commitments they made. We are suspending SCL/Cambridge Analytica, Wylie and Kogan from Facebook, pending further information."

UK data protection regulator the Information Commissioner's Office is already conducting an investigation into the use of personal data in political campaigns and confirmed it's looking into this incident as part of the investigation.

"Our investigation into the use of personal data for political campaigns, includes the acquisition and use of Facebook data by SCL [Strategic Communication Laboratories, which is affiliated with Cambridge Analytica], Doctor Kogan and Cambridge Analytica," said information commissioner Elizabeth Denham.

"This is a complex and far-reaching investigation for my office and any criminal or civil enforcement actions arising from it will be pursued vigorously."

Damian Collins MP, chair of the Digital, Culture, Media and Sport Committee, accused Cambridge Analytica CEO Alexander Nix of misleading the committee when he told the committee while giving evidence last month that his firm had not received any data from GSR.

Collins said: "It seems clear that he has deliberately mislead (sic) the committee and Parliament by giving false statements. We will be contacting Alexander Nix next week asking him to explain his comments, and answer further questions relating to the links between GSR and Cambridge Analytica, and its associate companies."

The committee will also demand that Facebook CEO Mark Zuckerberg, or someone similarly senior, attends the committee to answer questions about the incident.

Main image credit: Shutterstock

The government faces the threat of a judicial review if it doesn't scrap a clause from the Data Protection Bill that will deny three million EU citizens access to their Home Office records, privacy activists warned today.

The bill, which aims to incorporate the EU's General Data Protection Regulation (GDPR) into UK law, is being debated in the House of Commons today, where the Open Rights Group and the3million, a grassroots organisation representing the EU citizens resident in the UK, hope the amendment will be thrown out.

If it isn't, the groups have repeated their warning that they will seek a judicial review, arguing that the clause, which denies immigrants access to data that public bodies deem is relevant to "effective immigration control", is unlawful and contradictory to the bill.

"The Data Protection Bill is supposed to be about giving people greater control over their data, but it contains an exemption for immigration cases that does exactly the opposite," said Nicolas Hatton, co-founder of the3million argues is unlawful and contradictory to the bill.

"Everyone should be entitled to know how the Home Office and other government agencies are using their records, and that is why the3million support removing this shocking exemption."

Such a clause, opponents fear, would mean immigrants wouldn't be able to question the Home Office's case for deporting them, leaving them unable to defend their right to remain in the UK.

But the Open Rights Group and the3million are asking for support to fund their legal challenge.

The bill faces its third reading in the House of Commons today, the final chance for MPs to debate its contents.

If the exemption remains, the Open Rights Group warned it could affect those seeking refuge in the UK, those affected by the Windrush scandal and the three million EU citizens who will have to submit their applications for a new immigration status after Brexit.

Jim Killock, executive director of Open Rights Group, claimed the government could use the exemption to cover up mistakes with immigration and deportation.

"People will need their personal records to prove that they are entitled to live in the UK. This is a matter of natural justice," he said.

"Using medical and educational records to trawl for potential suspects is equally worrying, as the government seeks to surveil the population in every way it finds convenient. Mistakes will be made, and lives disrupted or worse."

Other amendments to the bill that MPs will debate include one that would establish a "Leveson two" inquiry into the misuse of personal data by the media. English media organisations that refuse to sign up to an officially recognised regulator - the only current one is Impress - could face punitive legal costs.

A related amendment tabled by the Labour MPs Tom Watson and Liam Byrne proposes to force publishers that haven't signed up to the regulator to pay the legal costs of claimants who make legal proceedings against a news outlet, even if the publisher wins the case.

Their proposal has prompted a robust response from media outlets, such as the Guardian, whose owner,Guardian News & Media, has written to all MPs warning that the proposed amendment on section 40 would "further erode press freedom and have a severe chilling effect".

Picture: Shutterstock

The UK's data protection watchdog has confirmed Facebook is one of 30 organisations it is investigating over the use of personal data in political campaigns.

The Information Commissioner's Office (ICO) announced the scale of its probe into the use of personal data and analytics in the UK by political campaigns, parties, social media companies and commercial powers, following news that political consulting firm Cambridge Analytica allegedly took 50 million Facebook users' profiles without their consent to help President Trump win the 2016 US election.

Information commissioner Elizabeth Denham said: "The ICO is looking at how data was collected from a third party app on Facebook and shared with Cambridge Analytica.

"We are also conducting a broader investigation into how social media platforms were used in political campaigning."

She added: "This is an important time for privacy rights. Transparency and accountability must be considered, otherwise it will be impossible to rebuild trust in the way that personal information is obtained, used and shared online."

In addition to public policy recommendations, the investigation may lead to enforcement action, with the ICO retaining the power to issue fines, conduct an audit, serve an enforcement notice for organisations to take action, or even prosecute organisations for failure to comply with previous enforcement notices.

Denham noted that while she welcomed changes Facebook has made to its policy around third-party access to people's data, it is too early to assess whether they sufficiently comply with the law.

Details on the terms and scope of the investigation expands on the ICO's initial announcement of the investigation in May 2017 to examine whether whether political groups were using analytics in a way that breached data protection laws.

At the Data Protection Practitioners' Conference over the weekend, Denham told delegates: "Our ongoing investigation into the use of personal data analytics for political purposes by campaigns, parties, social media companies and others will be measured, thorough and independent. Only when we reach our conclusions based on the evidence will we decide if enforcement action is warranted.

"The dramatic revelations of the last few weeks can be seen as a game changer in data protection. Suddenly, everyone is paying attention."

Meanwhile, senior figures linked with the Cambridge Analytica scandal have been summoned to appear before a House of Commons inquiry into fake news and misinformation.

Brittany Kaiser, former director of program development at Cambridge Analytica, will be interviewed by the Digital, Culture, Media and Sport Select Committee on 17 April, followed by Alexander Nix, its former CEO, on 18 April.

Meanwhile Mike Schroepfer, Facebook CTO, will appear before the House of Commons inquiry on April 26, while Mark Zuckerberg is set to appear before Congress next Wednesday.

Damian Collins MP, chair of the DCMS committee, last month called for more powers to be handed to the ICO to investigate data breaches.

Writing in the Evening Standard, he said: "The serious questions that result from the investigations of the past week require us to change our approach to the use of personal data in communications and election campaigns.

"Clearly, the information commissioner needs more powers to check that tech companies are complying with the data protection law. This should include the immediate power to go into tech firms when necessary to review their systems to make sure our data is safe. We can't just take their word for it: someone has to have the power to look behind the curtain to see what they are doing."

Parties at the centre of the scandal have in recent days been coming to terms with their own shortcomings, in a bid to address criticism moving forward.

Facebook announced last week that it is turning off the ability to search for people using phone numbers and emails because most of its more than two billion users may have been at the mercy of "malicious actors" scraping their public profiles this way.

Meanwhile Sheryl Sandberg, Facebook's COO, finally broke her silence in an interview with the Financial Times, admitting the company had underinvested in safety and security measures, but insisted operational attitudes were changing.

Picture credit: Information Commissioner's Office

A long-running court battle between Microsoft and the US government over data sovereignty appears to be drawing to a close, with both sides calling for the dismissal of the case in light of a new law.

The case, which has been ongoing since 2013, centres around a number of emails stored in Microsoft's Dublin data centre related to a criminal investigation into alleged drug trafficking. Redmond has repeatedly refused to comply with a warrant to hand over the emails to US law enforcement agencies, arguing that as the information is stored outside of the country it doesn't fall under the jurisdiction of American authorities.

Prosecutors in the case have countered by saying that because the data is held by an American entity - i.e. Microsoft - it falls under American jurisdiction, basing their arguments on the US Stored Communications Act from 1986.

Over the course of the past five years, the case has been fought all the way up to the US Supreme Court and attracted interventions and amicus briefs from the likes of Apple, Cisco, AT&T and, most recently, the European Union.

It now seems, however, that this bitterly fought battle is coming to an end - for now, at least.

The US Department of Justice (DoJ) has requested the case be dismissed, according to Reuters, with Microsoft backing the call, despite the two presenting arguments to the Supreme Court justices as recently as 27 February.

The reason for the about turn is a new piece of legislation signed into effect by US president Donald Trump on 22 March, which both sides say effectively resolves the dispute. The CLOUD (Clarifying Lawful Overseas Use of Data) Act states that US law enforcement agencies have the right to issue and enforce warrants relating to data held by American companies abroad, although there is also recourse to object if the order is in conflict with foreign laws.

In the filing, Microsoft's lawyers said: "Microsoft agrees with the government that there is no longer a live case or controversy between the parties with respect to the question presented."

While it may be the end of this particular case, this isn't necessarily the end of the story completely. The DoJ has acquired a new warrant for the data governed by the new law, which means there's still opportunity for Microsoft to object and, indeed, for the whole cycle to start again.

Apple has paid the UK government another 137 million in added tax following an HMRC audit that found it had substantially underpaid one of its subsidiaries.

The "extensive audit" covers corporate tax for a number of years up to September 2015, during which time Apple Europe, which provides sales support, marketing and other services to fellow Apple subsidiaries, wasn't paid fair value for its services, according to the taxman.

As a result, Apple Europe paid an additional 136.9 million in tax, on top of 57.4 million for the 18 months leading up to April 2017, according to a strategic report filed with Companies House.

An HMRC spokesperson said: "We do not comment on the tax affairs of individual companies. Multinational companies must pay all taxes due and we don't settle for less.

"Last year alone, HMRC secured and protected over 8 billion in additional tax revenue from the largest and most complex businesses."

The audit was first revealed by The Financial Times, which reported that it was down to Apple Europe's increased activities. Apple Europe's Companies House filing shows that as of April 2017 it employed 791 staff, up from 605 in 2015.

IT Pro has asked Apple whether it has changed how much it pays its Apple Europe subsidiary following the audit, but the subsidiary's Companies House filing shows that in September 2015, it paid just 1.3 million in tax on profits of just 14.7 million. In contrast, pre-tax profits for the 18 months up to April last year stood at 297 million.

Apple has already fallen foul of the EU over back taxes, when the European Commission ordered Ireland to collect 13 billion in unpaid back taxes from the tech giant in the summer of 2016. Both Apple and the Irish government are separately appealing the decision, but Apple has deposited the funds in an escrow account awaiting the outcome of the appeals.

Now, both the US Senate and authorities in France are scrutinising Apple's recent admission that it slowed batteries down on older iPhones to help them cope with more modern software. Apple has denied slowing the batteries down to push people to upgrade to newer iPhones.

Picture credit: Mike Deerkoski

Shh - what's that? If you listen very, very carefully, you'll hear it; it's the sound of countless security experts smashing their heads against their keyboards in frustration. The cause, as so often before, is the government's laughable attitude to data privacy and cyber security.

Where to begin with this latest shambles? You may recall that First Secretary of State Damian Green was allegedly found to have rude and naughty pictures of the pornographic variety on his government-issued computer, which Green denies.

Nadine Dorries, Conservative MP for Mid Beds, leapt to Green's defence over the weekend, pointing out that if porn was found on Green's computer, it may not have been him who was downloading and/or viewing it on taxpayer time. After all, she said, her staff use her login to access her official computer all the time. Even interns on exchange programmes!

Er, sorry... What?

Yes folks, you read that correctly - Dorries is so free and easy with her access credentials that she even hands them out to visiting exchange students. To make matters worse, several of her fellow MPs admitted they also share their login details with staff, including Nick Boles, Will Quince and Robert Syms.

Of course, Dorries was quick to downplay the seriousness of her actions, stating that all she has on her computer is a shared email account, with no access to government documents. Boles, similarly, said that only the four people he employs to deal with correspondence from constituents have access to the passwords, which are regularly changed.

For the avoidance of doubt, let's be crystal clear: this is a dangerous, insecure and irresponsible practice. Under no circumstances should anyone be sharing one login between multiple staff members. There are numerous ways to ensure staff members can access a shared computer, mailbox or file storage system without having one login that simply gets passed around, and the fact that government MPs are apparently not using any of them is extremely alarming.

Dorries and co claim that sharing their login with staff isn't an issue, but let's take the time to unpick some of the many, many problems with these arguments.

Firstly, there's the issue of lateral movement. Dorries says that the only thing on the computer is a shared email account. Even if that's true, the computer itself is 'Westminster-based', and is likely to be connected to some kind of internal network. This opens up the possibility for lateral movement, using Dorries' machine as a way to gain access to a more important target within the network.

Then there's the issue of data protection. The shared mailbox used by the staff of Dorries and Boles presumably contains at least a partial list of constituents' names and email addresses, along with who knows what additional information shared as part of their correspondence. Behaviour like this puts all of that information at risk.

Last but not least, accountability is the biggest problem with using a shared login - and one that is best illustrated, ironically, by the very issue that prompted Dorries' admission in the first place. She is quite right in stating that if Green's access credentials were shared by his staff, there's no way of proving that it was him that was allegedly looking at porn, but that's a huge problem.

Let's imagine that, instead of perusing some nudes, the First Secretary of State was instead accused of using his computer to leak classified intelligence data to Russian agents. With a single shared login, it's virtually impossible to trace the source of the leak back to the mole. If everyone has their own credentials, it's instantly obvious.

The concept of not sharing your username and password with anyone is a basic, fundamental tenet of cyber security best practice, and the tools to ensure that you shouldn't need to share your credentials have existed for years. Considering that the Tories are supposed to be the party of business, its own staff seem to be trailing laughably far behind the curve when it comes to keeping up with industry security standards - which would be funny if it wasn't so alarming.