British Gas is carrying out a trial using excess heat from data processing to provide free hot water in homes.

The company has signed a deal with sustainable cloud business heata that will see the heat generated by corporate data processing channeled directly into hot water cylinder in the home.

Not only could this cut heating costs for homeowners, British Gas said it also avoids the need for energy-intensive cooling in the data center.

The system works through a small compute unit that's attached to the resident's hot water cylinder. This works as a tiny 'virtual data center', processing data for cloud computing customers while providing free hot water for the homeowner.

Each heata unit can provide up to 4kWh of hot water per day, according to the company.

British Gas has now officially launched the trial scheme, running its own data processing workloads on the heata units in ten employees' homes.

"Waste heat is a big problem for data centers, leading to significant energy costs for cooling. Yet heat is valuable. On the other side of the coin you have an energy crisis and people struggling to heat their homes," said Chris Jordan, co-founder of heata.

"British Gas launching this trial is a huge step and we would love to see other firms following their lead. Being able to say you have reduced your compute carbon footprint and provided free hot water to people during an energy crisis is hugely powerful for companies who take pride in their sustainability and social impact."

Operators are cutting down on data center waste heat

While this is a tiny trial project, there are increasing moves to use the waste heat from data centers to power homes.

The first large-scale scheme in the UK kicked off at the end of 2023 in the London boroughs of Hammersmith and Fulham, Brent, and Ealing, serving 10,000 new homes and 250,000m2 of commercial space, as well as a hospital.

"Recycling the huge amounts of wasted heat from our local data centers into heat and energy for local residents, a major hospital and other users is an exciting and innovative example of OPDC’s support for the mayor’s net zero ambitions," said David Lunts, chief executive of the Old Oak and Park Royal Development Corporation (OPDC).

A report last year from techUK said the concept of data center heat reuse had significant promise, but identified a number of problems, including seasonal fluctuations and variable energy demand.

Meanwhile, new data centers take a while to fill, and operators have limited control over external factors such as occupancy levels. This, techUK noted, means that relying on exporting the majority of the available heat based on the maximum projected IT load carries a significant risk.

The report recommended that data centers should look to reduce their energy consumption before implementing heat reuse.

MORE FROM ITPRO

• Inside Google’s plan to use data center waste heat to warm nearby homes and businesses
• New East London data center proposals include plans to use waste heat for local homes
• Microsoft's new data center will heat homes and businesses in Finland

A shift in the UK’s approach to data protection is underway, with the finished product potentially representing a huge benefit for small and medium-sized businesses (SMBs). 

The changes come in the form of the Data Protection and Digital Information (DPDI) Bill, which experts say would significantly alter existing data protection law when it comes into law next year.

This draft update to the existing UK data protection framework – currently based on the EU’s General Data Protection Regulation (GDPR) and  Data Protection Act (DPA) 2018 – aims to remove “red tape” associated with current laws. With lawmakers still devising the DPDI Bill, however, there's a lot to be determined, but the regulations could significantly lighten the load by making it easier and less costly to comply with. 

How will the DPDI Bill differ from GDPR and the DPA 2018?

As law firm Pinsent Masons notes, the proposals in the latest update are similar to those contained in the original DPIDI Bill introduced into parliament in July 2022. Among the changes, the paper introduces a more business-friendly approach, says Sarah Pearce, partner at Hunton Andrews Kurth. For example, it introduces a new basis for processing personal data for “recognized legitimate interests”, she says.

This could make things easier because it wouldn’t require a so-called Legitimate Interests Assessment (LIA) – a light-touch risk assessment thought to be good practice under the current laws. Instead, organizations would simply have to demonstrate the data they’re processing is necessary for the relevant purpose, says Pearce.

It also introduces several exemptions from the much-hated cookie consent requirement for situations that pose a low risk to user privacy. At the same time, the Bill proposes to remove the obligation on controllers and processors not established in the UK to appoint a local representative. This is an example of administrative “red tape” being removed under the Bill, says Pearce.

Meanwhile, the role of data protection officer (DPO) currently required will be replaced by a “senior responsible individual”.  “A senior responsible individual is only required when an organization processing personal data is a public body or is conducting high-risk processing, and they must be part of your senior management,” Pearce explains.

What are the benefits and drawbacks of the proposed regulations?

The proposed regulation offers multiple advantages. SMBs are expected to see proportionally higher reductions in compliance costs than their larger businesses, for example, says Sarah Williamson, partner and head of the commercial and technology team at Boyes Turner. “This is because they will generally have lower levels of data use prior to the reforms – although it does depend upon the nature of the business.”

She says the greatest compliance cost savings will be felt in the professional, scientific, and technological sectors. “This is due to the fact that the reforms are focused on removing barriers to data use for research purposes and artificial intelligence.”

Yet there are proposals that, in practice, could cause difficulties. Williamson cites the example of the removal of the need to have a DPO. “Given the requirement under the EU GDPR for a DPO to be independent, there are questions [as to] whether, for businesses caught by both UK and EU GDPR, the same person could perform both roles. There’s also uncertainty as to whether an external consultant could still fulfill this role.”

The removal of a one-size-fits-all approach to data protection could in some ways be a boon for SMBs. But in its current form, the bill “risks being incredibly confusing and more onerous than the standardized approach”, says Jamie Akhtar, CEO and co-founder of CyberSmart. “Without further guidance and clarity, we risk placing the onus on SMBs to figure out data protection requirements themselves, something that’s simply not feasible for many small businesses.”

At the same time, the regulation could cause issues for firms that operate in both the EU and UK. Alongside aiming to reduce regulatory “red tape”, the Bill’s other objectives are to ensure that data protection and privacy are securely protected and that the UK maintains its EU “data adequacy” status. Yet some commentators feel the government has forgotten that the priority of data protection law is to protect consumers, rather than help businesses, says Williamson. 

“Some businesses fear that because of the reforms, the EU may reassess and withdraw the adequacy decision, causing major disruption to firms operating and trading internationally who rely on a free flow of data between the UK and the EU.”

How can SMBs prepare for the DPDI Bill?

There is good news for SMBs: if you’re already GDPR-compliant, there shouldn’t be too much to do. You will automatically comply with the proposed legislation, says Lauren Wills-Dixon, solicitor and data privacy expert at law firm Gordons. 

Of course, there could be an impact on organizations operating in both the UK and the EU, says Wills-Dixon. “These will be dual regulated by the UK regime and the EU GDPR which could add some complications and complexities to their privacy and governance frameworks.”

SMBs must keep international data protection in mind when handling governance, risk and compliance concerns as businesses, says Jan Stappers, EU GRC specialist at compliance software firm NAVEX. “No matter the size, firms must generate, process, or collect data in order to operate,” he says.

Taking this into account, he thinks a “solid program” is “a good investment that will pay dividends as it helps foster business growth”.

There’s time to spare and the draft regulation’s text may change. The exact timing before it becomes law is uncertain, but the Bill is expected to become an Act by roughly March 2024. “There will be a third reading before it progresses through the House of Lords, so organizations should not rush to make any changes until legal obligations are clear and finalized,” Wills-Dixon says.

In the meantime, Wills-Dixon thinks it is useful for senior management teams to “note and consider things such as how changes to the DPO function and lighter record-keeping requirements would affect their organization’s structure and their current allocation of roles and responsibilities”. 

It’s been more than a decade since the UK government abandoned plans to create a new NHS IT system, costing taxpayers billions of pounds. The scheme had been designed to deliver electronic records, digital scanning, and integrated IT systems across hospitals and community care.

For many in both the public and private sectors, that contracting saga lives long in the memory and its failure has now returned front of mind with government plans to create the new NHS Federated Data Platform (FDP).

What is the Federated Data Platform (FDP)?

The government hopes the FDP will allow NHS organizations to gather operational data from across the huge organization’s disparate systems and consolidate it in one place.

Writing on gov.uk last year, National Data Guardian Dr Nicola Byrne explained how the “value of our data will only be realized if it can be organized in such a way that the NHS is able to use it well to improve treatments, services and ultimately our health and care”.

“The programme’s work to support better health and care for all through the better use of our data is too important an ambition to fail,” she added.

However, with the platform value set at £480 million and multiple bidders expected, this new scheme doesn’t come without controversy. Fears over privacy, and concerns about data security, are all driving debate. 

Iain O’Neil, a former NHS director, and now managing partner of health and social care at TPXimpact, believes we will only “truly unlock the potential of NHS data” once the fundamentals are right; this includes data standards, interoperability, and getting data where and when it’s needed most.

He suggests funnelling all NHS patient data into one private firm could be a risk, explaining: “The FDP will work best if it supports an ecosystem of suppliers tackling the difficult challenges the health and care system faces.” 

And looking ahead five to ten years, he adds: “Clinical decisions based on data gathered from the 67 million people plugged into the NHS Service should be ubiquitous, enabling learning and better decision making.”

A revolution for managing and storing data

A major challenge for the FDP will be to gain frontline buy-in from receptionists, clinicians, nurses, and all working with data within the NHS. Unless the culture inside the organization fully adopts it, it won’t achieve its aims, experts argue.

But Alex Case, who previously worked in Downing Street overseeing cross-Whitehall Brexit delivery, believes the platform could “revolutionize the way we store, manage, and utilize healthcare data in the UK” – although he agrees this is only one part of the story. 

“There needs to be a recognition of the need to coordinate and orchestrate a 'patient journey' across the different components of an integrated care system, because that’s the point of taking a consolidated view of the data,” Case, who is now public sector industry principal at Pegasystems, explains.

Many argue implementing cutting-edge technology and infrastructure in partnership with the private sector could allow for a more coordinated healthcare system. Case, however, adds: “It’s crucial the NHS ensures data is collected and shared in a responsible and transparent manner, with robust safeguards in place to protect patient confidentiality. Additionally, there is a need for clear guidelines around data ownership and access to prevent any potential misuse or abuse.”

He argues the platform should be feature-rich, rather than simply focused on data integration, if patients are to be placed on “the right pathway to get the right treatment, at the right time”, while also accounting for NHS workloads, backlogs, and prioritization.

“The government and their technology partners have the responsibility to work together to ensure we deliver the highest standards of ethics and governance so that we can address the healthcare needs across the nation better and more reliably than before,” Case warns.

Experts agree the FDP should lead to better decision-making, given it will break down silos, including CEO of Apheris, Robin Röhm. “By providing access to distributed data sources, stored in different sources and locations, the data analytics platform can then be utilized for a multitude of operational purposes from care coordination to improving medicine supply chains.

“Data is most valuable when it is extensive and detailed. As the current handling of data within the NHS involves sensitive data being stored on many separate systems, this often leads to poor access and visibility of data by stakeholders.

“Federated data ecosystems are the most pressing response to the problem of working across organizational and geographical boundaries as personal data never leaves its secure environment.”

Avoiding the threat of vendor lock-in

The need to keep information in the FDP from being personally identifiable is a major issue for campaigners and patient-led organisations. The security risks are real; for example, according to Palo Alto Networks’ Unit 42 team, healthcare was the third most-targeted sector in the UK, with 9% of all attacks targeting healthcare organisations.

Amanda Brock, CEO at not-for-profit OpenUK, suggests some form of NHS systems standardisation could help manage every aspect of the user journey from appointment booking to service delivery, while updating patient records along the way to be more efficient. But she warns its success depends on its implementation; the NHS must own the platform and it’s built on open source software in a “collaborative and transparent way”. 

She adds public sector platforms frequently “pay lip service to the legal definition of open source using an OSI-approved licence and sharing the source”, but this is “not enough to avoid lock-in”, she states.

“The scale of this project means there are few people that have the skills to lead it successfully,” Brock further explains, “but the risk with appointing a single vendor is of course lock-in. The NHS has spent years fighting against this. 

“We need to find a balance between the current status quo of myriad disjointed platforms and apps, and one single vendor that owns everything in perpetuity and profits off that patient data at our expense.” 

Risking privacy is a price worth paying

The FDP will lead to better patient care, as it makes a person’s complete medical history far more accessible, adds Waseem Ali, formerly CDO at Lloyd’s of London and current CEO of data and analytics consultants Rockborne. 

This is because of its “treatment-first, paperwork-later” approach. Ali’s years of experience with healthcare data, however, shows the use of integrated records has always been an issue, especially amid privacy concerns.

“It’s understandable for people to be hesitant about their data being shared,” he concedes. “However, most people are already sharing more information with Amazon or Facebook, sometimes without even realizing it. 

“So, if you are happy for Amazon to know your consumer preferences and shopping habits, then why aren’t you happy to share your healthcare information with the NHS so that you can receive the optimum level of care?”

Ali talks of the potential benefits that would exist if “healthcare professionals knew everything about a patient”. “This information could be harnessed to pre-empt the types of services they may need, which would be a gold mine for preventative care,” he adds. 

“Yes, there will always be the argument about data privacy, but the number of lives that could be improved, or even saved, is hard to out-argue.”

Databricks has launched a raft of new features for its flagship Lakehouse data lake platform, including artificial intelligence (AI) and natural language improvements as well as data governance features.

With Lakehouse AI, customers can develop generative AI applications, including large language models (LLMs), within the platform itself, with tools spanning the breadth of the AI lifecycle. This includes data collection, model development, and monitoring.

“This gives you control over your intellectual property,” said Databricks CEO Ali Ghodsi during his keynote address at Databricks Data + AI Summit 2023. He added every company in the next five years “will be an AI and data company” and would need the tools to create their own LLMs to be competitive, rather than rely on third-party services.

What is LakehouseIQ?

LakehouseIQ is the firm’s ‘knowledge engine’ that’s designed to make natural language interfaces, like chat bots, more accurate and relevant to the needs of a particular organization.

Sitting as a fabric between data and a front-end interface, the tool uses generative AI to understand a business’ unique culture, jargon, and data usage patterns, among other factors.

It ingests a vast quantity of internal material, including organizational charts, notebooks, and more, in order to understand how best to answer questions users ask via any chat interface.

It’s designed to be specific to each business, so natural language interactions are far more accurate and context-sensitive than classic chat bots. While not a chat bot or virtual assistant itself, it’s designed to improve the reliability and performance of these tools.

Databricks has made Lakehouse IQ available as an API, and the firm plans to integrate this into open source libraries.

New AI features in Lakehouse

Vector Search gives developers the capacity to improve accuracy of generative AI responses. The features creates vector embeddings based on files found in Unity Catalog — the central hub that gives customers access control, auditing, lineage and data discovery capabilities across their workspaces.

It creates vector embeddings from Unity Catalog files, and automatically updates them through integrations with Databricks Model Serving. Developers can also add query filters to provide better outcomes.

Improvements to AutoML also adds low-code functionality to finetuning LLMs. Any tweaks customers make to their LLMs will be owned by the enterprise, with data kept in-house and not shared with any third parties. This model can also be sahred within an organization with Model Serving, Unity Catalog and MLflow integrations.

Finally, Databricks has launched several open source models through its marketplace including MosaicML’s MPT-7B and Hugging Face’s Falcon-7B, as well as Stable Diffusion.

On the LLMOps front, MLflow AI Gateway lets customers centrally manage credentials for software as a service (SaaS) models or APIs, and provide access-controlled querying. This also allows for prediction caching to track repeat prompts and rate limiting to reduce costs.

MLflow Prompt Tools, meanwhile, is a no-code feature that allows users to compare different outputs from various models based on prompts that are automatically tracked within MLflow.

New governance features in Lakehouse

Also new in Lakehouse is LakeHouse Federation capabilities, which has broken down silos between data systems that previously existed on the platform. As a result, businesses are now able to discover, query and govern data across all their systems without the need to copy or move data. 

Query federation comprises catalog and querying functionality to consolidate and map out data asses from different platforms beyond the confines of Databricks, including MySQL, PostgreSQL, Redshift, Snowflake, Azure AQL Database, Azure Synapse, BigQuery, and others. Users can secure, audit and access data from one interface rather than having to move the data between different platforms.

Additional governance tools in Unity Catalog also lets customers apply access policies on any data asset that’s registered, including tables, rows, columns and tags. This comes ahead of future plans to define data access policies and push them out to other data warehouses.

The Lakehouse Federation's capabilities also include giving users a common approach to discovering and exploring both structured and unstructured data with a single query. Domain-owned data sources for analytics and AI use cases are also rapidly exposed, offering faster access to data. Finally, the changes make it possible for users to apply a single permission model for the data estate.

We all know data is the new currency, and the applications for data analytics are seemingly endless. Industries across the economy have been keen to adopt big data and analytics, but have done so to varying degrees of success. 

Football is an area in which data is everywhere. Indeed, the use of data analytics is rife – whether it’s quantifying different phases of play throughout a match or measuring player performance, or even identifying transfer targets.

There are countless data points available to coaches, presenters, commentators, pundits, and executives throughout the industry, who comb through the numbers and translate them into insights. 

But there are metrics off the pitch the football industry has less success in translating to real insights. Seeking to capitalize on the opportunities of on-pitch and off-pitch data is LaLiga, the premier division in Spain.

Tapping into rivers of data

To make the most of the untapped rivers of data flowing through football, the league created LaLiga Tech as a subsidiary that strives to capture and process the data generated throughout each facet of the annual competition, with the organization providing detailed analytics to the groups that make up the league.

“We know now that data is power – but if data is isolated, and you have silos of data that are unconnected, then you are not able to provide value for the clubs, or the fans,” says Fermin Martinez, senior data engineer for business intelligence and analytics at La Liga Tech. 

“But it's not only about having the data, you have to be able to join all the data together. In order to get real insights, you need to put a lot of different sources together and mix them.

“The real motivation is to be able to give value to clubs and fans. In order to do something with this data, we need a platform. We need the data lake we are using from Databricks, but we also need to apply data processing techniques.”

Collaborating with data off the pitch

Before the inception of LaLiga Tech five years ago, clubs were processing their own data and creating analysis in isolation. While this was useful for each club in isolation, it couldn’t provide insights that a larger data model would be capable of, Martinez says.

With 20 clubs all providing up to 25 data points a second throughout matches, this volume of data needed a place to be stored and processed. In the case of LaLiga Tech, this came in the form of Databrick’s data lake where, as Martinez puts it, the data originating from different sources can be “mixed” and insights can be generated.

“Before we started with Databricks, most departments inside LaLiga worked with different providers; these providers were the only ones able to access the data. As a result, the data was there but there was no connection between one source and the other because there was no connection between teams.

“We talk about data and how data is important. It's obvious that we need to get all this data together somewhere. The data lake is the place where all the data goes. Using Databricks, we are able to separate the data we receive into several states. We have a staging area inside this data lake, a prepared area where we start to prepare the data, and we have a final consumer area where the data is presented.”

Powering the sporting world with data

With these analytics, LaLiga Tech is able to provide insights to players and management around the probability of a player getting injured, the style of play when a goal was scored and, during the pandemic, how likely it was for players to transmit COVID-19 to each other during a match.

For the clubs and TV broadcasters, the data that’s generated provides the best time to start promoting season tickets for the next year. The insights will also reveal which events during a match – like yellow cards and goals – might cause people to tune into a game.

According to Martinez, these insights are not just reserved for football and can be applied to any sport from rugby, to tennis, to basketball. “We’ll need to use some different data sources,” says Martinez, “but the process is going to be more or less the same. We are now able to use what we have built to apply it to different leagues around the world.

"We want to package what we have built and to be able to apply it to a tennis competition, or the Olympic Games. If we talk about tracking the position of a player 25 times a second, this is something that a lot of sports could use. The conclusions we get may be different but the treatment of the information stays the same.”

Appian has launched a new process mining service for businesses which will see the company audit an organization’s data before providing actionable advice on how to improve internal processes.

The service is part of its new ‘Insight to Action’ program - a hands-on approach from the company to prepare and carry out data analysis for customers, then provide action points and findings.

For a one-time fixed fee, Appian will assess an organization’s data and current processes for any inefficiencies and work with the customer to implement more optimal workflows.

After the initial audit is complete, Appian will follow this up with its ‘action phase’ which involves a rundown of its analysis’ findings and ways to improve existing processes.

If required, Appian can also perform a second phase of process mining to validate any improvements.

“I think this is a practice that organizations should be following, to be a priority of strategy all across,” said Karina Buschsieweke, director of product strategy at Appian, to ITPro. 

“Having the ability to adapt whenever something is changing is so crucial, but that mindset of constant change is not easy because culturally humans don’t want to change.

“It’s something that you have to practice, and as leaders we have to put forward.”

The program, announced on Tuesday, is intended as a first step towards businesses adopting process mining, which can be difficult to approach for teams that lack the relevant data processing skills or the means to adequately interpret results.

Customers can also use process mining to identify which Appian tools might best improve their efficiency. 

For example, results could indicate that time to respond to customer emails could be decreased through the use of the firm’s new AI offerings. 

These products can automatically categorize emails to prevent long-winded sorting or filtering from taking too much time away from workers.

Appian will also provide a unified dashboard for viewing results from process mining in real time with Process HQ, which is set to be launched in Appian’s Q3.

In a keynote demonstration, the Process HQ was shown to provide visualizations of essential metrics and allow business users to track improvements in performance.

The system can also generate at-a-glance scorecards for tracking efficiency trends and return on investment.

Real-time responses with process mining can help businesses to track metrics in more detail and across a wider range than ever before. It’s something that Buschsieweke singled out as an area ripe for expansion.

“We developed this for a return on investment calculation, but this concept can of course be applied to many other topics as well which are not features yet such as carbon emission tracking.”

“It’s the same logic as when you have a goal, such as an emissions reduction goal, and then the scorecards let you monitor if you’re reaching this.”

Buschsieweke noted that at present, small businesses aren’t best suited to gain value from the program. 

However, with the eventual release of Process HQ these impacts will be lessened.

“A small business owner doesn’t have their own IT department or people who can do the analysis. If it’s someone that’s already using Appian, in the future they will be able to open Process HQ and get all these insights,” she noted.

“If you’re a small business and you only get a few orders per day, you can probably do a lot with Excel as well or just standard analysis. It’s something you always have to consider, how often your process is running, how complex it is, and how easy it is to get started.”

There are many challenges in handling subject access requests (SARs). Some may have a clear resolution, such as not retaining emails for 20 years, while others may be relatively untested issues, where the legislation and guidance aren’t wholly clear.

SARs are among the most common queries many data controllers, and data protection officers (DPOs) within organisations, will face on a daily basis. Even before GDPR, the Data Protection Act 1998 outlined the right for individuals to access their personal data held by organisations. The adoption of GDPR into UK law amounted to slashing the time from 40 working days to 30 working days for a response.

When it comes to responding to SARs, there are several common areas of confusion – often regarding whether or not particular information counts as “personal data” or whether any exemption might apply. These themes include “do I have to provide every email which mentions them over the past 20 years?” and “our customer services rep called them a twerp – can I withhold this?”. There are more unusual queries, too, which raise lesser-known aspects of the rules.

Where there’s no obvious answer to such questions, it may be helpful to open up a dialogue with the requestor to find a solution together, such as how they might identify themselves. You should also keep clear records of analysis and conclusions, including when you apply exemptions, and how you’ve balanced corporate interests with transparency for individuals. Although many SARs may seem straightforward, there are nuances in how the law is applied, which businesses need to remain on top of.

Do IP addresses count as personal data?

A company received a request from an individual to access information associated with an internet protocol (IP) address, which the requestor said was assigned to their computer. The question posed to me by the company was: do we need to provide this information?

A person has a right to access to personal data, which means information relating to an identified or identifiable individual. Someone can be identified by reference to an “online identifier”, which includes cookie identifiers and IP addresses. So, in theory, information associated with an IP address – such as logs of access to a website, or behavioural advertising profiles – could be personal data.

But it isn’t as simple as that. An organisation may or may not use IP addresses in a way that is intended to identify or impact specific individuals. They may automatically be collected by its systems, but either not reviewed, or only used for gathering aggregated statistics on website visitors. An organisation may also be unable to link the identity of someone making a SAR to the personal data associated with the IP address. So, if you receive a message from me asking for logs of my access to your website – which requires no credentials to access – can you be sure which IP addresses and therefore which logs relate to me?

How do you identify the individual making a SAR?

There’s an interesting and often overlooked provision of the UK GDPR under Article 11: if the purposes for which personal data is processed don’t require the identification of an individual, the organisation doesn’t have to maintain additional information to identify them. Furthermore, if the organisation can demonstrate it cannot identify them, the right of access, together with other rights of individuals, doesn’t apply. There’s an exception, however, If the individual provides additional information to identify themselves. They will then have a right to access their data.

Even where Article 11 doesn’t apply, where an organisation has reasonable doubts as to a requestor’s identity, Article 12(6) allows it to ask them for additional information to confirm their identity (before addressing the request).

On an aside, where there is an issue with identifying someone making a request, I often hear a stock response of “we shall request a copy of the individual’s passport and proof of address”. Indeed, a passport contains several potential identifiers; full name, image, passport number, date of birth, and proof of address would mean you now know where the person lives. But how would that actually help you if your only dealings with them are online, and the records you hold do not include any of the same identifiers? What you have achieved is the collection of additional (possibly more sensitive) personal data leading to greater data protection risks in handling it. Identification checks need to be tailored to the context of your relationship with an individual.

Whilst the company in question did hold certain records by reference to an IP address, it could not at that stage be sure the IP address uniquely identified the person making the request. It needed to consider, in relation to the records held, whether it was in a position to identify an individual, and whether the requestor could provide additional information to enable their identification.

Exemptions to the right of access

Another organisation received a SAR from someone looking for information on decisions made about them. Opinions and decisions about someone are that person’s personal data, as the information “relates to” them. Information about reasons for a decision may also be personal data, again to the extent it relates to the specific individual.

However, the organisation was concerned that releasing all records concerning relevant decisions would reveal confidential and proprietary information about its decision-making techniques. So the question to me was whether it could apply any exemptions.

The bulk of the exemptions can be found in schedules 2 to 4 of the UK Data Protection Act 2018, which complements the UK GDPR. One that pops up a lot is “management forecasts”. This applies where data is used for the purpose of management planning, for example in relation to redundancies, and provision of that data would be likely to prejudice the conduct of the business, which didn’t apply in this case.

Is intellectual property exempt from SARs?

One exception relating to SARs sits under Article 15(4): “The right to obtain a copy… shall not adversely affect the rights and freedoms of others.” The data protection rights of other individuals most commonly spring to mind, but this can also refer to “trade secrets or intellectual property and in particular the copyright protecting the software”.

The purpose of the right of access is transparency, and exemptions are there to protect other businesses or public interests, but they shouldn’t be overused. It’s also important the application of Article 15(4) requires a balancing test between the requesting individual’s right of access to data, IP or rights of the other party. Just because another right exists does not mean that Article 15(4) automatically applies – in some cases the importance of providing access to personal data overrides the other right. In addition, perhaps curiously, it is an exception to the right to receive a copy of the data (under Article 15(3)), but not a general exemption to the right of access.

Taking all this into account, companies should not take an all-or-nothing approach. They need to assess how much personal data they can still provide, and how they can provide it, without unreasonably affecting other rights. A company could, for example, send reduced sets of data, or redact or extract data from records.

What do the data regulators say about intellectual property?

The reference to intellectual property rights in the UK GDPR is another frequently overlooked provision. Indeed, the Information Commissioner’s Office (ICO) guidance on exemptions doesn’t seem to mention it at all. It is touched on, however, within the European Data Protection Board (EDPB) guidelines on the equivalent right of access under the EU GDPR. They give an example of a gamer being denied access to a gaming platform due to allegations of cheating, detected by anti-cheating software.

The gamer makes a SAR, and requests information about the reasons for the decision. The gaming platform should provide some information about the alleged cheating – such as dates and times, what was detected – but may be able to withhold information concerning the technical operation of the anti-cheat software, if this is a trade secret and, presumably, to protect copyright.

Another example in the guidelines relates to a company’s proprietary techniques for a medical assessment. If the person makes a SAR, the company may be able to withhold information about the results of the assessment as it may reveal its techniques.

Regarding the original query, the organisation therefore needed to think about a few things:

1. What specific content concerning decisions was the requestor’s personal data, and which decision-making techniques may be revealed by sharing this data
2. Whether its decision-making techniques gave rise to intellectual property rights (to be assessed under intellectual property laws
3. If so, how to balance those rights with the requestor’s right of access, and then to reach a conclusion: what personal data could and should still be shared, and how?

What about automated decision-making?

Since we’re talking about decision-making, though, that’s not everything. As well as giving individuals a right to access personal data, Article 15(1) UK GDPR requires information to be provided about solely automated decision-making. This means decisions made by technological means without human involvement, such as automated credit scoring.

If these were taking place, the organisation must inform the requestor (amongst other matters) about the logic involved in those decisions. This does not necessarily mean sharing detailed algorithms, which may also prejudice intellectual property rights. But the information must be meaningful for the individual, to enable them to understand how the decision was made.

Windows 10 users have reported a broken Microsoft 365 trial offer which prevents access to the desktop until credit card details are entered.

On booting up, some Windows 10 devices have shown a full-screen offer for a trial version of Microsoft 365, the tech giant’s suite of productivity apps.

Buttons at the bottom of the screen read ‘Use for free’ and ‘No thanks’, but each leads to a screen prompting users to enter credit card details.

One Reddit user posted an example of the issue on the platform's Windows 10 community, noting that they had to put in their credit card details to gain access to their desktop and cancel afterwards to prevent being charged recurring payments.

No other buttons on the window enabled the user to skip entering payment details.

Microsoft 365 costs between £4.50 and £16.60 per month for businesses. It is unclear whether the nature of this bug enables it to appear on devices that are already subscribed to a plan with the suite, which could decide the likelihood of it being recreated on business laptops.

Another user posted a similar bug on a subreddit designed to highlight bad user interface (UI) design. Their full-screen offer advertised 50% off Microsoft 365 Family, and identically to the other post pressing ‘No thanks’ took them to the payment details screen.

The offer is meant to be shown in the Windows out of box experience (OOBE), which users see when a device is first turned on after purchase or immediately following a Windows 10 factory reset.

As the bug has not been addressed by Microsoft, it is not clear if it is the result of an erroneous update or a flaw with the individual users' machines.

One Reddit user asked for the name of the device's original equipment manufacturer (OEM).

"Looks like a bug in their OOBE - e.g. strings got swapped in their translations," wrote one individual.

"Not a [Microsoft] problem - though I'm sure if it gets into the right channels could mean a big fine for the OEM."

IT Pro has approached Microsoft for more information.

Digital transformation is at the centre of operational efficiency and innovation across businesses, but without a clear roadmap leaders struggle to find long-term benefits in optimisation initiatives such as automation.

This whitepaper shares how IBM's Process Mining offers unique differentiators and capabilities, and explains how it lowers risk, improves decision-making and maximises the returns of automation.

Download now to read client success stories and how to get started.

Provided by

Automation can enable greater efficiencies for organisations, with streamlined processes and better experiences for both users and customers. On the journey to digital improvements, there are a few business options that offer different advantages, benefits, and drawbacks.

This guide is designed to help purchasers of robotic process automation (RPA) technology make a more informed decision. It explains the benefits and limitations of RPA, where it fits in the automation landscape and how to choose the right level of RPA.

Read this guide for tips for choosing the right RPA provider and how to get started.

Provided by

Sustainability has a become a business imperative for organisations globally, with business leaders increasingly needing comprehensive data intelligence suites that can address sustainability issues more holistically.

This recent IDC paper examines how sophisticated technology trends can process data from various sources, curate it, and translate it into usable formats that meet the requirements for standardised, quantitative, metrics-driven ESG information.

Download now to realise the full value of sustainable intelligence solutions.

Provided by

Meta’s latest fines bring the total penalties incurred by the tech giant to more than €1 billion over the last 12 months.

On Wednesday 4 January, Ireland’s Data Protection Commission (DPC) imposed two sizeable fines on the social media giant totalling €390 million for GDPR violations.

A lengthy probe by the data protection watchdog found that Meta’s use of data across its Facebook and Instagram platforms was unlawful.

The DPC investigation was launched following complaints made by privacy campaigner Max Schrems in 2018. The complaint argued that, in order to comply with the newly-implemented regulations, both platforms requested users click “I accept” to confirm they agreed to updated conditions for ad targeting purposes.

According to the DPC, this meant the social media company had “forced” user consent to data processing unless they left the social media platforms, resulting in a breach of privacy regulations.

An initial fine of €210 million was issued for GDPR violations on Facebook, the DPC said, while a second €180 million fine was also related to breaches by Instagram.

In a ruling on Wednesday, the DPC said that Meta must also bring its data processing operations in line with GDPR requirements within three months.

Meta said it plans to appeal the ruling, and told CNBC that the decision will not result in a ban on personalised advertising on Meta platforms.

“The suggestions that personalised ads can no longer be offered by Meta across Europe unless each user’s agreement has first been sought is incorrect,” a spokesperson for the company said.

“There has been a lack of regulatory clarity on this issue, and the debate among regulators and policymakers around which legal basis is most appropriated in a given situation has been ongoing for some time,” the statement added.

Forrester analyst Stephanie Liu warned that if the ruling stands, however, Meta will likely be forced to “explicitly ask users for consent for behavioural advertising” - or find a workaround.

“It would also need processes, workflows, and capabilities to disable targeted advertising for users who don’t consent while also convincing advertisers that its properties are still worthy of their ad budgets,” Liu added.

Recurring Meta fines

This latest batch of fines marks the climax of a difficult 12 months for the social media giant. Across the past year, Meta has incurred more than €1 billion in fines from European regulators.

In November, the company was fined €265 million by the DPC after a lengthy probe into a damaging data scraping incident.

The 17-month inquiry found that personal data belonging to more than 533 million Facebook users was publicly available online, and had been scraped from the platform over a 15-month period between May 2018 and September 2019.

Two months prior, in September 2022, regulators also imposed a €405 million fine after Instagram was found to have mishandled teenagers’ personal information.

This consistent wave of regulatory crackdowns has prompted the tech giant to set aside a €2bn (£1.7bn) fund to accommodate for penalties expected across 2023, according to reports from the Irish Times.

AI and machine learning offer great opportunities for organisations to improve workflows, enhance productivity, and strengthen monitoring. To ensure success, IT decision makers and developers need to choose the right hardware and software for their development infrastructure; it’s no longer just about the cloud or HPC.

This whitepaper shares how workstations are proving their worth in AI development, working together with cloud AI platforms to support longer, or less costly, tasks, and enabling the cloud to focus on more robust processes.

Download now to learn five ways workstations can be utilised effectively and efficiently for AI apps and how to get started.

Provided by

The data integration tools market is seeing renewed momentum driven by requirements for multi-cloud and hybrid data integration and data fabric design patterns. Data and analytics leaders should use this research to evaluate suitable vendors for their existing and upcoming data integration use cases.

This whitepaper evaluates the core capabilities and functional requirements of current data integration tool vendors, ensuring they can offer organisations consistent access and delivery of data across a variety of data sources.

Download now to learn how the vendors measure up and why IBM is considered a leader in this field.

Provided by

As the renowned author, Douglas Adams, once wrote: “Space is big. Really big. You just won't believe how vastly hugely mind-bogglingly big it is.” It’s no real surprise, then, that getting to the bottom of the origins of the universe takes a massive – almost unbelievable – amount of computing power.

Getting to the bottom of some of the universe's deepest mysteries has meant setting up a massive computer, with Durham University among a handful of UK institutions jointly working on the project. Admittedly, it isn’t nearly as big as the Deep Thought system that features in The Hitchhiker's Guide to the Galaxy, and the answers are far less vague than “42”.

Before even beginning to tackle these questions, researchers sought a device powerful enough to peer into the very beginnings of space and time. This is where the James Webb Space Telescope (JWST) came in. Successor to the great Hubble Telescope, the JWST conducts infrared spectroscopy, with its high resolution and sensitivity allowing us to examine objects deep in space with detail its predecessor never managed. The JWST was launched into space last December and is already producing phenomenal results. Clusters of breathtaking images published by NASA speak for themselves.

This is only part of the journey, though, and institutions such as Durham University are hoping to use the tiny clues revealed by such images to help decipher the origins of the universe. They should, over time, begin to give answers to such questions as what the universe is, what it’s made from, what dark matter might be, and so on. But first, data needs to be crunched on a massive scale while, at the same time, researchers run in-depth simulations over and over.

The origins of everything

Durham set up a Cosmology Machine (COSMA) last year to begin answering these questions. This isn’t the first COSMA – that came online in 2001 – with the latest version, COSMA8, becoming operational in October 2021. It’s part of the Distributed Research utilizing Advanced Computing (DiRAC) facility, which has five deployments at the Universities of Cambridge, Durham, Edinburgh, Leicester and UCL. The DiRAC-3 memory intensive (MI) service at Durham runs workloads that require massive amounts of memory.

COSMA’s role is to run a simulation of the big bang. By tuning different input parameters and different models, taking into consideration things like dark matter and dark energy, the team attempts to match a simulation with what’s observed by astronomers using the JWST. Using a heavy amount of statistical analysis, the team can fine-tune the input parameters of these models to get a better idea of how the universe might have been formed.

To do that, COSMA8 has a high amount of memory per core, with the current system boasting 1TB of random access memory (RAM) per computer to power the cosmology simulation. This simulation which starts with the big bang before tracking how this might propagate through spacetime, can take months to run. The additional memory capacity helps to shrink that time span.

The compute cluster is based on Dell EMC PowerEdge C6525s. With four servers arranged in a 2U formation, each chassis contains 512 processing cores, with up to 3,200 MT/s (megatransfers per second) memory speed to decrease latency and PCIe Gen4 to transfer data quicker. The first installation had 32 compute nodes to iron out any problems with coding as well as testing and benchmarking. Shortly after, this was expanded to 360 nodes with plans to increase this even further to 600 nodes next year.

COSMA8 also features AMD Epyc CPUs, with 64 cores per processor. Each node contains dual 280-watt AMD EPYC 7H12 processors per node. According to Alastair Basden, HPC technical manager at Durham University, having so many cores per node decreases the amount of internode communication, speeding things up along the way. Basden’s team worked with Dell to move half of COSMA7 to a switchless interconnect, meaning all the nodes are connected in a 6D torus rather than to a central hub.

Simulation theory

One of the reasons for building this style of interconnect was that some of the code running the simulations didn’t parallelise 100%.

In order to scale well with the new technology deployed at Durham, Basden says the team there developed code in Swift to dynamically allocate tasks to nodes with available processing power, using task-based parallelism. This reduces the imbalance often seen in HPC codes. The code automatically rebalances itself periodically to consider different parts of the universe that may be denser or sparser. These simulations can take several months to carry out and produce petabytes of data which the team then analyses.

It was also important for the system to have a very fast scratch storage partition as when the simulation is running it needs to dump a lot of data to disk very rapidly.

With the system in place, Basden says it’s running as expected. The real challenge has not been with the hardware but with the software. For Basden, this means getting the software environment “working in a way in which maximises utilisation of the hardware and makes it easier for the researchers to use”.

Another challenge was in being one of the first to use direct cooling using water to take heat away from the system. He says that “was a bit of a learning experience in how to manage these systems”. He adds Dell helped the team thorough this challenge, and it is now very reliable, so much so that Dell will be offering direct liquid cooling across its next generation server portfolio when it launches next year.

As for the future, there is talk of the possibility of using composable systems from a company called Liqid that enables infrastructures to virtually pool GPUs, CPUs, memory, and network switches, among other hardware components. While Basden may not use GPUs any time soon – as he says CPUs are better for the memory intensive simulations Durham is running – it could be of use in allocating extra memory to a server when running those simulations.

This novel technology has led to Basden sparking up discussions with code developers, lab scientists and researchers on how they would be able to redesign their coding to take advantage of a much larger bank of cheaper memory.

Two apps described as 'mandatory' for attending the Qatar World Cup have been the subject of privacy complaints by multiple European data regulators, amidst claims they collect sensitive data outside of their remit.

‘Ehteraz’ and ‘Hayya’ are both apps released by Qatar’s Ministry of Interior and its Supreme Committee for Delivery & Legacy, respectively. The former is listed on Google Play as a contact tracing app for the tournament, while the latter is listed as a portal through which to book tickets, manage accommodation, and enter stadiums, but experts have argued that the permissions required by both apps go far beyond these basic functions.

In a statement, Germany’s BfDI (The Federal Commissioner for Data Protection and Freedom of Information) urged football fans looking to download the app only to do so if “absolutely necessary”.

The regulator also suggested that users should put the apps on a spare phone that contains no other personal data or contact information, and wipe the phone's storage and operating after use.

It alleged that the permissions and data processing of both apps goes beyond that described on their app store listings, that one of the apps tracks the number of phone calls made, and that data used by the apps is “transmitted to a central server” in addition to remaining on the device.

Datatilsynet, Norway's data protection authority, likewise stated that it does not know “what these apps actually do,” but that Ehteraz is required for seeking any medical treatment whilst in Qatar.

It recommended not giving the Hayya app permission to use device location and urged all businesses planing to send employees to the Qatar World Cup to carry out proper risk assessments.

“We are alarmed by the extensive access the apps require. There is a real possibility that visitors to Qatar, and especially vulnerable groups, will be monitored by the Qatari authorities.”

Google Play notes that Hayya’s security practices do not include data encryption, and the developer has neglected to provide a way for users to delete their data. The official FIFA guidance on Hayya explains that a Hayya card is “required to access the stadium on match day”.

The UK government's travel advice for Qatar states that visitors will not be required to register with Ehteraz prior to arrival, but that Hayya is a mandatory ID required not only for entering stadiums during the event, but also for entering Qatar in general.

“We are aware of media reports on this matter and we will consider the potential impact on the privacy rights of UK citizens,” an ICO spokesperson told IT Pro.

“If anyone is concerned about how their data has been handled, they can make a complaint to the ICO. We’d also always advise travellers who may be heading to Qatar to refer to our Your Data Matters page to ensure they are aware of their data rights."

The ICO declined to comment on the suggestion of using spare phones for app use.

Apps released for the promotion of, or to interface directly with, sports events have a history of security concerns. At the start of 2022, a ‘devastating flaw’ was discovered in China’s Beijing Olympics app that allowed threat actors to circumvent encryption intended to protect users’ files and voice recordings.

The MY2022 app, the use of which was mandatory for both international and domestic visitors to the games, was also found to transmit some metadata without any SSL encryption and lacked transparency over the extent to which it shared user medical data with third-party organisations.

In response, the Federal Bureau of Investigation (FBI) urged athletes to use temporary phones throughout the Beijing Winter Olympics, and advised participants and spectators not to download apps required to attend the event for fear of personal data theft, tracking, or malware.

Cloud computing firm Appian has championed its newly-released Appian Data Fabric system, claiming the system's real-time read/write feature offers capabilities that aren't offered by any competing vendor.

In the keynote that opened its annual Appian Europe conference, the system, which launched as part of Appian 22.4 last week, was the central talking point. The solution combines the automation and low-code development for which Appian is known across a single virtual data model, allowing customers to access unified data and identify areas in which to implement systems such as robotic process automation (RPA).

Appian insisted that while rival data fabric systems are available, none can offer its ease of adoption. The firm said 45% of its customers have already leveraged Data Sync, a process for caching source data that is at the heart of the data fabric system, and stated that for all its benefits Appian Data Fabric is no step up from these existing systems.

The workloads, automations, and queries set up by customers already laid the groundwork for Appian Data Fabric, as metadata from all of this can be used to optimise data management within the platform.

For example, by analysing how a customer builds its processes, what it automates, and which queries that analysis will require, Appian’s data fabric can automatically repartition and re-index data within its virtual model to ensure it can be accessed with maximum efficiency.

“When other clients say ‘oh yeah, we have a data fabric,’ what they're talking about is probably much more like a data lake,” said Michael Beckley, CTO and a founder at Appian.

“They might be able to analyse data from different locations. But being able to write transactions to the fabric in real-time, and read from it, that’s what the Appian data service can do, that no one else can.”

In his keynote address, Beckley also stressed that the data fabric is an improvement to the system that customers already use rather than a new product, and comes with no new training requirements or added cost.

He also stated that the company sees Data Fabric as an alternative to rip and replace models, or any vendor lock-in, giving the example of a data fabric that connects Oracle, Microsoft, and Salesforce alongside the Appian database.

“The answer is not just Appian. The answer is using Appian to take advantage of the technology investments you already have. And with Appian's data fabric, we're confident you'll be able to do that.”

A data fabric is a data management architecture that integrates multiple data pipelines or cloud environments in an end-to-end data environment, allowing customers to access their data through an optimised access point that requires little to no code.

The firm claimed that Appian Data Fabric has doubled search speeds, requires customers to use 75% less code to build charts, and allows zero-code apps to be built up to ten times faster than previously possible.

Last year, Gartner named data fabric as a key technology trend for 2022, noting its potential for adding to existing infrastructure. Since then, a number of companies have offered data fabric systems, such as Google Cloud.

Down the line, Appian said its existing data system could also be used to measure parameters such as carbon impact across a number of silos.

Gartner recently published findings that marked sustainability as a key technology trend for 2023, and that businesses investing in it are doing so to tackle disruption, and reap its short and long-benefits.

Malcolm Ross, deputy CTO at Appian, told IT Pro that regulatory pressure increases in a recession, and that environmental, social, and corporate governance (ESG) will be core to this.

“ESG is definitely the next GDPR-level type of regulatory oversight that companies will have to report their carbon footprint. They will have to report how their governance modelling, their board, is accurately collecting the culture of that organisation or that country as well.”

Ross also stated that efficiency savings through efforts such as automating the back office are unlikely to provide meaningful results with sustainability in mind. He argues that only holistic oversight, allowing for proper identification of weaknesses through processes such as big data analytics, will be necessary.

“You're not going to become better at ESG and sustainability, by just doing automation what you need is visibility.”

Head of process mining Karina Buschsieweke told IT Pro that Appian’s data fabric is already capable of providing this visibility, and that growing regulatory pressures might lead to more specific focus on this process down the line.

“How process mining works is, you have attribute data, so you have a process and you can add as many attributes to that as you like, so can be location, product, etc.," said Buschsieweke

"But it could also be CO2 as a further data attribute. Now, of course, today the major challenge for all companies is where to get the CO2 impact data from, because that's also a whole different issue - how to standardise it, and make it comparable.”

“However, if you have the data already, you could do this with our solution today. And then probably, there could be features that might even make it easier for customers than this. I think at some point in the future, companies will be required to report on CO2 the same way as they have to report their euros.”

VMware has announced a number of new data sovereignty solutions as part of a new initiative to make cloud compliance easier to manage and monitor.

The VMware Sovereign Cloud Initiative encompasses a number of changes to existing VMware services, such as VMware Tanzu and VMware Aria Operations, as well as a new framework for ecosystem wide compliance solutions.

These sovereign software as a service (SaaS) products are intended to help companies deliver services like those found in the public cloud, remaining compliant with data regulations. The Sovereign Cloud has been drawn up in alignment with European data sovereignty project Gaia-X, and other such international regulations.

VMware promises that in addition to the changes announced, sovereign cloud services will continue to see expansion through its cloud partners, to ease the process of maintaining data compliance and data protection across cloud services.

The cloud giant also revealed that it now has 25 Sovereign Cloud providers across the globe, more than double the number at the time the group was formed, including OVHcloud, UKCloud, Telefonica, Hitachi, and Tata Communications. In order to address customer concerns directly, VMware has additionally assembled a “consortium” of industry policymakers and cloud providers, working to define requirements across sovereign clouds.

As VMware seeks to address what it calls ‘cloud chaos’, in which businesses utilising multi-cloud are wasting resources to redundancies across multiple silos, and lack the oversight or central control to fix these issues, sovereignty has arisen as another pain point amongst its partners.

“VMware engineers made the Sovereign Cloud Initiative to address this issue, said Raghu Raghuram, chief executive officer at VMware.

“The VMware Sovereign Cloud Initiative is a set of software controls, overlaid on top of the standard VMware, infrastructure and platform to deliver sovereign security, compliance, control, autonomy and allows you to innovate on such a platform.”

As part of the update, VMware Tanzu Kubernetes Grid will offer users the enterprise-ready runtime they have come to expect from Tanzu, bolstered by open source server components such as Fluent Bit, Grafana, and Prometheus. In addition, Tanzu Application Platform will allow developers to perform air-gapped installation, dynamic API registration to ensure automation is secure, and a vulnerability dashboard through which teams can perform better pre-deployment security checks.

VMware’s multi-cloud management platform Aria, meanwhile, is being given its own Operations Compliance pack, in an effort to provide continuous compliance monitoring, reporting and remediation, with a backbone of automation that remains. It can be fully integrated with VMWare Cloud Director, and comes with a central dashboard from which users can monitor cloud-wide compliance, for compliant DevSecOps.

Research undertaken by Vanson Bourne, commissioned by VMware, has shown that 96% of of surveyed companies believe that over the next two years, data will be a source of revenue, but an almost equal figure (95%) identified data sovereignty as a point of concern.

“There is no data sovereignty without cloud sovereignty. And sovereignty does not have to come at the expense of cloud innovation,” said Rajeev Bhardwaj, vice president, cloud provider platform solutions, VMware.

Speaking to the importance of cloud sovereignty at a press event, Bhardwaj emphasised how the company’s increased efforts around sovereignty are in response to the worries of its customers:

“Sovereignty is more than just data privacy and security. What customers are concerned about is this changing geopolitical landscape, and making sure if things change customers still have access to data.

“What's happening in Ukraine and Russia that kind is now bringing sovereignty to the forefront," added Bhardwaj. "The second one we heard was around jurisdiction controls. This is around foreign nations having access to data using the legal framework. So that came up as another key concern from customers.

“Additionally, customers have embraced cloud. A lot of these regulated workloads are now set in public clouds. So, there's a concern here, either foreign nations can access their data, or if the geopolitical landscape changes they may not have access to data.”

A number of tech firms have made moves to give customers greater control over data transfers, with Oracle building more sovereign cloud regions in the EU in 2023, and Google adding more data transfer controls in the EU. The moves come in part due to anticipation of the EU-US data transfer agreement, the successor to Privacy Shield, which seeks to reconcile data protection approaches across the Atlantic.

VMware and HPE have announced an upgrade to the firms’ existing partnership, in the form of a unified cloud solution combining HPE GreenLake and VMware Cloud solutions.

With HPE GreenLake for VMware, GreenLake customers will gain access to VMware solutions such as its intelligent cloud delivery platform Aria, or its network security platform NSX, which offers granular protection and manages security policies on both public and private clouds.

Announced at VMware Explore Europe, the company’s annual conference in the region, both firms stressed the importance of the deal in the face of growing complexity within the hybrid cloud market. Companies are increasingly seeking to integrate hybrid clouds and multi-cloud solutions, while avoiding the old threat of cloud sprawl.

VMware argued that its unified solution, which can offer customers the services they require through one trusted source, is the answer to these concerns. Customers will be able to use HPE GreenLake for VMware to deploy kubernetes and integrated security on-premises, at the edge, or through colocation.

“Organizations are looking to evolve from a state of cloud chaos where cost and complexity reign, to a more cloud smart approach,” said Raghu Raghuram, chief executive officer at VMware.

“VMware Cloud is the trusted platform for enterprise workloads on private and public clouds that gives customers the flexibility and choice to become cloud smart. VMware and HPE will enable customers to combine VMware’s state-of-the-art multi-cloud software with HPE GreenLake’s cloud operating model and consumption economics to support any workload on a modern hybrid cloud.”

Once implemented, HPE GreenLake will be available on a ‘pay-as-you-go’ consumption model. HPE credits this model with increased insight for customers, with prices tied directly to demand, on a case-by-case basis. Consumption models have been suggested as more flexible alternatives for customers by companies such as Laiye, which recently predicted the end of subscription models within five years.

Facing the climate crisis and economic pressures, companies could benefit from consumption models as they allow spending to be tracked in line with resource usage, which helps to identify areas that can be cut back. It has also been suggested that such a model, combined with universal measurements for carbon impact, could help firms achieve software sustainability and curb energy demand on data centres.

“We’re right in the middle of transitioning our way of licensing from perpetual, into a kind of pay-as-you-go, in a kind of SaaS subscription,” said Luigi Freguia, senior vice president and general manager EMEA at VMware. He identified the economic uncertainty customers facing European customers in particular, with the war in Ukraine and growing economic crisis prompting companies to seek shorter-term solutions.

“It depends on the specific company but it's an additional flexibility that we’re bringing to the table, and we see a positive response. I mean actually we need to cope with the demand and get enough structuring of the offerings to accommodate. So financially, it's working. And as I said before, in terms of a valuable position, they really see the value of our platform because they are, they see the flexibility.”

HPE GreenLake currently provides access to more than 70 cloud services, supporting over 120,000 users and in excess of one exabyte of overall customer data.

In June, HPE GreenLake was expanded to include a new private cloud platform, alongside eight new cloud services. These included GreenLake for Data Fabric, a hybrid cloud managed service that gives insight into productivity, GreenLake for Disaster Recovery to assist firms bounce back from ransomware attacks.

Once upon a time, deleting a file meant it was gone for good. That was the assumption, but, in 1982, Peter Norton released the UNERASE tool, which could be used to magically restore files that had been wiped using the ERASE command in MS-DOS. Subsequently, Microsoft added its own official UNDELETE command to MS-DOS 5.

For careless users, these tools were a godsend, but for businesses that had made the early investment in storing sensitive information on computer disks, the idea of undeleting files was an alarming threat to data security. Since then, the threat has only grown: almost all of us have our own personal information stored somewhere in digital form that we wouldn’t want to fall into the wrong hands, while digital storage is now ubiquitous across businesses and governments.

Indeed, various regulations, such as the Data Protection Act 2018 and GDPR, make companies liable for ensuring certain data is kept secure and confidential, even after a computer is sold, donated or thrown into a skip. Secure deletion is more important than ever.

How does secure deletion work?

Undeleting is possible because “deleting” a file doesn’t actually remove its contents from the disk, it merely marks the space it occupied as available for reuse. Until new data is written into that space, a low-level tool can read the original bits and reconstitute the deleted file.

Deleting something securely, therefore, means overwriting it with fresh data, so the old data can no longer be recovered. If you’re wondering why this isn’t done by default, one reason is that it increases the wear and tear on a disk, shortening its lifespan. Another is that space can be deallocated in a tiny fraction of a second, whereas writing megabytes or gigabytes of data takes far longer, tying up the drive and slowing down performance.What’s more, simply overwriting the bits once might not be good enough. It’ll stop OS-based undelete tools from working, but a forensic analysis could still recover the old data.

To understand how, remember that mechanical drives store data by inducing tiny magnetic fields on the disk platter, with binary values of zero and one represented by opposing polarities. Overwriting a one with a zero means reversing the magnetic polarity on the disk’s surface, while writing a zero on top of a zero means magnetising it twice in the same direction. If a determined scientist were to pull the platter out of the drive and inspect it with a magnetic force microscope, they could measure the precise strength of the different fields to gain a clear hint of what their previous values might have been.

Solid state drives (SSDs) aren’t immune from this type of attack either. Rather than writing magnetic fields to a metal platter, solid-state disks store electric charges inside cells, but the upshot is exactly the same. Writing a zero on top of a zero is likely to leave a subtly different charge signature than writing a one on top of a zero, so with the right equipment it’s possible to work out the previous value of the cell.

The solution is to overwrite the deleted data not just once, but several times, typically using varying bit patterns, so that the original magnetic polarities or charge levels are impossible to separate from the noise.

How many overwrites is enough?

Almost any tool will give you a variety of overwriting patterns to choose from, probably including standards chosen by various national security agencies. It’s far from obvious which one to choose, as they use different numbers of write passes and different bit patterns.

There are also suggestions from tech security experts, including Bruce Schneier and Peter Gutmann. Schneier suggests overwriting deleted data with all ones, then all zeroes, then five passes of random bits. Gutman’s approach goes all the way up to a maximum of 35 passes, with a variety of bit patterns designed for the ways different types of drive store data.

In truth, that’s overkill. As Gutmann himself has explained, “performing the full 35-pass overwrite is pointless… if you're using a drive which uses encoding technology X, you only need to perform the passes specific to X, and you never need to perform all 35 passes.”

Indeed, these standards are almost all excessive for everyday use. While bit-by-bit reconstruction of overwritten data is possible, it requires the sort of specialist equipment and expertise that’s only likely to be found in academic or government organisations. Even professional data recovery specialists won’t normally attempt it.

While it’s understandable that military secrets are protected with maximum paranoia, we’d refer you to the 2014 recommendation of the US National Institute of Standards and Technology. This states that, for wiping both hard disks and SSDs, you merely need to overwrite media using organisationally approved software and perform verification on the overwritten data. The pattern should be at least a single write pass with a fixed data value, such as all zeroes. Multiple write passes or more complex values may be optionally used.

In other words, feel free to write complex bit patterns over and over, but a single pass is good enough to defeat undelete tools, and that’s really all you’re ever likely to need.

Is secure deletion guaranteed to work?

There’s a reason why the National Institute of Standards and Technology (NIST) secure deletion standard specifies that you need to “perform verification”. While it’s not likely, a software bug, a hardware restriction or a misconfiguration could mean your data isn’t really wiped. If you’re worried that something might be recoverable even after you’ve attempted to securely delete it, the best test is to see if you can undelete it yourself.

Another issue could arise if there are bad sectors on your disk. In this case, the drive controller may refuse to overwrite them, meaning that the last chunk of data stored in that area of the disk could still be recoverable. Since bad sectors are a warning sign of a bigger failure on the way, your safest bet is to check your disk health regularly, and if any errors are detected then copy your data onto a new drive and destroy the old one.

A similar challenge can arise with SSDs thanks to wear levelling, which dynamically updates and rotates the drive’s virtual geometry so that write operations are spread across all available cells. This means that no individual cell gets repeatedly flashed and re-flashed while others sit untouched, helping to maximise the lifespan of the drive. However, it also means that if you tell an SSD to overwrite a file, the new data will be written to a fresh set of cells, and those containing the original data won’t be touched at all.

If you want to be certain that the deleted files on an SSD have been purged, the surest way is to fill all available space with junk data. This ensures that every cell gets overwritten – after which you can delete the junk, freeing the space for use once more. The same technique can be used for drives of any type to ensure that nothing remains of forgotten files that might have been erased long ago; most secure deletion tools have the capability to overwrite all space that’s marked as free.

Securely deleting entire disks

We’ve focused on purging deleted files, but sensitive information can linger in other places, such as web caches, the system Registry or the Windows virtual memory file – which can contain information that was never even saved to a file. If you’re passing on a computer to someone else, the safest approach is to destroy or securely wipe the entire drive.

The former approach gives you some dramatic options. You could zap it with a strong electromagnet, melt it in a furnace or feed it into an industrial shredder. It’s probably more convenient, though, to use a tool that can comprehensively wipe the contents and allow you to reformat and use the disk again. There are several free options, and they should all work as well as one another, because they employ the native secure erase function that’s built into all modern hard disks. This ensures that the right procedures are followed to erase all data, on all partitions and in all locations, regardless of the disk’s type and physical format.

Remember that if you want to wipe your Windows system disk, you won’t be able to do it while the OS is running. You’ll need to connect it to a different computer, or create a bootable medium such as a USB flash drive containing a secure deletion tool, and boot from that.

Automation is increasingly becoming part of organisational strategy to modernise and improve workflows. Robotic Process Automation (RPA) can enable businesses to overcome business challenges by tackling repetitive tasks and accessing unstructured data, meaning compliance requirements are also met more effectively.

This report from Forrester Consulting looks at the ROI of adopting RPA, and how this investment has increased efficiencies, allowing staff to be deployed elsewhere, as well as improved compliance reporting and a reduction in fraud.

Download now to learn why RPA initiatives are just as vital as business-focused ones in your organisations' digital transformation strategy.

Provided by

Fujitsu and a Japanese university research institute have published research on the concept of a 'Trustable Internet', which aims to make it easier to verify the authenticity of data on the internet.

The Japan-based tech company teamed up with the Keio Research Institute at Keio University to publish a whitepaper on the Trustable Internet concept. The companies said that the verification of large amounts of information on the Internet remains a difficult task, highlighting the need for a more general-purpose method to prove the authenticity of data.

The pair's proposal would aim to help verify the authenticity of data by adding an interface, which they have dubbed the 'Endorsement Layer', which would theoretically help users confirm the credibility of various data based on additional information related to the generation and processing of data.

This includes information on confirmation and evaluation by third parties that have viewed the data, and information on physical spaces related to the data including from sensors, for example.

“This enables users to judge the credibility of data from a variety of perspectives to ultimately prevent the use of unverified data and the spread, unintentional or otherwise, of false and unverified information ('fake news'),” said the companies in the research.

An example that the companies gave in a video was a person seeing a river swollen by heavy rain and consequently posting on social media that a flood is about to occur.

The companies said the message could be misinterpreted that a flood is about to occur, or has occurred, generating anxiety among the general public as well as triggering social and economic confusion.

If the companies’ technology was applied in this case, it could inform the users reading the message about the source of the data and the process by which it was generated, as well as extra information like the actual water level of the river, collected from sensors, or the fact that no evacuation is needed since no message has been issued from the authorities.

“In this way, a chain of verifiable data is established, reinforcing the certainty of the data,” said the narrator in the video. “The confirmed data is then presented to the viewer in a way that is easy to be understood. Viewers can compare the posted message to the confirmed data and act with common confidence without confusion.”

The two companies suggested the proposed Endorsement Layer should sit between the existing 'Internet Layer' and the 'Web/App' layer. This configuration can be implemented without impacting the existing internet, they said, and allows users to use the internet and applications as usual.

If necessary, they could also obtain additional information to verify the authenticity of data and information.

The additional information can be used to verify the authenticity of data and can be provided by people and devices at the time of data generation, including information on the name, affiliation, and qualifications of the creator of the data, such as the person or company, or the device used, place, and date and time.

Extra information also includes verifications and evaluation from third parties such as independent experts and information obtained from physical spaces including sensor measurements that can be added after the data is generated.

Users would be able to search and check additional information necessary to verify the authenticity of data on the internet in the Endorsement Layer, where information would be stored as graph data.

Through this, the companies hope users would be able to evaluate data authenticity from a different perspective, to make data-driven decisions more accurate, and help to prevent the spread of unverified data.

“By providing a mechanism that enables users to verify and judge the reliability of data available on the internet from various perspectives, we contribute to the health of society and economic activities,” the companies stated. “This is what we are aiming for a trustable internet that people can use information securely.”

The EU’s data protection watchdog has called for rules effectively legalising the 'irresponsible' handing of data by Europol to be scrapped.

scrapping of new rules that effectively legalise the ‘irresponsible’ handling of data by law enforcement agency Europol.

The fresh complaints come months after the European Data Protection Supervisor (EDPS) ordered the law enforcement agency to delete a huge cache of personal information. It deemed this practice to be a violation of GDPR and human rights law.

Following the EDPS’ public allegations of data mishandling, made in January, the Court of Justice of the European Union (CJEU) introduced two new provisions to the 2016 Europol Regulation that aimed to, according to the EDPS, “legalise retroactively” Europol’s data practices.

Articles 74a and 74b of the amended Europol Regulation - the provisions most recently added and the ones contested by the EDPS - “undermine” the watchdog's powers, it said.

“The EDPS had to apply for an annulment of articles 74a and 74b of the amended Europol Regulation for two reasons,” the EDPS said. “Firstly, to protect legal certainty for individuals in the highly sensitive field of law enforcement where the processing of personal data implies severe risks for data subjects.

“Secondly, to make sure that the EU legislator cannot unduly ‘move the goalposts’ in the area of privacy and data protection, where the independent character of the exercise of a supervisory authority’s enforcement powers requires legal certainty of the rules being enforced.”

Added to the Europol Regulation in June 2022, the provisions specifically relate to Europol’s retention of data on individuals with no proven link to criminal activity.

Europol is alleged to be holding on to data belonging to individuals far longer than the current regulations allow it to.

The EDPS’ January complaint revealed that Europol was sitting on 4TB of data on at least 250,000 individuals said to be linked with crime. This was collected over a period of six years from a variety of European national law enforcement authorities.

The EU’s data watchdog aimed to impose rules on Europol that the data it collected on people should be assessed within six months and if no criminal link was found, then it should be erased in a timely manner.

Specifically, the supervising authority sought to enforce Data Subject Categorisation for each individual whose data was collected - a stipulation of the Europol Regulation.

Such categorisation seeks to clearly define why a given individual is having their data retained, be it because they are suspected of committing a crime, convicted of a crime, or suspected witnesses of a crime, among other categories.

Privacy experts speaking to IT Pro in January expressed sympathy for Europol given the large amount of data it is required to triage, but also said the amount of data held would be tantamount to “mass surveillance” in the eyes of some.

The EDPS said the provisions “establish a worrying precedent” that threatens the independence of the supervising authority and undermines the legal certainty for people’s personal data.

The situation raises debate around individuals’ right to privacy against the need for national security - one that emerges in so many areas of technology such as consumers’ access to end-to-encrypted messaging services.

It’s difficult to arrive at an absolute conclusion on such matters given the strength of the cases for both sides. Some argue, such as heads of state, that national security must take precedence over an individual’s privacy.

Others disagree and popular arguments often highlight that such an allowance could theoretically spiral towards a green-lit mass surveillance programme, for example. A large proportion of the IT industry also agrees that ending end-to-end encryption would adversely affect society at large

A joint legal challenge is being brought against London mayor Sadiq Khan, over a new police surveillance network that violates privacy rights.

Bindmans LLP, acting for the Open Rights Group and Sian Berry AM and David Farbey, have sent the mayor a pre-action letter decrying the increase of potentially sensitive traffic camera data passed on to the ​​Metropolitan Police Service (MPS).

In 2014, the MPS was given ‘limited access’ to textual data, accessed through the Transport for London (TfL) automated number-plate recognition (ANPR) system. The campaigners assert that access was expanded in May 2022 to include contextual imagery data from the ANPR cameras, including the colour of vehicles, their make, and images of drivers.

Within the letter, it is noted that TfL raised concerns in their 2020 data protection impact assessment (DPIA) over the wider range of view of newer versions of ANPR cameras.

At the time, it argued that there was a risk that the cameras could unintentionally capture images of individual pedestrians, or sensitive properties such as places of worship, health centres or schools. Under the Data Protection Act 2018 (DPA 2018), information such as an individual’s religious beliefs are considered protected characteristics, which may be processed under a limited range of conditions including if it is in the public interest.

The campaigners take issue with the lack of public consultation taken before the decision was made. They argue that the expansion of the ultra-low emission zone (ULEZ) to include all of Greater London by the end of 2023 will constitute a potentially large increase in the data collected by the MPS.

The legality of the decision has been questioned openly by the campaigners. The Independent Advisory Group (IAG) on ANPR cameras have called the plans a “gargantuan increase of surveillance in London”.

Earlier this year, the human rights group Liberty took legal action against the MPS for its highly controversial database of suspected gang members, known as the Gangs Matrix. This followed a 2018 ruling by the Information Commissioner’s Office (ICO) that the MPS had seriously breached data protection laws with its handling of the system.

The MPS’ website describes its use of ANPR as follows:

“As a vehicle passes an ANPR camera, its registration number is read and instantly checked against database records of vehicles of interest.

Police officers can stop a vehicle, speak to the occupants and, where necessary, make arrests.

ANPR has proved to be important in the detection of many offences, including locating, for example, people wanted for arrest or missing, witnesses, stolen vehicles, uninsured vehicles and uncovering cases of major crime.”

Within the pre-action letter, it is asserted that article 6 of the UK General Data Protection Regulation (GDPR) states that data can be processed in the ‘public interest’ if it is proportionate to the legitimate aim pursued, but that this is not clearly the case with regards to MPS use of ANPR data.

It also puts forward that the 2021 Surveillance Camera Code of Practice states that a surveillance camera system should not be used for purposes other than those used to have justified its establishment and that proposed extensions to system purposes or the information it collects should be subject to consultation prior to a decision being made.

“The aim of this case is to require the Mayor of London to consult with Londoners about the proposed sharing of location records and images from TfL’s ANPR cameras with the Metropolitan Police,” said Salima Budhani, partner in the Public Law & Human Rights team at Bindmans.

“The scheme involves sharing with the police a vast amount of data recording the whereabouts of Londoners going about their daily lives. The Mayor was under a clear duty to provide information and seek views before signing off the scheme.

“Had he done so our clients and others would have had an opportunity to air their concerns about the privacy risks involved which should have been taken into consideration by the Mayor in reaching a decision on this important issue.”

TikTok has announced new initiatives aimed at improving transparency around the company’s data use, measurement of trends and moderation systems.

In a blog post, chief operating officer Vanessa Pappas laid out a series of plans in detail to involve researchers, industry experts and academics to test and advise on TikTok’s platform.

Researchers will be given access to an application programming interface (API) through which they will be able to study public and anonymised data about content on the platform. This will be made available later this year.

The short-form video hosting service and editing app is extremely popular, with an active base of over one billion users. If research led by the data is made publicly available, insight into the trends and data analysis of TikTok’s vast dataset could prove highly valuable to the tech sector.

Businesses could benefit from knowledge of the factors that drive content to do well on the platform, as well as an understanding of how trends grow in popularity to release videos before or during them. Often, by the time businesses engage with a viral trend, much of the user interest in it has waned.

This month, Ofcom published a report stating that TikTok is the second most popular news source for teenagers with 28% using it to inform themselves, just one percent behind Instagram’s 29% of teens.

This marks it as a vital frontier in the battle against disinformation, and the moves announced today will allow greater oversight into this ongoing issue. In the same announcement, the company pledged to publish information on covert influence operations in all further quarterly Community Guidelines Enforcement Reports.

Select researchers will be given a similar API focused on TikTok's moderation system, to probe existing content moderation systems and the current state of content on the platform. The API will also have the functionality to let researchers upload their own content, to see what is permitted, rejected, or passed on to moderators.

In addition, select independent experts will be given access to TikTok’s list of filter keywords, which it uses to identify content as harmful and asked to offer advice based on this.

Those chosen will include members of TikTok’s US Content Advisory Council, which was set up in 2020 to give industry experts a say in the company’s safety strategies and content policies. The expert members of TikTok’s regional Safety Advisory Councils, namely Europe, the Middle East and North Africa, Asia Pacific, Brazil and Latin America will also be included.

“We've been listening to feedback from different communities of researchers, academics, and experts, and are today sharing new initiatives to strengthen transparency and accountability of our platform,” wrote Pappas in the post.

TikTok and its parent company ByteDance have faced harsh criticism in recent months, with FCC commissioner Brendan Carr last month urging Apple and Google to remove TikTok from their respective app stores. This was prompted by growing concerns over the security risk posed by the app's data harvesting.

IT Pro has approached TikTok for comment.

The majority of UK business leaders (81%) expect industry disruption from quantum computing by 2030, according to EY research. That’s a bold claim for a technology that’s yet to have a proven business case. The UK, though, is betting the near future will see the practical application of quantum computing in a wide range of industries.

Last year also saw the establishment of the National Quantum Computing Centre (NQCC). Commenting on EY’s research when it was published, Dr Simon Plant, deputy director for Innovation at the NQCC, said: "Quantum computing is expected to significantly speed up the time to solution for certain tasks, addressing computational problems that are currently intractable using conventional digital technologies. As a result, the pace of development is accelerating, and the question is how and when – not if – quantum computing can address industrially-relevant use cases.”

Sparking quantum disruption

We must first quantify the claim that quantum computing will be disruptive, and define this within the context of business processes. The pharmaceutical, finance and automotive sectors, for instance, are likely to be the first adopters. Moving away from classical computing architectures could revolutionise the development of new drugs, for example, radically cutting the typical ten-year development cycle and slashing the $2 billion average cost of bringing a new drug to market.

Quantum advantage, however, is fast approaching for all businesses, according to managing director of Accenture Technology in the UK and Ireland, Maynard Williams. “The power that this new generation of machines will create will start to make these core challenges achievable, with quantum at the pinnacle of next-generation problem solving. The single biggest watershed moment for computing will be when quantum computers solve the problems that were considered quite literally intractable – making the impossible possible.”

The key to harnessing quantum computers will be to place them into context and use these machines alongside binary computers. Classic computers, indeed, have their own place in the computing landscape in such a way that all enterprises, no matter their size, can take full commercial advantage of the next technological wave.

“I hope the detailed quantum strategy will put a strong focus on industry skills in addition to research and development,” says Richard Hopkins, distinguished engineer and fellow of the Institute of Engineering and Technology from IBM. His company is one of many striving to achieve quantum supremacy alongside the likes of D-Wave and Google. "There's a lot of value the UK could derive by being the first to apply quantum computing to real-world industrial problems, but that will need us to invest in the associated skills.

The business case for quantum

The popularity behind the potential of adopting quantum commuting is vast, as research by Fujitsu and the Tecknowlodgy Group – looking closely at how quantum computing could be applied across a diverse business landscape – found. The study saw 81% of business leaders across sectors including manufacturing, life sciences, retail, transport, and utilities saying optimising business processes can help them to tackle digital transformation challenges. It’ll also allow such businesses to remain competitive in a fast-changing market.

It’s telling that there's been a profound shift in the quantum computing discourse, with the conversation moving from theory to how to apply the technology in practice. Now the worst of COVID-19 has passed, businesses must also be more agile and innovate at speed, which includes establishing how to adopt emerging and once-gimmicky technologies like quantum computing. Business leaders now see this new frontier for computing as a tool in the arsenal towards boosting innovation, including the likes of BASF and Volkswagen, which are already using quantum algorithms within their businesses.

In March this year, HSBC detailed its intention to join the IBM Quantum Accelerator programme, which would give the bank access to the company's 127-qubit processor known as Eagle. “This technology has the potential to transform how we run areas of the bank by addressing challenges which classical computers may never be able to solve alone,” commented HSBC Bank plc and HSBC Europe chief executive officer (CEO), Colin Bell, on the announcement.

Accenture’s Maynard Williams also advises that businesses should begin their strategic planning to shape their quantum future. "The quickest action business leaders can take on the journey to quantum readiness is to begin evaluating how these technologies will shape the operations of their enterprise,” he says. “This will allow them to identify their knowledge and operational gaps, and begin filling them in before it's too late.”

Striving for a quantum advantage

The cost of investment has, until today, positioned quantum computing almost exclusively within the corporate realm. Smaller and medium-sized businesses (SMBs) and startups, however, will also be keen to tap into its potential. Is the quantum door closed to them?

Access to technology has always shaped business cases. What we are seeing in the marketplace right now is the major cloud service providers developing quantum as a service (QaaS) platforms that offer the high level of computing capability to the broadest possible audience. IBM has been offering its quantum computers through the cloud for some time, with the likes of AWS offering a rival Braket quantum cloud service and Microsoft offering Pasqal machines through Azure.

Digital Annealer, produced by Fujitsu, is another quantum-inspired technology architecture designed to help businesses solve complex combinatorial challenges beyond the capabilities of today's computers. Although not an actual deployment of quantum computing, this technology does show the way to the quantum future many businesses can see as part of their development over the next decade.

In some sectors in which there are many smaller businesses – notably financial services and fintech especially – quantum computing is seen as a potential business differentiator, and certainly a technology that could deliver commercial advantages. Despite the progress made in recent years, however, the real-world practical applications of quantum computing won’t arrive until 2030, according to McKinsey. Until then, quantum-inspired algorithms will continue to be developed and deployed in association with high performance computing (HPC) models.

Do all businesses have a quantum future? “Given the difference in the nature of this technology, organisations may wish to ‘phone a friend’ to help them develop their quantum strategy and start their initial investigations,” Deloitte’s Scott Buchholz, national emerging technology research director and CTO for government and public services tells IT Pro. “Done with the right partner, that approach will save time and speed up the learning process.”

Jan Beitner, lead data scientist at Boston Consulting Group, also advises businesses should take practical action today: "Businesses should start by examining their value chain and identifying the use cases most relevant to them. From there, they need to quantify them and, with the support of experts, work out when computers can address them. From that starting point companies can then build a roadmap to prepare for the application and integration of quantum as its potential gets unlocked by advances in the technology.”

As businesses look to re-draw their digital transformation roadmaps in the wake of COVID-19, quantum computing should be a component of that journey. As development continues, we’re not far from a breakthrough that will see quantum computers enter perhaps not the mainstream, per se, but become a transformative technology all businesses can access. The key is having a clear deployment strategy and defined business cases to harness quantum computing's unique properties.

IBM is acquiring the data observability software provider Databand.ai, as the tech giant moves to bolster its data, artificial intelligence (AI) and automation portfolio.

Tel Aviv-based Databand provides a proactive observability platform, which is designed to help organisations fix issues with their data, including errors, pipeline failures and poor quality – all before it starts to affect their bottom line.

In an announcement, IBM said the acquisition – the value of which hasn’t been disclosed – will help it address the full spectrum of observability to help keep businesses moving.

"Our clients are data-driven enterprises who rely on high-quality, trustworthy data to power their mission-critical processes. When they don't have access to the data they need in any given moment, their business can grind to a halt," explained Daniel Hernandez, general manager for data and AI at IBM.

To tackle this, data observability uses historical trends to compute statistics about data workloads and pipelines directly at the source. This then determines if they are working and helps pinpoint where any problems reside.

Available either in a software as a service (SaaS) format or as a self-hosted software subscription, Databand’s extendable approach will allow data engineering teams to easily integrate and gain observability into their infrastructure, IBM said.

"With the addition of Databand.ai, IBM offers the most comprehensive set of observability capabilities for IT across applications, data and machine learning, and is continuing to provide our clients and partners with the technology they need to deliver trustworthy data and AI at scale," Hernandez added.

“Joining IBM will help us scale our software and significantly accelerate our ability to meet the evolving needs of enterprise clients," commented Josh Benamram, co-founder and CEO of Databand.ai.

The Databand addition marks IBM’s fifth acquisition of 2022, as it continues to strengthen its range of hybrid cloud and AI capabilities. With data observability, the company said it has identified a market it expects will continue to grow rapidly as data teams look to better understand the health of data in their systems and troubleshoot issues in real time.

For Databand, the acquisition will expand its resources and capabilities, enabling broader integrations across more of the modern data stack.

Datadog has launched a new service to help organizations aggregate, filter, and route ‌large volumes‌ ‌of observability data.

Dubbed Observability Pipelines, the vendor-agnostic tool offers customers with a unified view of infrastructure and application metrics, logs, and traces.

The granular outlook helps with lowering costs, reducing technology lock-in, standardizing data quality, improving compliance, and scaling observability practices, according to Datadog.

Most notably, businesses can gather, enrich, transform, sanitize, and route observability data from any source to any destination at petabyte scale. Rule-based throttles and reactive routing strategies ‌can also be deployed to protect against data spikes.

If need be, organizations can also choose to redact sensitive data from a data stream ‌before‌ ‌it‌ ‌leaves‌ ‌the company‌ ‌network.

"As the amount of telemetry continues to grow at an organization, teams are often completely overwhelmed—if they're not blind to—the runaway costs, reliability and compliance risks that come from a lack of visibility into infrastructure and application data," said Zach Sherman, senior product manager at Datadog.

“We built Datadog Observability Pipelines to give organizations a powerful way to take back control of their data, without compromising visibility for engineering, security and SRE teams," added Sherman.

Datadog’s Observability Pipelines also comes with an extensive list of integrations or built-in connectors that give organizations the ability to collect and route data quickly and easily to any existing tools.

With the wide-ranging capabilities that Netsuite offers, Netsuite integration projects can involve many applications. This guide can support you in simplifying this process with a checklist of things to consider in your planning.

From the people involved, to the data flow processes, the applications, and the data, this guide takes into account how to identify each stage, what you need to determine - including specifications and recommended methods - as well as common issues.

Download this checklist now to ensure your Netsuite integration is straightforward, and gives you a competitive advantage.

Provided by

This asset shares advice and tips on the technical requirements you might need, as well as key considerations for your Salesforce integration project.

From the people involved, to the data flow processes, and the applications, this guide takes into account how to identify each stage, what you need to determine, as well as common issues and customisation considerations.

Download this checklist now to future proof your Salesforce integration.

Provided by

Solid-state drives (SSDs) are recommended as a more energy-efficient alternative to hard-disk drives (HDDs) in data centres, using 70% less power and 50% less space for the same capacity.

This is part of Huawei’s strategy to help data centres go green through data storage. The strategy reduces energy consumption per TB of data through high-density design, system convergence, data reduction, and full-lifecycle carbon footprint management.

This is especially important as by 2030, 1 yottabyte (YB) of data will be generated globally every year, representing a 23-fold increase over 2020, Huawei revealed at an event last week. Storing mass data consumes enormous amounts of energy, highlighting the importance of green and sustainable development.

As part of this strategy, Huawei looks to use high-density components and systems to increase the hardware density and heat dissipation efficiency of its data storage products, including replacing HDDs with SSDs. Its use of half-palm NVMe SSDs helps its storage systems to support 36 SSDs in a 2U disk enclosure, which it says delivers a higher hardware density than similar products and 25% higher heat dissipation efficiency than a traditional disk enclosure.

The company also hopes to ensure higher resource utilisation by supporting multiple protocols and eliminating storage silos. One storage system supports block, file, object, and Hadoop Distributed File System (HDFS) protocols for diversified requirements to consolidate multiple kinds of storage. Additionally, the converged resource pool aims to consolidate multiple storage systems in data centres to improve their resource utilisation.

Huawei also aims to use deduplication and compression algorithms to reduce data duplication. The algorithms currently help its storage systems deliver a data reduction ratio of up to 72:1, 20% higher than the industry benchmark.

"Huawei has always been committed to the green and low-carbon data storage strategy, providing customers with more environment-friendly products for sustainable development,” said Assaf Natanzon, Huawei's chief architect of Data Storage.

Initiatives into green data centre technology have become more popular recently, with Japan choosing six companies in February to help power new research into this area. The project aims to address the challenge of increasing power consumption at data centres in today’s digital society. The companies taking part aim to develop products to realise greater energy efficiency, larger capacity, and lower latency across data centre sites.

While there is a broad understanding that successful organisations need to be data-driven, what does that mean in practice and how can your business achieve this?

This whitepaper lays out the key steps a company needs to take to become a truly data-driven institution that bases strategic business decisions on concrete evidence, and how agility, digital transformation and continuous innovation tie into this project.

Download now to learn how other companies are making the best use of their data and what that can teach your organisation.

Provided by

Ever since the 2020 coronavirus pandemic struck, it has become increasingly obvious that for companies to thrive, they must be able to make quick decisions based on high-quality data.

MIT Technology Review Insights surveyed 357 senior business leaders and academics in June and July 2021 to explore how organisations are using data to drive business value, specifically during turbulent times.

Read the report, sponsored by Amazon Web Services to learn more about:

• Challenges of data strategy at scale
• Data strategy priorities
• Successful data strategies

Provided by  AWS

Let me tell you a story: You’re having a new friend round for lunch. You designed a recipe for a “Meaty Platter”, which combines a range of meats, to create the perfect meaty experience. Over the last week, you have purchased the finest ingredients for each component of the platter. That morning you blend it all together and make it look amazing. Your friend presses the doorbell and enters your home. She takes one look at your beautiful platter and declines to eat it; she doesn’t understand what it’s made from, and she doesn’t want to eat meat. Meaty Platter goes in the bin, and your friend doesn’t return, or, alternatively, maybe she takes a taste and then suffers a severe stomach ache later that day, and your friendship is lost.

So, how do you host a lunch without alienating or damaging your friends? Before designing your recipe, you consider whether aspects of your menu may use ingredients unsuitable for some guests. You could also ask your guests if they have any dietary concerns. Any issues can then be addressed within your recipe and the ingredients that form part of it. You can prepare a tailored platter with all dietary needs baked into it. You can let guests know what it is, so they can make an informed decision about whether to eat it. In my story, you could then present your friend with a meal she understands and wants to eat. Meaty Platter (perhaps now Veggie Platter) hopefully won’t be thrown in the bin. If your friend takes a taste, she’s less likely to suffer a stomach ache, and you’re more likely to retain your friendship.

You may not be able to eliminate every risk. You’re unlikely to have considered all potential eventualities or have discussed with every guest the full detail of your menu. A guest may have an unforeseen dislike of a particular ingredient, or a previously unknown allergy. But, by considering the risks in advance, and without taking unnecessary steps to guarantee a fault-free meal, you have minimised the risk that a dietary issue leads to your food not being eaten, or causes damage to your guests.

The story re-told

Let me tell you another story: You’re launching a new technology product. You designed a recipe for “Meeting Platform”, which combines a range of information about customers’ online habits, to create the perfect meeting experience. Over the past year, you’ve engaged the finest coders for each component of the platform. That month, you have been blending it all together and making it look good. You press the launch button (there’s always a big launch button, right?), and your customers enter your platform. They take one look at your beautiful product and decline to use it; they don’t understand what you do with the requested data, and they don’t want to provide it. Meeting Platform is shelved, and your customers don’t return, or, alternatively, maybe some customers take a taste, and then you suffer a severe security breach later that week, and customer data is lost.

So, how do you launch a product without alienating or damaging your customers? Before designing your platform, you consider whether aspects of your product may use personal data. You could also ask potential customers if they have any concerns with the use of their data. Any issues can then be addressed within your platform, and the components that form part of it. You can prepare a tailored platform with data protection baked into it. You can let customers know what you’ll do with their data, so they can make an informed decision about whether to use it. In my story, you could then present customers with a product they understand and want to use. Meeting Platform hopefully won’t be shelved. If your customers take a taste, you’re less likely to suffer a security breach, and you are more likely to retain your customers.

You may not be able to eliminate every risk. You’re unlikely to have considered all potential eventualities, or to have discussed with every customer the full detail of the platform’s use of personal data. A customer may have an unforeseen dislike to a particular use of data, or the system may have a previously unknown vulnerability. But, by considering the risks in advance, and without taking disproportionate steps to guarantee a fault-free product, you have minimised the risk that a data protection issue leads to your product not being used, or causes damage to your customers.

Data protection by design

Data protection by design is just this! It’s about baking data protection compliance into the design and development of new activities involving the use of personal data. All data protection requirements should be addressed, including the core principles (such as transparency, data minimisation and security), and enabling individuals to exercise their rights (such as the right to access and erase data).

Data protection by design is a legal requirement under UK GDPR, along with the closely related concept of data protection by default. This demands that the default position for any activity is to collect the minimum amount of data and do the minimum amount of processing. The obligations are ongoing throughout the lifecycle of the use of data.

Without data protection by design, data protection may only be an afterthought for a project (by which time it may be too late to address issues), or it may be ignored completely. This may lead to the project being shelved for data protection reasons. As a topical example, the NHS COVID-19 app faced several data-protection hurdles. Privacy concerns were key to the UK government scrapping the original 2020 centralised model, and, in 2021, it was reported that an update to the app had been blocked by Apple and Google due to the prohibited collection of location data.

Even if a project isn’t cancelled, it could cause significant costs and delays to rework it to address data protection issues. In May 2019, the Information Commissioner’s Office (ICO) issued an enforcement notice against HMRC in relation to its Voice ID service, requiring it to delete data. The ICO found HMRC was processing biometric data (for voice authentication) without a lawful basis under data protection law, as it had failed to obtain adequate consent. In its notice, the ICO stated: “HMRC appears to have given little or no consideration to the data protection principles when rolling out the Voice ID service.” In other words, it didn’t apply data protection by design.

When is it needed?

Data protection by design most obviously springs to mind for big projects, such as new technology systems that will process personal data. Its remit, however, is much wider than this. It applies to all activities involving personal data (big or small), and to the preparation of policies and processes that govern the use of data. You may not need to carry out the same level of review in each case, though. As raised in my stories, the approach you take and the extent of measures you put in place should be proportionate to the risks involved.

Consider, for example, a business’s use of customer contact details to keep customers updated about requested services. Design measures may include ensuring customer details aren’t used for a wider purpose, and are kept up to date and secure from misuse. However, the assessment may be fairly quick, and the measures fairly standard. Compare this with more innovative or intrusive uses of data, such as those involving artificial intelligence, sensitive data, or monitoring and profiling of individuals. A more complex assessment and more bespoke design measures are likely to be needed. For these types of higher-risk activities, a formal data protection impact assessment (DPIA) may be needed, and it forms an important part of data protection by design. Asking those who will be impacted for their views, is also a stage of the DPIA process.

In my experience, higher-risk projects are commonly now given some quality data-protection time, although I still come across some clangers. Just the other day, a company sent its employees a request to provide their COVID-19 vaccination details, together with proof of vaccination (with type of vaccine and dates), or the reason why they were unvaccinated. The request had no explanation as to what would be done with this information. My head started firing out data protection principles: There was no transparency or specified purpose! What was the lawful basis? How about data minimisation?

At the lower-risk end of the spectrum, I find there is a tendency to focus on specific aspects of compliance (such as having a privacy notice, and checking security measures), without looking at the full range of data protection design elements. As an example, one of my clients recently launched a new website, and included a form for people to sign up to receive a newsletter. However, there was no newsletter – this request was “just in case” the company decided to create one in the future. Data protection by default, and the principle of data minimisation, would say don’t collect this information yet, as it’s not needed right now.

Privacy-enhancing technologies

The organisations actually collecting and handling personal data have legal responsibilities under data protection law. However, product developers have a role in designing systems with data protection embedded, which can also be a selling point for them. This is the aim of ‘privacy-enhancing technologies’, meaning technologies that are designed for supporting specific privacy or data protection functionality, or protecting against privacy risks. They’re currently a hot topic in the data protection world.

I have excitedly been trying to understand mathematical concepts such as differential privacy (adding ‘noise’ to statistics to make it more difficult to identify source data), and homomorphic encryption (which enables functions to be carried out on specific data without decrypting whole data sets). Anonymisation and pseudonymisation functionality can also be built into technology design. These types of privacy-enhancing measures may most obviously assist with information security, but they have wider data protection benefits. They may, for example, limit retention periods by ensuring individuals can no longer be identified from data sets, ensure that only the minimum amount of personal data is held within a system, and facilitate the exercise of rights by data subjects.

So next time you’re designing your recipe for new technology or data processing activities – or even a meaty platter – don’t forget to bake in your data protection (or dietary) requirements.

Google Cloud has introduced a preview of BigLake today, a data lake storage engine, it said would remove data limits by unifying data lakes and warehouses.

The tech giant said that managing data across disparate lakes and warehouses create silos and increases risk and cost, especially when data needs to be moved. Through BigLake, it hopes to allow companies to unify their data warehouses and lakes to analyse data without worrying about the underlying storage format or system. This, it said, eliminates the need to duplicate or move data from a source and reduces cost and inefficiencies.

Google Cloud customers will gain access controls through BigLake, with an API interface spanning Google Cloud and open file formats like Parquet, as well as open-source processing engines like Apache Spark. The company said these capabilities extend a decade’s worth of innovations with BigQuery to data lakes on Google Cloud Storage to enable a flexible and cost-effective open lake house architecture.

BigLake is set to be the centre of the company’s overall strategy from a storage perspective, revealed Sudhir Hasbe, Google Cloud’s data analytics product manager.

“We are going to make sure all of our tools and capabilities work seamlessly with BigLake,” he said. “Similarly, all of our analytics engines, whether it's BigQuery, whether it's our Spark engine, or whether it's our data flow engine, all of these engines will seamlessly integrate out of the box with BigLake.”

The company also announced the formation of the Data Cloud Alliance, a new initiative to ensure global businesses have more seamless access and insights into the data required for digital transformation.

The alliance comprises Google Cloud, Accenture, Confluent, Databricks, Dataiku, Deloitte, Elastic, Fivetran, MongoDB, Neo4j, Redis, and Starburst. The companies said they are committed to making data more portable and accessible across disparate business systems, platforms, and environments.

Google Cloud said that the proliferation of data means businesses increasingly need common digital data standards and a commitment to open data, to effectively use data to digitally transform.

The Data Cloud Alliance is committed to accelerating the adoption of data analytics, artificial intelligence, and machine learning best practices across industries through common industry data models, open standards, and integrated processes.

The alliance’s members will work together to help reduce customer challenges and complexity with data governance, data privacy, data loss prevention, and global compliance. They will provide infrastructure, APIs, and integration support to ensure data portability and accessibility between multiple platforms and products across multiple environments.

Each alliance member is also set to collaborate on new, common industry data models, processes, and platform integrations to increase data portability and reduce the complexity associated with data governance and global compliance.

HPE’s Spaceborne Computer-2 (SBC-2) has successfully completed 24 research experiments on the International Space Station (ISS). The company claims this has accelerated time-to-insight from months and days to minutes.

The SBC-2 is the first in-space commercial edge computing and AI-enabled system to run on the ISS, according to HPE, and was installed in May 2021. The experiments involved real-time data processing and testing of new applications to prove reliability in space to increase autonomy for astronauts. The experiments were focused on healthcare, image processing, natural disaster recovery, 3D printing, 5G, and AI.

SBC-2 consists of HPE’s edge computing hardware, including the HPE Edgeline Converged EL4000 Edge system, which is designed to perform in harsher edge environments, such as space. It’s also made up of the HPE ProLiant DL360 server, a server for additional high-performing capabilities to target a range of workloads, including edge, HPC and AI.

The supercomputer is part of a mission to advance computing and reduce dependence on communications as humans travel further into space to the moon, Mars, and beyond. It aims to demonstrate ways astronauts can increase self-sufficiency when processing data directly on the space station, bypassing longer latency and wait times that occur when relying on sending raw data to Earth to be processed and analysed, and sent back to space.

For example, HPE outlined that previously, 1.8 GB of raw DNA sequence data took an average time of 12.2 hours just to download to Earth for initial processing. With SBC-2, researchers on the ISS could process the same data in just six minutes to gather meaningful insights, compress it to 92 KB, and send it to Earth in just two seconds, representing a 20,000X speed-up.

“By introducing edge computing and AI capabilities to the International Space Station with Spaceborne Computer-2, we have helped foster a growing, collaborative research community that shares a common goal to make scientific and engineering breakthroughs that benefit humankind, on space and here on Earth,” said Mark Fernandez, principal investigator of Spaceborne Computer-2 at HPE. “We are proud of this ongoing work, which has already resulted in 24 completed experiments, from various organisations, demonstrating new possibilities for space exploration and milestones for humanity.”

What experiments have the Spaceborne Computer-2 been involved in?

The SBC-2 has run experiments for researchers developing capabilities for space exploration, like Axiom Space, Cornell University, Cumucore, Microsoft, NASA, and Titan Space Technologies.

Using AI-enabled damage detection in astronaut gloves

Astronauts on the ISS are often on spacewalks where they repair equipment, install new instruments and upgrade features and functions on the space station. They wear essential gloves that can experience natural erosion, along with even rips and cuts, that can present potential safety concerns.

In an experiment led by NASA, HPE and Microsoft, photos and recorded video taken in space of recently worn gloves by astronauts were processed using SBC-2’s AI capabilities. The glove analyzer model was then used to rapidly look for signs of damage on-orbit, in space. If damage is detected, an AI-annotated photo is generated in space and immediately sent to Earth, highlighting areas for further review by NASA engineers.

Automatic interpretation of satellite imagery after a disaster

NASA Jet Propulsion Laboratory (JPL) observes Earth from space to study science and climate, as well as support disaster response. Using Spaceborne Computer-2 along with embedded processors, NASA JPL tested several deep learning inference networks to automatically interpret remote sensed images from land and structures after a disaster.

Two of these techniques use radar data to determine flood extent, such as from a hurricane, and to determine urban building damage, such as from an earthquake. HPE said these techniques could be used onboard future spacecraft to rapidly deliver actionable products to relevant authorities to assist in disaster recovery.

3D printing in space through validated software

As humans look to future deep space travel, ordering supplies to repair or build new equipment from Earth will not be timely and practical, explained HPE. To increase self-sufficiency by enabling additive manufacturing for humans travelling beyond low Earth orbit (LEO), Cornell Fracture Group, part of Cornell University, developed a modelling software that can simulate 3D printing of metal parts and even predict failure and deformation that may result when printing in space. HPE said the software was successfully tested on SBC-2, showing that it can be used in space to digitally simulate a part and understand how it will perform in reality.

Expanding network capability on the ISS with a 5G core prototype

Cumucore, a private mobile network, tested its 5G core network, along with RAN emulators and other features, on SBC-2, to emulate current capabilities on the base station and end-user devices. HPE underlined that the experiment showed the potential to install state-of-the-art 5G capabilities on selected satellites and spacecraft to access a new level of communications in space.

Developing software codes to calculate fuel requirements based on space travel distance

HPE opened up SBC-2 to students in India involved in Codewars, an educational community and competition for computer programming. The projects largely focused on developing code using C++, Python and Fortran, with one involving C++ Pythagoras theorem code to calculate how much fuel is needed for a given space travel distance to directly travel to without requiring refuelling.

Microsoft has announced the acquisition of Mint, a process automation company, for an undisclosed fee.

The acquisition is aimed at supporting digital transformation strategies with automated insights from operational data.

Mint was originally set up in Slovakia but is now headquartered in Amsterdam, with sub-offices in New York and London. The firm develops and sells process automation technology, which is used for data analytics. Its systems monitor and measure 'event' data to give a business a detailed overview of how certain parts of its operations perform. This can be used for machinery, software, or even its people.

It's considered a lucrative market, likely to be worth over $11 billion by 2030, according to estimates from Polaris Market Research. It's also an area that Microsoft has previously invested in, with acquisitions of robotic process automation startup Softmotion back in 2020.

With Mint, the plan is to "further empower" customers in their digital transformation journeys by providing a more complete picture of their processes, according to Microsoft.

"Our customers will be able to better understand their process data, uncover what operations look like in reality, and drive process standardisation and improvement across the entire organisation to ensure compliance at every step," Justin Graham, Microsoft's general manager of process insights, wrote in a post.

For Mint and its own customers, however, there isn't much detail about what comes next. CEO James Dening has said that the level of support and engagement it offers its users "will stay the same". He also quoted co-founder Rasto Hlavac who said that the Microsoft acquisition would result in positive outcomes on "a different scale", in a post on the company's website.

Denning then signed off the message with "there's nothing I can add to that".

Telefónica Tech has announced the acquisition of UK-based Microsoft partner Incremental for up to £175 million, including potential contingent payments linked to future performance.

The move strengthens Telefónica Tech’s presence in the UK and Ireland, as well as its scale and competencies in Microsoft technologies, the firm said.

Launched in 2016, Incremental Group has become one of the leading Microsoft Dynamics Partners in the UK and is also a major player in the data and analytics market.

The company has been a Microsoft Business Applications Inner Circle member for the past three years and is one of just two partners in EMEA on the Redmond giant’s Global Advisory Board for data analytics.

The acquisition means Telefónica Tech now becomes one of Microsoft’s largest partners in the UK, with 16 Gold Competencies and 5 Advanced Specialisations.

Telefónica said the addition of Incremental’s business applications, power apps, data analytics and management capabilities to its cloud services portfolio will enable it to enhance its end-to-end cloud offering for mid-market, large enterprise, and government customers.

“We warmly welcome Incremental Group, and are delighted that this acquisition enables us to strengthen our position as a leader in the UK market for IT services,” commented José Cerdán, CEO of Telefónica Tech.

“We are now able to provide end-to-end Microsoft services, including digital transformation, managed services and data analytics, and achieve attractive cross-selling synergies with Telefónica Tech UK&I, complementing and positioning us as a leading Microsoft-focused company in the UK.”

Glasgow-headquartered Incremental has experienced significant organic and inorganic growth in recent years. Early last year, the firm acquired Redspire in a bid to expand its capabilities in the financial services market and become one of the UK’s largest Microsoft Dynamics partners.

It then snapped up data analytics company Adatis, which enabled the business to offer end-to-end digital transformation to customers.

Today, Incremental has more than 350 employees on its books, which will take Telefónica Tech UK&I’s headcount to around 1,000 staff post-transaction.

Neil Logan, CEO at Incremental Group, said the focus was on securing the “right support for the long term” as the business looked to the next stage of its development.

“Becoming part of Telefonica Tech propels us into the next phase of our journey and enables us to further scale the business, creating exciting opportunities for our people and our customers,” he said.

Human rights group Liberty is taking legal action against the Metropolitan Police over its controversial Gangs Matrix, a secretive database of suspected gang members established as part of the response to the 2011 London riots.

Liberty is challenging the lawfulness of the database, arguing that it discriminates against people of colour and breaches human rights, data protection requirements, and public law principles.

The human rights group is acting on behalf of musician and writer Awate Suleiman and Unjust UK, a community interest NGO that challenges unjust and discriminatory policing. Suleiman has been subjected to over-policing since he was a child and has tried to establish since 2019 whether he was on the Matrix, said Liberty.

Of those on the Matrix, 86.5% are Black, Asian, or other minority ethnic, and 79% are Black. Liberty said this was a stark figure, considering that only 27% of those convicted of offences related to serious youth violence are Black. It added the majority of the people on the Matrix, 65%, are considered by the police to be ‘low-risk’.

Despite this, those on the Matrix may be subject to a wide range of ‘enforcement actions’, including exclusion from benefits, housing, and education, as well as increased stop and search, said Liberty. Information on the Matrix is also shared with other bodies like immigration enforcement.

However, the Met Police doesn’t inform people if they are on the Matrix, and there’s no mechanism by which a person can appeal against their inclusion, or ask for the data held about them to be reviewed.

Liberty said this makes it hard for people on the Matrix to challenge their inclusion on it or the accuracy of the data held about them.

“Secret databases that risk young Black men being excluded from society based on racist assumptions are not a solution to serious violence, they are part of the problem,” said Lana Adamou, a lawyer at Liberty. “The Matrix damages communities through division and alienation. We should be demanding better, evidence-based solutions that tackle underlying causes.”

In a letter to the Met Police, Liberty warned that the Matrix discriminates against BAME people, particularly Black people, who are disproportionately represented in the database. It also breaches the right to private and family life, with sensitive personal data about those on the database shared broadly.

Lastly, the group said it breaches the Public Sector Equality Duty for public authorities to eliminate discrimination, harassment and victimisation, and advance equality of opportunity.

“The fact that I had to threaten the police with judicial review before they would confirm whether I was on the GVM is not good enough and another indication of the Met’s intention to covertly surveil young, black people,” said Suleiman. “These practices were normal in colonial times when British officers kept meticulous records of the people they terrorised and abused, but are antithetical to the kind of society we’re meant to live in today."

IT Pro has contacted the Met Police for comment.

In November 2018, the ICO found that the Met Police had seriously breached data protection laws in its conduct when sharing information with public bodies, such as local councils and housing associations. The 27-page report found that the Gangs Matrix didn’t distinguish individuals between offenders and victims.

It also contained informal lists of people who no longer meet the criteria to be placed on the list. The report determined the Matrix was too vague when it came to its reasoning behind sharing data with public bodies and determined that a review was needed around how the information it held was shared. It added that the public bodies receiving the information weren’t always aware of how to interpret the data correctly either.

The Ministry of Defence (MoD) formally reported seven data incidents to the Information Commissioner’s Office (ICO) between 2020 and 2021, the department's Annual Report and Accounts have revealed.

The most serious case involved an email account associated with MoD Schools - the institutions in place to provide education to the children of service personnel, mainly overseas - being compromised for a 72-hour period. During this time, details of students and parents were disclosed and affected 4,142 people. The ICO provided guidance in response and determined no further action was necessary, it told IT Pro.

A total of 4,331 individuals were affected by the combined seven incidents, the vast majority of which were those involved in the MoD School-related incident.

In another case, one individual emailed personal data, including identities and home addresses of MoD personnel, to external organisations and international media outlets, affecting a total of 147 individuals. The case was already being investigated by the Military Police and the ICO did not intervene.

A number of social media-based incidents also occurred involving one incident in which images from an incident logbook were posted to social media. The images were of an individual’s injuries, how they were sustained, and details of the affected individual.

Another individual also posted MoD documents to a closed social media group. These documents contained details of cadets and adult volunteers, affecting 30 people.

A separate incident saw an unredacted copy of criminal allegations incorrectly passed to the accused in administrative action. Affecting five people, the copy of allegations included the identity of the victim and details of the associated witness statements. ICO enquiries are ongoing, it told IT Pro.

The final incident involved one person’s name and location details mistakenly published to the House of Commons website as a result of submitting a question to their MP.

The ICO said it was made aware of all seven cases and in most instances, it simply provided the MoD with guidance without further investigation necessary.

"We take the security of MOD personnel, systems and establishments very seriously," said an MoD spokesperson to IT Pro. "As soon as these incidents were reported, their severity was assessed and passed to the Information Commissioner’s Office in line with our obligations under the law.

"The Information Commissioner’s Office has not raised any concerns about MOD’s handling of these incidents."

Commenting on the news, Donal Blaney, founder of Griffin Law, said: “Our courageous soldiers, sailors and air force personnel are willing to sacrifice their lives – often working under cover and in extreme conditions – so we can live in safety and freedom.

“The least the Ministry of Defence could do is keep these brave heroes’ personal data safe and secure. Instead, their identities, and potentially the safety of their families and friends, have been put at risk by superannuated MoD pen pushers who are not fit to lick their boots. The Information Commissioner needs to investigate these breaches and bring those responsible to justice.”

The MoD’s data controller specified an additional 552 incidents that occurred within the department but didn’t meet the criteria for reporting to the ICO, representing a slight increase in cases from the 546 reported in 2019-20.

Most recent incidents included cases of inadequately protected electronic equipment or paper documents from in and outside government premises being lost, insecure disposal of inadequately protected paper documents, and other cases of unauthorised disclosure of data.

Details of a ‘record number’ of security breaches at the Ministry of Defence was revealed earlier in 2021 after a number of heavily redacted documents were handed to Sky News.

The information gleaned from the redacted documents did not match up with the aforementioned incidents as reported in the latest Annual Report and Accounts from the MoD but did reveal secret information belonging to the department was exposed to hostile states.

Other incidents involved data sent to an unauthorised domain, potential compromises to MoD-owned systems, misconfigured infrastructure and more.

Speaking at the time, an MoD spokesperson said: “The MoD takes the security of its personnel, systems and establishments very seriously and continually seek to improve security incident reporting.

“We have recently introduced policy, processes and tools to make internal and external reporting easier and more efficient, and the increase in reports can be largely attributed to these improvements.”

In September 2021, an MoD data breach within the Afghan Relocations and Assistance Policy team also saw the lives of Afghan interpreters put at risk after the Taliban seized control of the country a month earlier.

Many of the individuals affected were hiding at the time, but their names emails and, in some cases, pictures were included in an email sent without concealing the full recipient lists' identities. Around 250 people were thought to be affected by the incident.

Google has expanded its open-source differential privacy (DP) platform to support the Python programming language, widening availability to millions more developers and data analysts.

The announcement makes Python the fourth language supported by the project after initially launching in 2019 with support for C++, Java, and Google-created language Go, sometimes referred to as Golang.

It comes after Google reported a significant number of developers contacting the company expressing their interest in using the open-source library for their Python projects. Google worked for more than a year with OpenMined on Python support and said numerous projects have already used its DP library, including Australian developers who have accelerated scientific discoveries through analysing medical data in a private way.

DP is a system used by data analysts to preserve the privacy of the individuals whose data is used in an analysed data set. Work to develop strong DP dates back decades, but only in recent years have tech giants such as Google and Apple embraced the system.

One of the key areas of DP development for Google in the past year has been on providing a tool for developers within the library to fine-tune the 'epsilon' - a mathematical measure of privacy. Finding the optimum epsilon requires a great deal of trial and error to perfect and having a tool within the library that allows developers to make adjustments to yield a lower epsilon, which indicates a more private release, means individual projects are able to be tuned as privately as possible.

Google said now Python is supported, the DP library is now available to nearly half of all developers worldwide which means more developers and researchers will be able to analyse data and make new discoveries while preserving the privacy of users to whom the data belongs.

Python is among the most popular programming languages currently in use and won 'Language of the Year 2021' from the TIOBE index, which ranks programming languages based on their popularity. Python is useful for a wide range of programming activities but is especially well-known for its capabilities in data analysis, making it a natural progression for Google's DP library.

As part of the launch, Google has released a new web-based product, pipleinedp.io, which allows any Python developer to analyse their dataset with differential privacy. Google also said it has seen organisations experimenting with new use cases such as showing a website's most visited web pages by country, in an anonymised fashion.

The library is compatible with leading large data processing engines, the Spark and Beam frameworks, and Google will be launching an additional tool to help users "visualise and better tune the parameters used to produce differentially private information".

"We encourage developers around the world to take this opportunity to experiment with differential privacy use cases like statistical analysis and machine learning, but most importantly, provide us with feedback," said Google announcing the news. "We are excited to learn more about the applications you all can develop and the features we can provide to help along the way.

"We will continue investing in democratising access to critical privacy-enhancing technologies and hope developers join us in this journey to improve usability and coverage. As we’ve said before, we believe that every Internet user in the world deserves world-class privacy, and we’ll continue partnering with organisations to further that goal."

What is differential privacy?

Differential privacy is a tool that has gained acclaim in recent years as data and identity protection have become focal points for researchers, businesses, and regulators alike.

Some argue it is fundamentally necessary in data analytics to preserve the privacy and hide the identity of people whose data is being analysed. For technology companies especially, it has been at the forefront of how their users expect them to handle the data they hold on others.

DP works by adding 'controlled noise' to datasets so that people cannot be individually identified by the data they provide to the dataset. For example, if residents of a neighbourhood supplied data for analysis involving their salaries which were then represented as an average, and one resident left the neighbourhood, their salary information could be tied to their identity by looking at the difference in the data pre- and post-move.

Similarly, if two databases were analysed, one with a single data point on 50 people and one with a single data point on 51 people, the analysis results for both would have to be indistinguishable from each other to avoid identifying that 51st person, in order to qualify as differentially private.

Adding controlled noise to a dataset would remove the possibility of identifying an individual by skewing the statistics just enough to remove the element of identification, without significantly compromising the accuracy of the results.

All major Big Tech firms have embraced DP in different ways. Microsoft's AI Lab works with Harvard University on projects to facilitate DP-enabled research. Apple has used DP on its products since macOS Sierra and iOS 10, and Facebook and Amazon also have experience working with the system too.

The UK's Ministry of Justice (MoJ) has been served an enforcement notice by the Information Commissioner's Office (ICO) for failing to address and respond to a growing backlog of Subject Access Requests (SARs).

The MoJ is said to have contravened Chapter 3, Article 15 of the EU and UK GDPR, and section 45 of the Data Protection Act 2018, and has now been ordered to develop a recovery plan that includes details of how to remedy the outstanding SARs, and "take appropriate steps" to ensure future SAR submissions are timely notified of any delays to a response.

The ICO said it issued the enforcement notice after considering, and agreeing, that "damage or distress is likely" as a result of the delay in SAR processing, which meant subjects were "being denied the opportunity of properly understanding what personal data may be being processed about them by the controller". Data subjects were also deemed to have been unable to exercise their statutory rights in respect to their data.

At its peak, it's believed the subject access request backlog had grown as high as 7,753.

The ICO acknowledged the difficulties faced by the MoJ, especially as pandemic restrictions limited affected its ability to process SARs. However, the "substantial number" of SARs that are out of time for compliance was "a cause of significant concern for the Commissioner," the ICO said in the enforcement notice.

It also added that "previous meetings and correspondence between the controller and commissioner have proven largely ineffective in reducing the number of outstanding SARs".

Failure to meet the demands of the enforcement notice will result in a fine of £17.5 million or 4% of its annual global turnover, whichever is higher. The MoJ has 28 days to appeal the notice.

"We take our responsibilities seriously and have set out an action plan to clear the backlog," an MoJ spokesperson told IT Pro."

"The MoJ devotes significant resources to meeting these legal obligations, and we have hired extra staff to assist in clearing outstanding requests," they added. "The pandemic has had an unprecedented impact on our work, but we responded quickly and adapted ways of working to continue to provide a level of service to requestors.

"We have engaged in constructive dialogue with the ICO before and throughout the pandemic and have a clear action plan we have in place to clear the backlog."

Timeline of events

The ICO originally became aware of a backlog at the MoJ on 7 January 2019, which resulted in conversations with the data controller over the following year. This almost led to an enforcement notice being issued - a formal exercise of the Commissioner's powers for violations of data protection law - which was ultimately delayed due to the pandemic.

According to the ICO, the pandemic "led to a shift in Commissioner's approach to regulatory action" and saw the investigation into the MoJ paused. New societal restrictions affected the MoJ's ability to respond to the backlog of SARs, the data controller told the ICO in an October 2020 update. Urgent cases were being prioritised, such as those affecting legal proceedings, police investigations, and immigration hearings.

The ICO said contact between it and the MoJ resumed in March 2021 and by April, it became aware that the MoJ was facing 5,956 outstanding SARs to which the MoJ had only partially responded. A total of 372 of these dated back as far as 2018.

Regular progress updates from the MoJ regarding how it was addressing the backlog were then requested by the ICO and by May 2021, the backlog had grown to 6,398. The backlog grew further to 7,753 by August 2021 after the MoJ said it predicted the resumption of a full SAR service by "summer/autumn 2021". It also said that of the near-8,000 outstanding cases, 25 received no response at all and around 960 predated the pandemic.

The MoJ promised to address the pre-pandemic cases first, setting itself a deadline of 31 May 2022, after which time it "will then move forward with plans to revisit the remaining 6,772 partial response cases in the timeliest way achievable".

Europol has been accused of unlawfully storing, and ignoring requests to delete, large amounts of data on individuals with no established link to criminal activity.

The European Data Protection Supervisor (EDPS) has ordered Europol to delete the data it has been storing, concluding a years-long inquiry into the crime-fighting agency's data collection habits.

The order follows the EDPS 'admonishment' of Europol more than a year ago in September 2020 when it was first found to be storing large volumes of data with no Data Subject Categorisation - a requirement stipulated by the Europol Regulation.

The EDPS said that while Europol has complied with some requests and implemented "some" technical measures since then, it has not complied with other requests including failing to define an appropriate data retention period.

The measures introduced reduce, but do not remove, the possibility that individuals' fundamental rights could be put at risk by unlawful analysis of their data by Europol, or by the data being shared with other law enforcement agencies. As such, the data being stored does not ensure compliance with the Europol Regulation, the EDPS said.

It means Europol was keeping this data for longer than was necessary and violated the principles of data minimisation and storage limitation enshrined in the Europol Regulation.

Europol's bank of data reportedly contains at least four petabytes of data on at least 250,000 individuals linked to terror or crime offences, accumulated from national law enforcement authorities over the past six years, according to the Guardian.

Privacy advocates have told IT Pro that Europol's hoarding of data is "hugely concerning" and have been exacerbated by the law enforcement agency's reluctance to delete the data after being told to do so a year ago. The amount of data that was reportedly being stored by Europol could even be likened to the NSA's mass surveillance revealed by Edward Snowden.

"Admittedly, sorting through 4 petabytes of data could not have been an easy task for Europol," said Hannah Hart, privacy expert at ProPrivacy. "Such a vast quantity of data, which is roughly a fifth of the US Library of Congress, is even tantamount to mass surveillance in the eyes of many a privacy advocate. The stockpiling of this information – as well as the secrecy of its existence – has led to chilling comparisons to America’s infamous NSA, which conducted widespread telephone surveillance before its exposure by Edward Snowden."

"Law enforcement bodies are given enhanced rights to collect and process personal data to perform their security functions," said Ed Hayes, partner at UK law firm TLT to IT Pro. "Citizens have a reasonable expectation that those organisations will be doing everything possible to ensure they comply with the law when exercising those extensive rights. When they fail to do so, it reduces trust, and that has knock-on effects.

“Law enforcement bodies are often at the forefront of deploying new technologies like AI and facial recognition," he added. "If they can’t be trusted to get the basics of data protection right – things like having proper data categorisation, storage and retention arrangements – it calls into question whether they should be trusted with deploying potentially far-reaching and intrusive new technologies.”

As Europol has failed to comply with requests, the EDPS will now exercise its corrective powers and impose a six-month retention period, and all datasets older than six months that have not undergone Data Subject Categorisation must be deleted. Europol has been given a 12-month grace period in which to comply with the EDPS' decision.

"Europol has dealt with several of the data protection risks identified in the EDPS’ initial inquiry," said Wojciech Wiewiórowski, the EDPS. "However, there has been no significant progress to address the core concern that Europol continually stores personal data about individuals when it has not established that the processing complies with the limits laid down in the Europol Regulation.

"Such collection and processing of data may amount to a huge volume of information, the precise content of which is often unknown to Europol until the moment it is analysed and extracted - a process often lasting years."

The EDPS thinks that six months is enough time for Europol to extract all the critical data needed from the datasets and to provide any support to law enforcement authorities in EU member states.

Europol will also be required to submit reports to the EDPS every three months for the next 12 months updating him on the progress of its efforts to implement the necessary measures outlined in this week's decision.

Security vs. Privacy concerns

The news of Europol storing this large amount of data has led many to be concerned with the level of risk to individuals' rights but the EDPS decision also raises a debate around the balance between protecting an individual's right to privacy against the need to protect national security.

"This is a great example of the central dilemma of an open society – the need for privacy versus the need for security," said Edmund Probert, Commercial, IT Contracts and Intellectual Property Partner at international law firm Spencer West to IT Pro. "Clearly Europol, with which the UK has a co-operation agreement, has been trying to hold data for far too long in the view of the European Data Protection Supervisor. As a result, he has thrown all the toys out of the pram."

"Given the size of the databases, this amounted to the sort of mass surveillance the like of which we expect from dictatorships and totalitarian countries – not the EU. While the decision is couched in diplomatic terms, it is a damming report – and in simple terms, this is a ‘final warning’ with performance monitoring."

"Europe’s data protection regime relies on data controllers taking their legal obligations seriously, and that’s especially the case for public authorities operating in the law and order space," said Hayes of TLT. "Europol’s failure to comply with previous clear directions from the EDPS is so concerning precisely because it brings into question in what other ways it is ignoring the data protection law that should govern its actions."

LG Electronics has joined the IBM Quantum Network to expand industry applications of quantum computing.

IBM will give LG Electronics access to its quantum computing systems and Qiskit, in addition to the firm's open source quantum information software development kit.

The resources will help LG electronics augment big data, artificial intelligence (AI), connected cars, digital transformation, the Internet of Things (IoT), and robotics applications.

Further, with IBM Quantum technology, LG can capture the latest advances and applications from quantum computing, in accordance with IBM's quantum roadmap.

Using IBM Quantum technology, LG will also train its employees, allowing the company to examine potential breakthroughs for its industry.

"Based on our open innovation strategy, we plan to use IBM Quantum to develop our competency in quantum computing," said Byoung-Hoon Kim, CTO and executive vice president of LG Electronics.

"We aim to provide customers with value that they have not experienced so far by leveraging quantum computing technology in future businesses."

As part of the IBM Quantum Summit in November 2021, IBM unveiled its Eagle quantum computing processor with 127 qubits. Eagle uses IBM's 3D packaging architecture designed to support advanced quantum processors, including its 1,126-qubit Condor chip scheduled to be released in 2023.

The LG partnership further strengthens IBM's quest for Quantum Advantage.

"We're happy to welcome LG Electronics to a growing quantum computing ecosystem in Korea at an exciting time for the region," said Jay Gambetta, IBM fellow and VP of quantum computing at IBM.

"The relationship between IBM and LG Electronics will permit LG to explore new types of problems associated with emerging technologies and will help strengthen the quantum capabilities in Korea."

WeSpire, a provider of employee experience solutions with an environmental, social, and governance (ESG) sustainability focus, has announced the launch of its Employee Carbon Management Solution.

Developed in partnership with Cox Enterprises and South Pole, the new solution provides enterprises with a comprehensive set of tools to measure, reduce, balance, and report on employee carbon emissions both on the job and at home.

“Until now, getting employee-based Scope 3 carbon emissions data quickly, accurately, and on-demand has been challenging due to a lack of workplace-specific tools to reliably capture and report the data,” explained WeSpire.

“The rapid move to hybrid and remote work environments and an increasing number of companies setting Scope 3 Net Zero goals has magnified the urgency of implementing a better approach.”

Employee Carbon Management Solution by WeSpire enables companies to establish a corporate ESG strategy across the workforce by providing employees with specific steps they can take to reduce their individual carbon footprints.

Through curated actions based on behavioral science, companies can promote continual, progressive reductions in carbon emissions without relying on offsets immediately.

WeSpire has also partnered with South Pole to provide high-quality offset opportunities as rewards to employees and employers.

WeSpire's Employee Carbon Management Solution will be available by Earth Day 2022 after it passes its testing phase.

“We’ve pioneered a data-first, behavior-change solution to drive much needed personal climate action in the workplace,” said Susan Hunt Stevens, founder and CEO of WeSpire.

“Our technology enables organizations to engage their employees to better understand their own impact, take targeted carbon reduction actions, and, when needed, the company or employees can balance what remains. This holistic solution will inspire further innovation as employees see their collective impact on their company’s ESG goals and will significantly simplify employee-related Scope 3 emissions reporting,” added Stevens.

DataOps is the key to leveraging data for competitive advantage, but success depends on the establishment of a strong functional infrastructure.

The foundation for DataOps requires an integrated storage and data management platform to unify the capture, storage, movement, classification, ingestion, and protection of data to make it available for high-value data engineering and data leverage purposes.

Download this resource to understand how to tackle the challenges presented by data growth and how to overcome them for greater agility.

Provided by

Datatilsynet, the Norwegian Data Protection Authority (DPA), has fined location-based LGBTQ+ dating app Grindr €6.5 million (£5.4 million) for selling user data for advertising purposes without consent.

Considered the largest GDPR fine issued by the Nowegian authority to date, the penalty states Grindr unlawfully shared personal data of users with third parties for advertising and marketing purposes.

The fine was ultimately reduced from its initial sum of 100,000,000 NOK (£8.2 million) as a result of Grindr's co-operation with the Norwegian DPA and quick fixes to remediate its consent management platform.

Describing Grindr's infringements as "grave", the authority said that user GPS locations, IP addresses, advertising IDs, ages, and genders were included in the data shared with third parties. It also concluded that the fact users had been identified as Grindr account holders meant that sexual orienation data had been shared, which is considered a special category under GDPR and requires additional justification for processing.

"We consider that data revealing the fact that someone is a Grindr user strongly indicates that they belong to a sexual minority," said the Norwegian DPA. "Data concerning a person’s sexual orientation constitutes special category data that merit particular protection under the GDPR. As the consents Grindr collected were not valid, Grindr could not lawfully share such data.

"While it not defined as special categories of personal data in itself, location data is sensitive and personal. The fact that Grindr has also shared this data unlawfully adds to the severity of the case."

The DPA also said Grindr users were forced into accepting the app's privacy policy in order to access its full set of features and were not asked specifically if they consented to their data being shared with third parties for behavioural advertisement.

The fine is the largest ever issued by the Norwegian DPA, which said further orders may be issued to Grindr. The Norwegian Consumer Council, which originally filed the complaint against the company, has already claimed the dating app infringed additional provisions of GDPR and has asked the DPA to order Grindr to erase the illegally processed data.

Grindr has a three-week window in which it can launch an appeal to the fine, which may be extended depending on circumstances, the DPA said.

"We strongly disagree with Datatilsynet’s reasoning, which concerns historical consent practices from years ago, not our current consent practices or Privacy Policy," said Shane Wiley, chief privacy officer at Grindr, to IT Pro.

"Even though Datatilsynet has lowered the fine compared to their earlier letter, Datatilsynet relies on a series of flawed findings, introduces many untested legal perspectives, and the proposed fine is therefore still entirely out of proportion with those flawed findings.

"We’ve just received a copy of the letter from Datatilsynet and are analysing the document. The Company is considering its options including the right to appeal the findings to the Personvernnemnda (PVN - Appeal Board)," he added.

The UK and US have announced a new agreement that will see the two long-term allies develop a deeper cross-border data partnership.

In a joint statement from the Summit for Democracy, the UK secretary of state for Digital, Culture, Media & Sport (DCMS) Nadine Dorries and the United States commerce secretary Gina M. Raimondo said developing a more comprehensive data-sharing agreement will lead to "a more peaceful and prosperous future".

The challenge, the two nations acknowledged, would be to create a data-sharing partnership that both allowed the free-flowing of data across the Atlantic while adhering to the different data protection laws and frameworks adopted by the two countries.

The purpose of creating the data framework is to enhance public safety, national security, and law enforcement investigations, the joint statement read.

"The challenges facing cross-border data flows are increasingly global and require solutions that work across multiple jurisdictions," said Dorries and Raimondo. "We recognise the negative trends that risk closing off international data flows.

"In response, we seek to shape a global data ecosystem in a manner that promotes and advances interoperability between different data protection frameworks, facilitating cross-border data flows while maintaining high standards of data protection and trust.

"We are committed to open and inclusive engagement with international partners, industry, civil society, and consumer and privacy rights groups."

Talks of a cross-border data-sharing agreement between the UK and US have been taking place for years and there were fears that once the UK left the European Union (EU), and was no longer compelled to adhere to GDPR domestically, that such an agreement between the UK and US would undermine data protection laws on home soil.

In 2019, when leaked documents confirmed the US was lobbying the UK for a data-sharing agreement, US officials cited the Asia-Pacific Economic Cooperation-Cross-Border Privacy Rules (APEC-CBPR) agreement as a model the two nations could follow.

The EU has had a watchful eye over the UK and US' data dealings for some time. Later in 2019, the two countries struck up a preliminary agreement with a narrower focus: to make it easier for sensitive data to be accessed across the borders for the purpose of crime fighting.

The move was originally designed to make it easier for UK and US law enforcement to access the data they needed for investigations without too much friction, but the EU then warned both countries that the agreement may not be sufficiently compatible with EU data protection standards.

European Data Protection Board (EDPB) director Andrea Jelinek wrote to the UK at the time saying the agreement may harm the UK's chances of securing a post-Brexit data adequacy agreement with the EU, an agreement it later achieved this year.

Privacy technology prize challenge

Also announced by the two nations at the Summit for Democracy was a brand-new prize competition to encourage the development of, and mature privacy-enhancing technologies (PETs).

The prize challenge will form part of a series of international grand challenges to promote democracy-affirming technologies to accelerate work and overcome gaps in the technology used to protect the privacy of citizens.

It's the thought the work that goes into the challenge will build on the innovation already being made across academia, the private sector, and government, harnessing data to help protect privacy and intellectual property.

"Privacy-enhancing technologies can help our democracies to harness the power of data and AI to support our citizens and businesses - in a way that reinforces our shared values," said Dorries.

"The UK is striving to unlock the power of data across the economy. This prize challenge will build on the UK’s comprehensive National Data Strategy and help to raise the profile of these technologies on both sides of the Atlantic, laying the foundations for future collaboration."

Winners of the prize will be announced at next year's Summit.

The EU's proposed Data Governance Act (DGA) has been provisionally agreed by the European Council and European Parliament which could bring an innovation boost to the Bloc's data economy.

The DGA promotes the sharing of protected public-sector data between companies in the EU and aims to provide a trustworthy environment through which innovative products and research can be produced.

It will introduce robust mechanisms such as digital platforms which can be used to purchase data for 'altruistic projects', the Bloc said on Tuesday.

It’s thought such data can be bought and re-used at a faster rate by EU member states to accelerate the development of projects for the common good, like medical research.

There is also a belief in the EU that the potential for artificial intelligence (AI) development cannot be unlocked without data sharing.

"The Data Governance Act is a major milestone that will boost the data-driven economy in Europe in the years to come," said Boštjan Koritnik, Slovenian minister for public administration, and president of the European Council. "By enabling control and creating trust, it will help unlock the potential of vast amounts of data generated by businesses and individuals.

"This is indispensable for the development of artificial intelligence applications and critical for the EU’s global competitiveness in this area. Data-powered innovations will help us address a range of societal challenges and drive economic growth, which is so important for the post-COVID recovery."

Data made available on these digital platforms will be subject to the rights of others and includes categories such as trade secrets, personal data and data protected by intellectual property rights.

The EU said individuals and companies whose data will be made available on these platforms, known as data intermediation services, will have full control over their data and share it only with clients they trust.

Data intermediation services will also have to be listed on an official register to be able to operate - a measure the EU hopes will foster greater trust in the initiative.

"The law will be used to structure data sharing between organisations and member states in a more open and controlled way than is currently possible," said Peter Galdies, senior consultant at DQM GRC.

"Importantly, the obligation to meet the requirements of pre-existing data legislation still exists. It does not attempt to run roughshod over laws like the GDPR, but instead more clearly allocates responsibilities and measures that may have to be met to allow such sharing to take place."

The core principles of the General Data Protection Regulation (GDPR) will be at the heart of each data transaction on these digital platforms. Data intermediaries will not be able to share or sell data for any other purposes outside of what's agreed by the original stakeholders but will be allowed to charge for each transaction.

Public sector bodies will be prohibited from creating exclusive rights for the re-use of certain data and exclusive agreements will have to be limited to a maximum of 12 months, or two-and-a-half years for existing agreements.

"We are at the beginning of the age of AI and Europe will require more and more data," said lead MEP Angelika Niebler. "This agreement should make it easy and safe to tap into the rich data silos spread all over the EU.

"The data revolution will not wait for Europe. We need to act now if European digital companies want to have a place among the world’s top digital innovators."

The Information Commissioner's Office (ICO) has issued a provisional fine of £17 million to controversial Australian firm Clearview AI over its handling of UK personal data.

Despite no longer operating in the country, the firm has also been told to stop processing UK personal data and delete any it has.

The company, which provides mass databases and facial recognition technology for law enforcement agencies, has already been found to have broken Australian privacy law and been hit with cease and desist notices from the likes of Facebook and Twitter for scraping public images for its systems.

After a joint investigation with the Australian ICO, the UK's data regulator found that Clearview had violated "several" data protection laws in the UK. It also found the company may be "continuing to process significant volumes of UK people's information" without their knowledge.

"I have significant concerns that personal data was processed in a way that nobody in the UK will have expected," said Information Commissioner Elizabeth Denham said.

"It is therefore only right that the ICO alerts people to the scale of this potential breach and the proposed action we're taking. UK data protection legislation does not stop the effective use of technology to fight crime, but to enjoy public trust and confidence in their products technology providers must ensure people's legal protections are respected and complied with."

In response, Clearview called the regulator's claims "factually and legally incorrect". The company's founder and CEO, Hoan Ton-That, also said that the ICO had "misinterpreted" his technology and intentions.

"My company and I have acted in the best interests of the UK and their people by assisting law enforcement in solving heinous crimes against children, seniors, and other victims of unscrupulous acts. We collect only public data from the open internet and comply with all standards of privacy and law," Ton-That said, according to the BBC.

Clearview can challenge the proposed fine before a final decision is made midway through 2022.