Meritxell Borràs calls for a ban on the systematic espionage of tools such as Pegasus

The director of the Catalan Data Protection Authority (APDCAT), Meritxell Borràs, called on Parliament to ban systematic espionage that allows tools such as Pegasus, because "they directly attack the essence of fundamental rights". During his appearance before the Committee on Institutional Affairs in the Parliament of Catalonia, Borràs said that the case of espionage uncovered by Citizen Lab is "extremely serious", because it affects particularly sensitive personal data of the citizens of Catalonia, which they refer to aspects such as ideology or health and which are specially protected by data protection regulations.

Borràs recalled that the scope of these security breaches goes far beyond the people directly affected by the installation of the spyware, as it also affects the personal data of third parties.

In this sense, he pointed out that in the APDCAT "this is an issue that worries us very much", and recalled that "the European Data Protection Supervisor has already said that national security cannot be an excuse for the use systematic use of this type of tool”. Borràs defended that this case "should appeal to everyone, including the rest of the data protection authorities, beyond ideologies", and called for full powers and more resources so that the APDCAT can defend the totality of the rights and freedoms of the citizens of Catalonia”.

43% more notifications of security breaches

The director of the APDCAT presented today to the Parliament the main data of the report corresponding to 2021 and the most relevant actions carried out by the Authority. In this regard, he highlighted the increase of about 43% of notifications of security breaches registered in 2021, half of which as a result of a malicious external act (50%).

Borràs also highlighted the significant increase in rights protection procedures, in response to complaints from people who have seen their right to data protection violated. He noted that in 2021 they have increased by 134% and that they are mainly related to the right of access in the field of health and the police.

He also highlighted the work of legal advice that the APDCAT carries out so that the Catalan public sector correctly applies the rule, with the elaboration of opinions on issues that involve data protection. These include, for example, those developed around data processing in relation to COVID-19, or those related to the implementation of video surveillance systems.

He also spoke about the Audit Plan on the publication of the register of processing activities, completed during 2021, and the Audit Plan on the obligation to appoint a data protection officer, and communicate the appointment to the APDCAT, started in 2021 and in the process of execution. Borràs emphasized that these are key tools for complying with the principle of prevention and for monitoring compliance with the standard and the implementation of corrective measures, if necessary.

Finally, he pointed out the training and dissemination work promoted by the Authority, which in 2021 had a significant impact on the group of minors and teachers in schools. Thus, he highlighted the realization of the first online course for teachers, in which training was provided by trainers. Also, the elaboration of didactic and educational materials, such as stories and games for children and young people, and the publication of resources to clarify data protection doubts, such as the Decalogue of data protection or the updating of frequently asked questions on the subject. data protection. In addition, Borràs highlighted the conferences organized by the APDCAT during 2021 to emphasize the importance of protecting privacy in various aspects, such as artificial intelligence, and the application of the data protection standard in the third sector.

Regarding the new challenges, Borràs stated that "we want to address the impact of emerging technologies on rights and freedoms", and explained that the APDCAT is already working on a new Strategic Plan that incorporates a practical vision aimed at the people. "We need to get organizations to understand their share of responsibility, when they process personal data, and that people have the tools to be able to protect themselves from abuse, without ignoring the benefits that technology brings", he concluded.