Pegasus Attacks! Be on Watch!

The big news today was about Pegasus, the exploit targeting Apple devices. Pegasus exploits a vulnerability in iMessage, and can install itself on a device without a user doing anything to facilitate the installation. The spyware allows an attacker to steal messages, emails, and location data, and record with the camera and microphone.

Don't miss that you need to also separately upgrade your Apple Watch after you have updated your iPhone's operating system. Go to the Apple Watch app on the phone, and select General . . . Software Update.

Apple’s Tracking Transparency Feature

The latest version of Apple’s iOS system for iPhones will prompt users to choose whether or not they want each individual app installed on their mobile devices to track their personal data. This feature will only operate if a user enables it under Settings . . . Privacy . . .Tracking:

If an app receives permission to collect personal data, the device’s ID; the advertising ID; the user’s name; and the user’s email address will be used in conjunction with data from third parties to send you targeted advertising. Apple’s notice for its Transparency Tracking feature warns that when permission to track is given “[t]he app developer may also choose to share the information with data brokers which may result in the linking of publicly available and other information about you or your device.”

Notably the notice acknowledges that this feature does not prevent an app dev from using your personal data to send you targeted ads on the iPhone. The restriction only applies to using the data to target you elsewhere.

After the feature is enabled when you open an app, you’ll get a notice like this;

You set the option to turn off personal data collection for use off your iPhone:

Oddly, on my iPhone some apps such as Amazon and Google Maps do not prompt the user to respond to the tracking transparency feature.

WhatsApp Data Processing Halted Under the GDPR

Earlier this month, the Commissioner for Data Protection and Freedom of Information in Hamburg ordered Facebook's subsidiary in Ireland to stop processing personal data collected from WhatsApp. See, Press Release, The Hamburg Commissioner for Data Protection and Freedom and Information, Order of the HmbBfDI: Ban of further processing of WhatsApp user data by Facebook (May 11, 2021), available at: https://datenschutz-hamburg.de/assets/pdf/2021-05-11-press-release-facebook.pdf. WhatsApp users will have to agree to new terms which allow their data to be shared with Facebook by May 15, or they will have to make do with a version of the app with limited functionality. The data will be used for advertising to WhatsApp users. The Commissioner found that the data processing does not comply with GDPR.

The Commissioner criticized WhatsApp for isolating terms regarding data transfers in separate areas of the new terms, and using contradictory language. Facebook's processing of WhatsApp data could not be regarded as being necessary for the performance of a contract. "Facebook cannot claim a prevailing legitimate interest in processing the data of WhatsApp users because their interests are overridden by the rights and freedoms of the data subjects. Consent is neither given freely nor in an informed manner. This applies particularly to minors. For these reasons, consent under data protection law cannot be considered as a legal ground." Ibid. The Commissioner faulted WhatsApp for not promptly responding to its inquiry into how data is shared.

The order will be in effect for three months while the Commissioner requests that the European Data Protection Board issue a final decision. Article 66 of the GDPR allows a supervisory authority to immediately adopt provisional measures when there is an urgent need to act. These measures can only last for three months.