<p>英国的数据保护监管机构在与一家英国零售集团的漫长法律斗争中取得了一小胜，该集团在 2017 年的数据泄露中丢失了数百万条数据记录。</p>
<p>您可以在这里阅读沃比法官昨天发布的裁决 [PDF]。</p>
<p>信息专员办公室（ICO）在 2020 年最初对 DSG Retail 处以 50 万英镑（67.3 万美元）的罚款，这是根据 1998 年数据保护法（DPA 1998）允许的最高财务罚款——在 GDPR 实施前的相关立法。</p>
<p>其货币罚款通知（MPN）被上诉法院的初审法庭维持，但后来被上级法庭 [PDF] 撤销，该法庭支持 DSG Retail，如果该决定是最终的，将有效地使 ICO 的罚款无效。</p>
<p>案件的重要性在于被盗数据的性质。黑客在 DSG 拥有的消费电子商店 Currys PC World 和 Dixons Travel 的 5390 个收银机上安装了恶意软件。</p>
<p>ICO 在发布其 MPN 时确认，该恶意软件在九个月内未被发现，窃取了 560 万条支付卡信息和约 1400 万人的个人信息。</p>
<p>时任专员史蒂夫·埃克斯利当时表示，ICO 的调查结果令人 “担忧”，与 “基本、常见的安全措施” 有关，最终显示出对客户数据的 “完全漠视”。</p>
<p>争议的焦点是，攻击者获取的卡片信息是否可以用来识别持卡人。与支付信息分开访问的个人数据并不是本案中讨论的内容。</p>
<p>关键是，涉及的卡片信息是长达 16 位的卡号和到期日期，但不是卡上的姓名。</p>
<p>DSG 辩称，案件的这一特定方面并不构成个人数据泄露，因为黑客无法仅凭支付卡信息识别个人。DSG 承认，作为一个组织，它可以将卡数据与真实个人联系起来，但攻击者无法做到。</p>
<p>上级法庭对 ICO 作出了不利裁决，认为案件应从攻击者的角度来看。如果他们无法使用卡数据识别个人，那么该数据在 DPA 1998 的犯罪背景下就不应被视为个人数据。</p>
<p>沃比法官在周四得出结论，认为这一论点不正确，支持 ICO，将案件发回初审法庭，该法庭在第一审中做出了正确的裁决。</p>
<p>他的判决挑战了上级法庭对法律的解释，表示个人数据必须从控制者的角度来看；如果它可以导致识别个人，在本案中是 DSG Retail，那么它就是个人数据。</p>
<p>相关法规要求数据控制者保护这些数据，无论第三方是否能够使用它来识别个人。</p>
<p>沃比法官补充说，上级法庭的思维方式如果确实是 DPA 1998 的正确解释，可能会导致混淆的后果。</p>
<p>例如，这种相同的方法将有效地解除数据控制者在勒索软件攻击发生时保护数据的责任，只要攻击者无法使用它来识别个人。</p>
<p>“上诉法庭和 DSG 的论点隐含地认为，只要恶意行为者无法识别与数据相关的个人，这种干预从数据主体的角度来看基本上是无害的，因此对他们的保护责任将是毫无意义的负担，” 沃比法官裁定。“我不接受这一点。”</p>
<p>他接着讨论了拼图识别的可能性，即攻击者可以利用通过各种来源在线可获取的大量个人数据来识别持卡人。</p>
<p>“技术的复杂性大大提高。定位、组装和结合不同项目以获取有关个人的信息的能力大大增强。通常很难排除未经授权访问数据集部分的风险，这些部分本身并不识别任何个人，但可能导致某个未知第三方（合法）访问识别手段。”</p>
<p>现在，上诉法院裁定 DSG 有法律责任将支付卡数据作为个人数据进行保护，初审法庭将根据这一裁决重新审查案件。</p>
<p>DSG 可能会对法庭的决定提出上诉，再次将其送回上级法庭。如果争议仍然存在，可能会成为英国最高法院的问题。</p>
<p>ICO 的总法律顾问宾妮·高表示：“今天的裁决是一个重要的胜利，为受到网络攻击影响的人们以及行业带来了急需的明确性。”</p>
<p>“我们欢迎上诉法院确认，组织必须保护他们处理的所有个人数据，无论黑客如何使用或利用这些数据。这承认即使黑客无法从被盗数据集中单独识别个人，网络攻击仍然会造成实际伤害。</p>
<p>“随着网络犯罪威胁的上升，这一决定增强了我们在未来采取强有力行动的能力，并向所有组织发出了明确的信息：您有责任保护您所持有的个人数据。”</p>
<p>DSG Retail 的当前交易名称 Curry's PLC 未对我们的评论请求作出回应。®</p>

乐购

<p>英国的数据保护监管机构维持对 DSG Retail 的 50 万英镑罚款，原因是 2017 年的数据泄露事件暴露了数百万个支付卡信息。上诉法院裁定，尽管攻击者无法从被盗信息中识别持卡人，DSG 仍有法律责任保护这些数据作为个人信息。该案件将返回初审法庭进行进一步审查，并有可能上诉至英国最高法院。信息专员办公室强调了保护组织处理的所有个人数据的重要性</p>

<p>The UK's data protection watchdog has scored a small win in a lengthy legal battle against a British retail group that lost millions of data records during a 2017 breach.</p>
<div class="lb-trans"><p>英国的数据保护监管机构在与一家英国零售集团的漫长法律斗争中取得了一小胜，该集团在 2017 年的数据泄露中丢失了数百万条数据记录。</p>
</div><p>You can read Lord Justice Warby's decision, handed down yesterday, here [PDF].</p>
<div class="lb-trans"><p>您可以在这里阅读沃比法官昨天发布的裁决 [PDF]。</p>
</div><p>The Information Commissioner's Office (ICO) originally fined DSG Retail £500,000 ($673,000) in 2020, the maximum financial penalty allowed under the Data Protection Act 1998 (DPA 1998) – the relevant legislation at the pre-GDPR time.</p>
<div class="lb-trans"><p>信息专员办公室（ICO）在 2020 年最初对 DSG Retail 处以 50 万英镑（67.3 万美元）的罚款，这是根据 1998 年数据保护法（DPA 1998）允许的最高财务罚款——在 GDPR 实施前的相关立法。</p>
</div><p>Its monetary penalty notice (MPN) was upheld by the Court of Appeal's first-tier tribunal but later reversed by the upper tribunal [PDF], which sided with DSG Retail and, if that decision was final, would have effectively nullified the ICO's fine.</p>
<div class="lb-trans"><p>其货币罚款通知（MPN）被上诉法院的初审法庭维持，但后来被上级法庭 [PDF] 撤销，该法庭支持 DSG Retail，如果该决定是最终的，将有效地使 ICO 的罚款无效。</p>
</div><p>Important to the case is the nature of the data that was stolen. Hackers installed malware on 5,390 tills across consumer electronics stores Currys PC World and Dixons Travel, both of which DSG owns.</p>
<div class="lb-trans"><p>案件的重要性在于被盗数据的性质。黑客在 DSG 拥有的消费电子商店 Currys PC World 和 Dixons Travel 的 5390 个收银机上安装了恶意软件。</p>
</div><p>The malware went unnoticed for nine months, hoovering up 5.6 million payment card details and the personal information belonging to around 14 million people, the ICO confirmed when issuing its MPN.</p>
<div class="lb-trans"><p>ICO 在发布其 MPN 时确认，该恶意软件在九个月内未被发现，窃取了 560 万条支付卡信息和约 1400 万人的个人信息。</p>
</div><p>Then-commissioner Steve Eckersley said at the time that the ICO's findings were &#34;concerning&#34; and related to &#34;basic, commonplace security measures,&#34; that ultimately showed &#34;a complete disregard&#34; for customers' data.</p>
<div class="lb-trans"><p>时任专员史蒂夫·埃克斯利当时表示，ICO 的调查结果令人 “担忧”，与 “基本、常见的安全措施” 有关，最终显示出对客户数据的 “完全漠视”。</p>
</div><p>The point of contention, central to the protracted legal case, is whether the card details the attackers scooped up could be used to identify cardholders. The trove of personal data accessed separately from the payment details is not something being debated in this case.</p>
<div class="lb-trans"><p>争议的焦点是，攻击者获取的卡片信息是否可以用来识别持卡人。与支付信息分开访问的个人数据并不是本案中讨论的内容。</p>
</div><p>Crucially, the card details involved were the long 16-digit card number and expiry dates, but not the names on the cards.</p>
<div class="lb-trans"><p>关键是，涉及的卡片信息是长达 16 位的卡号和到期日期，但不是卡上的姓名。</p>
</div><p>DSG argues that this specific aspect of the case does not amount to a personal data breach since the hackers could not identify people from the payment card details alone. DSG acknowledges that it, as an organization, could make the link between the card data and real individuals, but says the attackers could not.</p>
<div class="lb-trans"><p>DSG 辩称，案件的这一特定方面并不构成个人数据泄露，因为黑客无法仅凭支付卡信息识别个人。DSG 承认，作为一个组织，它可以将卡数据与真实个人联系起来，但攻击者无法做到。</p>
</div><p>The upper tribunal ruled against the ICO, arguing that the case should be viewed from the perspective of the attackers. If they couldn't use the card data to identify people, then that data should not be considered personal data within the context of a DPA 1998 offense.</p>
<div class="lb-trans"><p>上级法庭对 ICO 作出了不利裁决，认为案件应从攻击者的角度来看。如果他们无法使用卡数据识别个人，那么该数据在 DPA 1998 的犯罪背景下就不应被视为个人数据。</p>
</div><p>Lord Justice Warby concluded on Thursday that this argument was incorrect, siding with the ICO, sending the case back to the first-tier tribunal which ruled correctly in the first instance.</p>
<div class="lb-trans"><p>沃比法官在周四得出结论，认为这一论点不正确，支持 ICO，将案件发回初审法庭，该法庭在第一审中做出了正确的裁决。</p>
</div><p>His judgment challenged the upper tribunal's interpretation of the law, saying that personal data must be viewed from the perspective of the controller; if it can lead to the identification of an individual, in this case, at DSG Retail, then it is personal data.</p>
<div class="lb-trans"><p>他的判决挑战了上级法庭对法律的解释，表示个人数据必须从控制者的角度来看；如果它可以导致识别个人，在本案中是 DSG Retail，那么它就是个人数据。</p>
</div><p>The relevant statute requires data controllers to safeguard this data, regardless of whether a third party could use it to identify individuals.</p>
<div class="lb-trans"><p>相关法规要求数据控制者保护这些数据，无论第三方是否能够使用它来识别个人。</p>
</div><p>Lord Justice Warby added that the upper tribunal's thinking could lead to confusing consequences if that was indeed the correct interpretation of the DPA 1998.</p>
<div class="lb-trans"><p>沃比法官补充说，上级法庭的思维方式如果确实是 DPA 1998 的正确解释，可能会导致混淆的后果。</p>
</div><p>The same approach would effectively free data controllers of the burden of protecting data in the event of a ransomware attack, for example, provided the attacker could not use it to identify people.</p>
<div class="lb-trans"><p>例如，这种相同的方法将有效地解除数据控制者在勒索软件攻击发生时保护数据的责任，只要攻击者无法使用它来识别个人。</p>
</div><p>&#34;It is implicit in the reasoning of the UT, and in DSG's submissions, that such interventions are essentially harmless from the perspective of data subjects, so long as the malicious actor is not able to identify the people to whom the data relate, so that a duty to guard against them would be pointlessly burdensome,&#34; Lord Justice Warby ruled. &#34;I do not accept that.&#34;</p>
<div class="lb-trans"><p>“上诉法庭和 DSG 的论点隐含地认为，只要恶意行为者无法识别与数据相关的个人，这种干预从数据主体的角度来看基本上是无害的，因此对他们的保护责任将是毫无意义的负担，” 沃比法官裁定。“我不接受这一点。”</p>
</div><p>He went on to discuss the possibility of jigsaw identification, whereby attackers could use the vast amounts of personal data that are accessible online, through various sources, as a means to identify the cardholders.</p>
<div class="lb-trans"><p>他接着讨论了拼图识别的可能性，即攻击者可以利用通过各种来源在线可获取的大量个人数据来识别持卡人。</p>
</div><p>&#34;Technology has vastly increased in sophistication. The ability to locate, assemble, and combine disparate items to elicit information about individuals is greatly enhanced. It will often prove impossible to rule out the risk that unauthorized access to part of a data set, which does not itself identify any individual, could lead to processing by some unknown third party with (legitimate) access to the means of identification.&#34;</p>
<div class="lb-trans"><p>“技术的复杂性大大提高。定位、组装和结合不同项目以获取有关个人的信息的能力大大增强。通常很难排除未经授权访问数据集部分的风险，这些部分本身并不识别任何个人，但可能导致某个未知第三方（合法）访问识别手段。”</p>
</div><p>Now that the Court of Appeal has ruled that DSG had a legal duty to safeguard the payment card data as personal data, the first-tier tribunal will review the case within the context of this judgment.</p>
<div class="lb-trans"><p>现在，上诉法院裁定 DSG 有法律责任将支付卡数据作为个人数据进行保护，初审法庭将根据这一裁决重新审查案件。</p>
</div><p>DSG could appeal the tribunal's decision, sending it back again to the upper tribunal. If disputes remain, it could become a matter for the UK Supreme Court.</p>
<div class="lb-trans"><p>DSG 可能会对法庭的决定提出上诉，再次将其送回上级法庭。如果争议仍然存在，可能会成为英国最高法院的问题。</p>
</div><p>Binnie Goh, general counsel at the ICO, said: &#34;Today's judgment is a significant victory, bringing much-needed clarity for people affected by cyber attacks as well as industry.</p>
<div class="lb-trans"><p>ICO 的总法律顾问宾妮·高表示：“今天的裁决是一个重要的胜利，为受到网络攻击影响的人们以及行业带来了急需的明确性。”</p>
</div><p>&#34;We welcome the CoA's confirmation that organisations must protect all personal data they process, regardless of how it might be used or exploited by hackers. This recognises that even if hackers can't identify people individually from stolen datasets, cyberattacks can and do still cause real harm.</p>
<div class="lb-trans"><p>“我们欢迎上诉法院确认，组织必须保护他们处理的所有个人数据，无论黑客如何使用或利用这些数据。这承认即使黑客无法从被盗数据集中单独识别个人，网络攻击仍然会造成实际伤害。</p>
</div><p>&#34;With the rising threat of cybercrime, this decision strengthens our ability to take robust action in the future and sends a clear message to all organisations: you have a protective duty to safeguard the personal data you hold.&#34;</p>
<div class="lb-trans"><p>“随着网络犯罪威胁的上升，这一决定增强了我们在未来采取强有力行动的能力，并向所有组织发出了明确的信息：您有责任保护您所持有的个人数据。”</p>
</div><p>Curry's PLC, the current trading name of DSG Retail, did not respond to our requests for comment. ®</p>
<div class="lb-trans"><p>DSG Retail 的当前交易名称 Curry's PLC 未对我们的评论请求作出回应。®</p>
</div>

攻击者掌握了 16 位卡号和到期日期，但没有持卡人的姓名。该组织现被罚款 50 万英镑