The United Kingdom has become just the second country, following the United States, to issue guidance for companies in the maritime shipping industry alerting them about common illicit and suspicious practices used to evade sanctions. The guidance further describes best practices for reducing sanctions risk exposure.

The Office of Financial Sanctions Implementation (OFSI), part of HM Treasury and the authority for the implementation of financial sanctions in the United Kingdom, issued the guidance July 27. It follows issuance of a similar advisory by the U.S. Departments of State and Treasury and the U.S. Coast Guard in May.

In its guidance, the OFSI warned, “illicit activity could occur across multiple sectors involved in the maritime industry.” Maritime insurance companies, charterers, unions, classification societies, oil companies and refineries, customs and port state controls, flag registries, and shipping industry associations are all exposed to financial sanctions risk.

The maritime guidance includes a discussion about high-profile sanctions regimes, include those in place for the Democratic People’s Republic of Korea, Iran, and Syria. It further advises companies refer to the relevant sanctions regulations to determine what restrictions apply in relation to any given regime.

Illicit shipping practices

“Individuals and entities with exposure to the maritime shipping sector should be aware of the non-exhaustive list of illicit practices below and ensure compliance and due diligence procedures take account of them,” the OFSI stated in the advisory.

Like the U.S. maritime sanctions guidance, the U.K. sanctions guidance goes into significant detail about common deceptive shipping practices, including:

  • Ship-to-ship transfers used to facilitate the illicit transfer of coal, crude oil, and petroleum products to evade sanctions;
  • Disabling or manipulating the automatic identification system (AIS) on vessels;
  • Cyber-attacks from cyber-focused military units tasked with generating income for the regime it reports to;
  • Bank accounts used as fronts to conduct transactions in violation of sanctions and facilitating illicit shipping practices;
  • Falsifying documentation accompanying maritime transactions; and
  • Physically concealing illicit cargo aboard a vessel.

Due diligence

The OFSI does not recommend any specific measures to mitigate deceptive shipping practices, only advising that each company “assess its own risks and put due diligence measures in place to manage these risks.” However, it does recommend a few general due diligence considerations, including the following:

Do your homework. “Companies conducting activity in or around high-risk jurisdictions should seek to have a robust understanding of the sanctions regulations in place, including the relevant obligations,” the OFSI said.

Consider AIS screening. Ship owners, charterers, insurers, flag registries, and port-state control entities may wish to consider “AIS switch off” clauses in contracts. “While AIS switch off does not necessarily confirm illicit shipping practices, it may be one of several indicators for consideration,” the OFSI said. “Due diligence could be enhanced, for example, through contacting vessels that have ‘gone dark’ by switching off their AIS. This is to better understand the cause of disconnection, noting such instances, and reviewing for trends.”

Consider subscription-based resources. Subscription-based resources may allow for checks on ownership structures, vessel flag information, details of home ports, and recently visited ports. “However, this information is also readily available online and can be accessed freely, which helps companies with limited resources to carry out a variety of checks to provide initial indicators of behavior,” the OFSI said.

Check validity of financial transactions. Suspected fraudulent letters of credit, bills of lading, loans, and other types of financial instruments should always be checked with the relevant institution for validity. Any person dealing with funds or economic resources owned, held, or controlled by a designated person (DP) or those operating on a DP’s behalf should immediately freeze the assets or funds and alert the OFSI.

Conclusion

Companies and sanctions compliance officers in the maritime industry should review both the OFSI maritime guidance in conjunction with the U.S. Global Maritime Advisory when determining what due diligence measures to put in place. Even companies with well-embedded enhanced due diligence measures in place should still consider conducting a review to ensure they’re accounting for all the deceptive practices highlighted in the maritime guidance documents.

Conversely, other companies whose due diligence practices are not as mature may find they’ll have to conduct a significant risk assessment to identify the red flags highlighted by the OFSI and get their due diligence processes up to par.

client alert from law firm Eversheds Sutherland further recommends considering revisions to contractual clauses to ensure they address risks posed by, and offer protection against, deceptive shipping practices. Such provisions may include, for example, AIS-disablement provisions; corresponding termination rights to regulate vessel behavior in active transactions; and representations and/or warranties concerning the vessel’s past transactions, the law firm advised.

Breaches of financial sanctions come at hefty cost. Under the Policing and Crime Act of 2017, the OFSI has authority to impose monetary penalties of up to 50 percent of the value of the breach or up to £1 million (U.S. $1.3 million), whichever is higher.

The OFSI can also refer cases to law enforcement agencies for investigation and potential prosecution. Breaches of financial sanctions are considered a serious criminal offense and are punishable by up to seven years in prison on indictment or up to six months for a summary offense in England, Wales, or Northern Ireland, or 12 months for a summary offense in Scotland.

As law firm Clyde & Co. stated, “It is no coincidence that two of the world’s leading sanctions enforcement bodies have both issued guidance notes to the maritime industry within months of each other. Industry participants have been warned: There are now very clear expectations of what good sanctions compliance looks like.”

Source: complianceweek


CHICAGOJuly 31, 2020 /PRNewswire/ — According to the new market research report Maritime Satellite Communication Market by Component (Solutions and Services), Solution (VSAT and MSS), Service (Tracking and Monitoring, Voice, Video, Data), End User (Merchant Shipping, Offshore, Government), and Region – Global Forecast to 2025″, published by MarketsandMarkets™, the global Maritime Satellite Communication Market size is expected to grow from USD 2.3 billion in 2020 to USD 3.2 billion by 2025, at a Compound Annual Growth Rate (CAGR) of 7.1% during the forecast period. Escalating the need for enriched data communication to improve operation efficiency, onboard security & surveillance, and employee/passenger welfare in maritime is driving the market.

Furthermore, the major factor driving the Maritime Satellite Communication Market is the need to attain improved connectivity between the land and sea operations and realizing benefits in faster repair times, preventative maintenance, fuel-saving, and real-time navigation.

Browse in-depth TOC on “Maritime Satellite Communication Market

221 – Tables
42 – Figures
216 – Pages

Download PDF Brochure:

https://www.marketsandmarkets.com/pdfdownloadNew.asp?id=113822978

Ka-band segment to account for the largest market size during the forecast period

This section studies the maritime satellite communication VSAT portfolio. Ka-band operates under frequency 26.5-40 GHz. It is an extremely high frequency, commonly used in HD satellite TV. It is used by the maritime industry to support marine VSAT services. Ka-band incurs significant implementation cost but relatively low maintenance. It is susceptible to rain fade. Inmarsat was the first company to provide Ka-band VSAT services. As more Ka-band bandwidth becomes available, other players also started using Ka-band to deliver their communication services.

The video service segment to account for the largest market size during the forecast period

The video service segment of the maritime satellite communication service includes streaming of high definition photos & videos and online TV channel broadcast services. Video services enable the crew to get in touch with family through videoconferencing, get information & update on news, sports, and favorite TV programs, and many other services. Live video service can help onboard technicians to get live assistance from experts to resolve problems. High-quality live video transfer needs reliability and sufficient bandwidth.

Speak to Analyst:

https://www.marketsandmarkets.com/speaktoanalystNew.asp?id=113822978 

APAC to account for the highest market share during the forecast period

The Maritime Satellite Communication Market in APAC is the largest in terms of market size. APAC is the fastest-growing region in the Maritime Satellite Communication Market. Many countries in the APAC region are likely to adopt maritime satellite communication solutions owing to high demands, specifically in the oil and gas, merchant shipping, mining, and passenger shipping verticals. The APAC region is implementing maritime satellite communication solutions significantly. The maritime satellite technology has been adopted in this region to incorporate advanced communication networks to communicate with employees, such as crew working at remote offshore locations.

The major Maritime Satellite Communication Market vendors include Inmarsat (UK), Iridium Communications (US), Thuraya (UAE), Hughes Network Systems (US), KVH Industries (US), Viasat (US), Speedcast (Australia), ST Engineering (Singapore), NSSLGlobal (England), Marlink (France), ORBOCOMM (US), Navarino (Greece), Network Innovations (Canada), GTMaritime (England), AST Group (UK), Isotropic Networks (Wisconsin), Norsat International (Ontario), Satcom Global (Canada), Intelsat (US), and Orbit Communication Systems (Israel).

Browse Adjacent Markets: Satellite Communication Market Research Reports & Consulting

Related Reports:

Nanosatellite and Microsatellite Market by Component (Hardware, Software & Data Processing, Launch Services), Type (Nanosatellite and Microsatellite), Application, Vertical (Government, Defense, Civil), and Region – Global Forecast to 2025

https://www.marketsandmarkets.com/Market-Reports/nanosatellite-and-microsatellite-market-130496085.html

M2M Satellite Communication Market by Technology (Satellite Telemetry, VSAT, AIS), Communication Network Device (Satellite IP Terminals, Satellite Modems, Gateways), Service (Managed Service, Data), Vertical, Region – Global Forecast to 2020

https://www.marketsandmarkets.com/Market-Reports/m2m-satellite-communication-market-33741729.html

About MarketsandMarkets™

MarketsandMarkets™ provides quantified B2B research on 30,000 high growth niche opportunities/threats which will impact 70% to 80% of worldwide companies’ revenues. Currently servicing 7500 customers worldwide including 80% of global Fortune 1000 companies as clients. Almost 75,000 top officers across eight industries worldwide approach MarketsandMarkets™ for their painpoints around revenues decisions.

Our 850 fulltime analyst and SMEs at MarketsandMarkets™ are tracking global high growth markets following the “Growth Engagement Model – GEM”. The GEM aims at proactive collaboration with the clients to identify new opportunities, identify most important customers, write “Attack, avoid and defend” strategies, identify sources of incremental revenues for both the company and its competitors. MarketsandMarkets™ now coming up with 1,500 MicroQuadrants (Positioning top players across leaders, emerging companies, innovators, strategic players) annually in high growth emerging segments. MarketsandMarkets™ is determined to benefit more than 10,000 companies this year for their revenue planning and help them take their innovations/disruptions early to the market by providing them research ahead of the curve.

MarketsandMarkets’s flagship competitive intelligence and market research platform, “Knowledge Store” connects over 200,000 markets and entire value chains for deeper understanding of the unmet insights along with market sizing and forecasts of niche markets.


With large potential fines (the greater of up to 4% of global turnover or 20 million Euros), risk of claims from individuals and reputational damage, businesses need to make the necessary changes to their systems and policies now in order to be prepared when the GDPR “goes live” on 25 May 2018.

Organisations in the shipping industry may collect a lot of personal data, from email addresses of business contacts and counterparties to vessel crew and passenger information, as well as information about their own employees. Crew and contractors are vetted and managed. Immigration law obligations in numerous jurisdictions require certain personal information to be shared. Every business transaction involves interaction with individuals working for corporate counterparties. Much of this information is likely to cross national borders and be exposed from time to time to physical and cyber security risk. Once the GDPR applies, and the risk of large fines and reputational damage increases, breach of the data protection rules could potentially sink the business (or at least cause it to take on water).

Does the GDPR apply to my business if it is not based in the EEA?

The GDPR applies to all organisations “established” within the EEA, i.e. any organisation which has a “real and effective activity, even a minimal one, exercised through stable arrangements”. If you have an office or regular operations in the EEA, and process personal data in the context of that office or those operations, then the GDPR is likely to apply to your business. The fact that the processing itself actually takes place outside of the EEA would not be material.

The GDPR will also apply to organisations established outside of the EEA if certain conditions apply, including where they monitor the behaviour of individuals within the EEA (for example, via cookies), offer goods or services to individuals within the EEA (note that if you offer goods or services to a business that business has individuals within it) or where EEA Member State law applies in accordance with international law, e.g. where a vessel is flagged with an EEA Member State registry.

Particular factors to consider when determining whether the GDPR will apply are:

  • Are any of your vessels flagged within the EEA?
  • Is your website directed towards customers based in the EEA, for example by giving an option to choose a “UK” setting, an EEA currency, or a particular language?.
  • Can your services be bought from within the EEA?
  • Do you have a registered establishment or an office in the EEA?
  • Is your business currently registered with an EEA data protection authority, such as the UK’s Information Commissioner’s Office (the “ICO”)?
  • Do you use servers located in the EEA?
  • Do you monitor the behaviour of any individuals within the EEA (irrespective of their nationality or habitual residence)? For example, if your website uses tracking cookies, then you are “monitoring individuals” for the purposes of the GDPR.

If the answer to any of these questions is yes then it is likely that the GDPR applies to you.

So the GDPR applies to my business – what next?

The GDPR introduces a host of new obligations and requirements with which businesses must comply.

First, some essential terminology: “data controllers” make the decisions on how and why personal data are processed. “Data processors” only process data on the instructions of the data controller. “Processing” means any action involving personal data, including merely storing it. “Personal data” means any information relating to an identified or identifiable natural (living) person (a “data subject”). Under the new definition of personal data, online “identifiers” such as cookies and IP addresses can make an individual “identifiable”. “Sensitive” or “special category” reveal information such as an individual’s health, race or ethnicity, religious beliefs, ethnicity or sexual orientation.

A full list on how to comply with the GDPR requires more space than is available here, but five key action points are as follows:

  1. Conduct a data audit. Data controllers and processors alike are required to keep records of their personal data processing. Analyse your systems and practices to check what personal data you process, why, how you use them, where they are stored and whether you still need them. Check whether you process them in accordance with one of the permitted legal grounds (e.g. has the individual given their consent, or is the processing necessary for the performance of a contract with the individual, or necessary for a legitimate business interest). “Sensitive” personal data are subject to stricter rules and processing usually requires the individual’s consent. Note that “consent” is more difficult to obtain under the GDPR regime than under the UK Data Protection Act 1998 which implements the current EU data protection regime. Criminal records of employees or service providers can only be processed in accordance with specific EEA Member State laws. Document your findings and decisions.
  2. Draft or amend policies and procedures. The GDPR strengthens and adds to individuals’ rights, for example it strengthens the rights to have personal data deleted or frozen, adds a new right of “data portability” where an individual can request that personal data stored electronically be transferred to a different data controller, and shortens timelines for compliance with individuals’ requests. It also imposes new obligations on all data controllers to report personal data breaches to relevant data protection authorities within 72 hours, and to report breaches to individuals concerned (if the breach is high risk) “without undue delay”. It introduces a new concept of “privacy by design”, which requires businesses to think about protecting individuals’ privacy at the very beginning of any new project and to conduct “privacy impact assessments” calculating the potential risks to individuals’ privacy rights. Businesses will need to update (or draft) policies and procedures to ensure compliance with these obligations.
  3. Inform individuals about your processing through fair processing notices. Individuals must be kept informed about the processing of their personal data. The GDPR increases the amount of information which must be included in these notices. Privacy policies will need to be updated and businesses will need to amend (or draft) notification forms.
  4. Amend or put contracts in place with data processors. The GDPR requires data controllers to have contracts in place with all of their data processors, containing certain elements specified in the GDPR.
  5. Appoint a data protection officer. Many businesses will be required to appoint data protection officers, or may choose to do so voluntarily, given the increased risks associated with data protection.

These are just some of the actions that organisations need to take now. For more information on how you can prepare, and what systems you must have in place, see our special GDPR update at https://goo.gl/jNjMym or contact either:


The UK Chamber of Shipping has launched its latest publication, ‘The General Data Protection Regulation: Guidance to Shipping Companies’.
The guidance summarises the key requirements of the GDPR, which entered into force in May 2018, and the actions companies should take to implement data protection policies in compliance. It focuses specifically on the maritime sector and covers key areas such as crewing issues and seafarer payments.

The publication provides guidance to shipping companies on implementation of the General Data Protection Regulation (GDPR), which entered into force in May 2018. It summarises the key requirements of the GDPR and the actions companies should take to implement data protection policies in compliance. It focuses specifically on the maritime sector and covers key areas such as crewing issues and seafarer payments.

The purposes of this guidance document, produced by the UK Chamber of Shipping with Hill Dickinson LLP, are:

  • To summarise the key points of the General Data Protection Regulation (GDPR);
  • To identify the main areas where shipping companies will be affected by it; and
  • To advise companies on the most effective and efficient ways to familiarise themselves with the new rules and then to determine how to best implement them.

The document defines GDPR terminology and lists the types and sources of personal data and how it should be processed. It also describes the role and responsibilities of the Data Controller and the Company Data Protection Officer.

Guidance is also provided on the strict provisions relating to transfer of personal data to ‘third countries’ and those outside the EU. This is particularly relevant in the offshore industry where crew are transferred from one site to another and to and from a multitude of jurisdictions where their personal data will follow.

Finally, the publication sets out an ‘Action Plan for Companies’, describing suggested stages for a company to implement GDPR and verify compliance.

Click here to purchase

Source: UK Chamber of Shipping

The European General Data Protection Regulation (GDPR) entered into force on 25 May this year. While many of its provisions already applied under existing national and European data protection laws, the advent of the GDPR raised the profile of the issue and concentrated the minds of those in organisations that are now faced with the possibility of huge fines for any failure to protect adequately the personal data of their customers and employees and, most importantly, to report when a breach has occurred.

Under GDPR, companies are obligated to do three basic things: to ensure that data is held only for specific reasons and purposes; to ensure data subjects’ consent is not only freely given but as easy to withdraw as to provide, and to ensure systems for the storage and processing of data are secure.

This has led to the emergence of a whole industry of instant experts in data protection, who flooded many people’s inboxes with apocalyptic warnings of impending catastrophe and quick-fix solutions of high cost and limited results.  Quite how they compiled their distribution lists without breaching pre-existing data protection laws is not entirely clear.

One of the key issues for those in the shipping industry concerned cross-border transfers of personal data, particularly between EEA and non-EEA states. To what extent would GDPR apply to seafarers recruited from non-EEA countries?  Would it be lawful for personal data to be passed to organisations in countries outside the EEA?  These would include crewing and manning agencies, but also Port State Control and other statutory authorities and overseas ports.

The Chamber sought answers to these important questions from legal experts at law firm Hill Dickinson, who led a workshop for members at the UK Chamber last September.  Following on from this, the Chamber prepared a publication, ‘The GDPR: Guidance to Shipping Companies’, which was published by Witherby Publishing in June this year.

Following requests from members, the Chamber will host a follow-up workshop entitled ‘The GDPR – Implementation and Next Steps’ on the afternoon of Thursday 18 October. The key purposes of the workshop will be to introduce the guidelines and hear members’ experiences of bringing their data protection procedures into line with GDPR.

Hill Dickinson’s Javed Ali will take centre stage and will provide answers to some of the most important questions that members have raised concerning the GDPR. These include how transfers of personal data between data controllers and processors inside and outside the EEA should be conducted in order to be GDPR-compliant; the use of data protection clauses in contracts and charterparties, and the link between shipboard and shore-based data protection policies.

Mr Ali will also report on Hill Dickinson’s own experiences of the application of GDPR, the role that the Information Commissioner’s Office has played since 25th May and details of prosecutions for breaches of GDPR that have been brought.

Following Mr Ali’s presentation, members will have the opportunity to put their own questions to him and raise any further matters that might have come to light since the regulation’s entry into force. Suggestions for further actions by the UK Chamber will also be welcomed.

  • For more information about the ‘The GDPR – Implementation and Next Steps’ event and to register, click here. As usual, the event is free to attend for members of the UK Chamber; a fee applies for non-members.

Violent attacks against ships and their crews have risen in 2020, with 77 seafarers taken hostage or kidnapped for ransom since January, reveals the ICC International Maritime Bureau’s (IMB) latest piracy report.

The Gulf of Guinea off West Africa is increasingly dangerous for commercial shipping, accounting for just over 90% of maritime kidnappings worldwide. Meanwhile ship hijackings are at their lowest since 1993. In total, IMB’s Piracy Reporting Centre (PRC) recorded 98 incidents of piracy and armed robbery in the first half of 2020, up from 78 in Q2 2019.

The increasing threat of piracy adds to hardships already faced by hundreds of thousands of seafarers working beyond their contractual periods due to COVID-19 restrictions on crew rotations and international travel.

“Violence against crews is a growing risk in a workforce already under immense pressure,” says IMB Director Michael Howlett. “In the Gulf of Guinea, attackers armed with knives and guns now target crews on every type of vessel. Everyone’s vulnerable.”

So far this year, 49 crew have been kidnapped for ransom in the Gulf of Guinea and held captive on land for up to six weeks. Rates are accelerating, with 32 crew kidnapped in the past three months alone. And incidents are happening further out to sea: two-thirds of the vessels were attacked on the high seas from around 20 to 130 nautical miles off the Gulf of Guinea coastline.

IMB PRC urges vessels to report any attacks promptly. It can then liaise with coastal agencies, international navies and vessel operators, encouraging a quick response to deter piracy and armed robbery and improve the security of seafarers. IMB PRC also broadcasts to shipping via GMDSS Safety Net Services and email alerts to Company Security Officers.

“We need to change the risk-to-reward ratio for pirates operating within the Gulf of Guinea. Without an appropriate and proportionate deterrent, pirates and robbers will get more ruthless and more ambitious, increasing the risk to seafarers,” says Howlett.

In one recent case commended by IMB, the Nigerian Navy responded promptly to a distress call from a fishing vessel boarded and hijacked by armed assailants in Ivory Coast waters. As a result the crew were saved and the ship was prevented from being used as a possible mother vessel to carry out further attacks.

In another incident, a product tanker was attacked while underway around 127 nm off Bayelsa, Nigeria. Eight armed pirates kidnapped ten crew as well as stealing cash, personal valuables, and ship’s property. IMB PRC contacted regional and international authorities, and a Nigerian Navy Security Vessel was dispatched. A nearby sister vessel helped the four remaining crewmembers to sail the tanker to a safe port. The kidnapped crew were released three weeks later.

Singapore Straits

The Singapore Straits saw 11 incidents in the first half of 2020, raising the risk of collisions in this busy shipping channel, especially at night. Although most are opportunistic – low-level attacks that are aborted once the alarm is sounded –­­­­­­­ two reports in May 2020 indicated crew were threatened with knives, taken hostage and injured.

There were ten attacks in Indonesian anchorages and waterways in Q2 2020, up from five in Q1 2020.

Americas – Call for more reporting

IMB is recording more incidents in new areas of Latin America, but says many attacks go unreported, making the problem more difficult to tackle.

The four attacks that were reported in Mexico all targeted offshore vessels and happened within a span of 11 days in April. One anchored accommodation barge was boarded by six people wearing face masks and armed with automatic weapons and pistols. They attempted to enter and opened fire, leading to an injured crewmember and three damaged windows. The Master raised the alarm, sent a distress message, informed the Chief Security Officer, and the crew mustered in the citadel. The incident was reported to the Marine Control and a naval boat was dispatched, but the attackers escaped with the barge’s high value project equipment.

Incidents continue to be reported off Callao Anchorage, Peru, while vessels off the coast of neighbouring Ecuador have recorded incidents each year since 2017, with at least three container ships attacked while underway in Q2 2020. In one case, two crew were taken hostage for the duration of the robbery and in another the perpetrators fired on the ship when they were unable to gain access.

Somalia

No incidents were reported off Somalia. Vessels are urged to continue implementing Best Management Principles (BMP5) recommended practices while transiting these waters. The Somali pirates still maintain the capability for carrying out attacks.

IMB Piracy Reporting Centre

Since 1991, the IMB PRC’s 24-hour manned center remains a single point of contact to report the crimes of piracy and armed robbery. The Centre not only assists ships in a timely manner, it also provides the maritime industry, response agencies and governments with transparent data received directly from the Master of the vessel under attack, or its owners.

Source: iccwbo


LONDONJuly 15, 2020 /PRNewswire/ — Since rolling out in May 2018, there have been 340 GDPR fines issued by European data protection authorities. Every one of the 28 EU nations, plus the United Kingdom, has issued at least one GDPR fine.

GDPR tracking dashboard from PrivacyAffairs displays official data from national data protection bodies to monitor the status of GDPR fines.

Whilst GDPR sets out the regulatory framework that all EU countries must follow, each member state legislates independently and is permitted to interpret the regulations differently and impose their own penalties to organisations that break the law.

Nations with the highest fines:

  • France: €51,100,000
  • Italy: €39,452,000
  • Germany: €26,492,925
  • Austria: €18,070,100
  • Sweden: €7,085,430
  • Spain: €3,306,771
  • Bulgaria: €3,238,850
  • Netherlands: €3,490,000
  • Poland: €1,162,648
  • Norway: €985,400

Nations with the most fines:

  • Spain: 99
  • Hungary: 32
  • Romania: 29
  • Germany: 28
  • Bulgaria: 21
  • Czech Republic: 13
  • Belgium: 12
  • Italy: 11
  • Norway: 9
  • Cyprus: 8

The second-highest number of fines comes from Hungary. The National Authority for Data Protection and Freedom of Information has issued 32 fines to date. The largest being €288,000 issued to an ISP for improper and non-secure storage of customers’ personal data.

UK organisations have been issued just seven fines, totalling over €640,000, by the Information Commissioner. The average penalty within the UK is €160,000. This does not include the potentially massive fines for Marriott International and British Airways that are still under review.

British Airways could face a fine of €204,600,000 for a data breach in 2019 that resulted in the loss of personal data of 500,000 customers.

Similarly, Marriott International suffered a breach that exposed 339 million people’s data. The hotel group faces a fine of €110,390,200.

The largest GDPR fine to date was issued by French authorities to Google in January 2019. The €50 million was issued on the basis of “lack of transparency, inadequate information and lack of valid consent regarding ads personalisation.”

Highest fines issued to Private individuals:

  • €20,000 issued to an individual in Spain for unlawful video surveillance of employees.
  • €11,000 issued to a soccer coach in Austria who was found to be secretly filming female players while they were taking showers.
  • €9,000 issued to another individual in Spain for unlawful video surveillance of employees.
  • €2,500 issued to a person in Germany who sent emails to several recipients, where each could see the other recipients’ email addresses. Over 130 email addresses were visible.
  • €2,200 issued to a person in Austria for having unlawfully filmed public areas using a private CCTV system. The system filmed parking lots, sidewalks, a garden area of a nearby property, and it also filmed the neighbours going in and out of their homes

For questions regarding the research or more information about the team behind the report, contact Joe Robinson at joe@privacyaffairs.com or visit PrivacyAffairs.


Maritime Cyber Security experts, Epsco Ra are proud to announce RaEDR (RA Endpoint Detection and Remediation) a comprehensive cybersecurity monitoring and defense solution.

Inspired by the necessity for remote working brought about by the COVID 19 pandemic and the resulting huge worldwide increase in cyber-attacks, Epsco Ra have developed a new next-generation solution in the form of a cloud-hosted application which functions as an agent on each computer in a network (or on a UTM when possible).

Epsco Ra’s solution is easily installed on any vessel or office network, without any requirement for hardware and with no disruption to existing network or system installations.

The agents provide in-depth visibility of the system’s security posture, offering security monitoring, intrusion & threat detection, file integrity monitoring, vulnerability assessment, and incident response.

The system includes Compliance alignment with controls allowing full configuration with Governance frameworks inclusive of but not limited to NIST and GDPR.

This is all managed via an extensive user-customizable dashboard with reporting and alerting tools.

RaEDR gives our clients peace of mind in the knowledge that they have their own professional cybersecurity team without the cost of employing an in-house team.

Epsco Ra’s RaEDR service offers our clients 3rd party assurance from as little as US$25.00 per month per vessel.
Source: maritimecyprus


The GDPR has successfully met its main objectives but work still needs to be done to improve cross-border investigations, increase regulator resources and address fragmented approaches across the EU, according to the European Commission.

The review of the data protection legislation two years on highlights several areas for improvement.

One of the most pressing is the need for harmonization across the region. This is because, although the regulation must be applied across the board, it allows for member states to legislate in some areas and provide specificity in others.

This has led to the “extensive use of facultative specification clauses,” which has made for differences in areas such as the age of children’s consent across different countries, the report claimed.

This could create problems for cross-border business and innovation, especially in tech and cybersecurity innovation, the Commission said.

“A specific challenge for national legislation is the reconciliation of the right to the protection of personal data with freedom of expression and information, and the proper balancing of these rights,” it argued.

“Some national legislations lay down the principle of precedence of freedom of expression, whilst others lay down the precedence of the protection of personal data and exempt the application of data protection rules only in specific situations, such as where a person with public status is concerned.”

Other areas that need continued work include the more efficient handling of cross-border cases and the disparity in “human, financial and technical” resources between many regulators.

This echoes a report issued in April by web browser firm Brave, which claimed that regulators are unable to match the financial might of technology giants like Google and Facebook, which puts them at a distinct disadvantage in investigations.

Only five of Europe’s 28 GDPR regulators have over 10 tech specialists, while half have budgets of under EUR5m. The UK’s ICO, which is the largest and most expensive watchdog to run, has only 3% of its 680 staff focused on tech issues, the report claimed.

Stewart Room, global head of data protection and cybersecurity at DWF, took issue with the Commission’s claim that GDPR has “successfully met its objectives of strengthening the protection of the individual’s right to personal data protection and guaranteeing the free flow of personal data within the EU.”

“A key problem to note is that there is an absence of such evidence on data protection performance levels under the previous legal regime (the 1995 Directive), so, therefore, there isn’t a benchmark available to substantiate progress made under the GDPR,” he argued.

“In contrast, reports of personal data security breaches have not run dry, there are still structural problems in the AdTech environment and with the ceaseless progression of developments in technology, such as facial recognition and AI, there have to be doubts about the ability of the law and the regulatory system to keep up speed.”

This post European Commission: Still Work to Do on GDPR originally appeared on InfoSecurity Magazine.


Safety is critical to the tanker industry. The International Safety Guide for Oil Tankers and Terminals, or ISGOTT as it is now widely known, has become the standard reference work on the safe operation of oil tankers and the terminals they serve. To remain so, the Guide must keep abreast of changes in vessel design and operating practice and reflect the latest technology and legislation.

ISGOTT was first published in 1978 by combining the Tanker Safety Guide (Petroleum) published by the International Chamber of Shipping (ICS) and the International Oil Tanker and Terminal Safety Guide published on behalf of the Oil Companies International Marine Forum (OCIMF). This Sixth Edition updates and replaces the 2006 Fifth Edition and has been reviewed by OCIMF and ICS together with the International Association of Ports and Harbors (IAPH). Support has also been provided by other industry associations, including INTERTANKO, the Society of International Gas Tanker and Terminal Operators (SIGTTO) and the Society for Gas as a Marine Fuel (SGMF), as well as specialists in topics such as human factors.

This new edition covers a range of topical issues including gas detection, the toxicity and the toxic effects of petroleum products (including benzene and hydrogen sulphide), the generation of static electricity and stray currents, fire protection and the growing use of mobile electronic technology.

In addition, the opportunity was taken to include new topics or to significantly reappraise topics previously covered that have undergone a shift in emphasis since the Fifth Edition. These include:

  • Enclosed space entry
  • Human factors
    Safety Management Systems (SMSs), including complementary tools and processes such as permits to work, risk assessment, Lock-out/Tag-out (LO/TO), Stop Work Authority (SWA) and their linkage to the underlying principles of the International Safety Management (ISM) Code
  • Marine terminal administration and the critical importance of the tanker/terminal interface
  • Alternative and emerging technologies
  • Bunkering operations, including the use of alternative fuels such as Liquefied Natural Gas (LNG)
  • Cargo inspections
  • Alignment with OCIMF’s recently revised Mooring Equipment Guidelines
  • Maritime security and linkage to both the International Ship and Port Facility Security (ISPS) Code and industry’s maritime security Best Management Practices (BMP).

The Ship/Shore Safety and Bunkering Operations Checklists have also been completely revised to reflect changes in the understanding of the impact of human factors in their effective use.

Source: maritimecyprus


Company DETAILS

SHIP IP LTD
VAT:BG 202572176
Rakovski STR.145
Sofia,
Bulgaria
Phone ( +359) 24929284
E-mail: sales(at)shipip.com

ISO 9001:2015 CERTIFIED