OpenLobby.EU
Explore

Trellix

Trellix is one of the world’s leading independent cybersecurity companies.

Lobbying Activity

Meeting with Despina Spanou (Cabinet of Vice-President Margaritis Schinas)

10 Sept 2021 · Cybersecurity and ransomware

Meeting with Despina Spanou (Cabinet of Vice-President Margaritis Schinas), Natasha Bertaud (Cabinet of Vice-President Margaritis Schinas)

25 Jun 2021 · Ransomeware

Meeting with Vangelis Demiris (Cabinet of Vice-President Margaritis Schinas)

2 Dec 2020 · Cybersecurity

Meeting with Despina Spanou (Cabinet of Vice-President Margaritis Schinas), Vangelis Demiris (Cabinet of Vice-President Margaritis Schinas)

28 May 2020 · Briefing on McAfee’s COVID-19 cyber-threat landscape analysis

Meeting with Daniel Braun (Cabinet of Vice-President Věra Jourová), Wojtek Talko (Cabinet of Vice-President Věra Jourová)

27 Apr 2020 · Disinformation

Response to Report on the application of the General Data Protection Regulation

21 Apr 2020

McAfee provides encryption, end-point and mobile protection and cloud security solutions to combat cyberattacks, malware, ransomware and botnet infections. Some of McAfee services are considered “essential outsourced services” and have data transfers. The need for standardised Technical and Organizational Measures (TOMs). The legal and information security requirements should be harmonized to facilitate Cloud Service Providers’ (CSPS) compliance with Regulated End User requirements (EBA, EIOPA). We propose using standardized TOMs that are technology neutral; to regulate the framework of audits; and outsource to independent companies as audit costs are a major burden to smaller companies and CSPs must be able to provide certificates in lieu of on-site audits. The Model Clauses (SCCs) need to be updated as controllers and processors have had to negotiate their own interpretations of the GDPR’s requirements. This, along with difficulties in managing third-party vendors, has resulted in tremendous compliance burden that can be alleviated with the issuance of GDPR-ready SCCs. 1. TOMs: Too much time is spent negotiating these between controllers and processors, where each party insists on using their standard TOMs. DPAs should be encouraged to develop a set of TOMs that cover the key minimum standards. 2. Retention period: Introducing a 3-year backstop and offering protections for companies that correctly delete the data, but may require it for litigation, after the contract terminates is justified. One of the conflicts within the GDPR is the data subject right to deletion. If the deletion is granted, an organisation may have difficulty defending future claims. 3. Audit: The audit right provided in the SCCs and in certain regulations such as EBA or EIOPA Guidelines is too broad, without definition, limitation, or distinction between general audits and those following data breach. This can be solved by developing (1) an audit mechanism for supervisory authorities (2) and for the controller (one annually and another following a data breach). The right to audit should vary depending on the circumstances that caused the audit. If the purpose of audit is to prove compliance, then a requirement for an audit plan, sufficient advance notice, and use of mutually agreed third-party auditors should be handled via one mechanism.The introduction of GDPR-compliant 3rd party certifications could resolve this issue. An audit following a data breach, by contrast, will likely require an different process due to the urgency around post-incident compliance, and this should be done by a single independent auditor, and not all customers coming on-site. GDPR impact on PSD2 As a CSP, McAfee’s diverse customers include financial institutions which need to the PSD2. Whilst PSD2 requires financial institutions to provide access to all customers’ personal data in order to stimulate competition and innovations, the GDPR’s goal is to give back control of personal data to customers. These differing rules create discrepancies and force financial institutions to go beyond the GDPR, and are also shown in financial institutions relationships with CSPs. When implementing GDPR in the financial sector the processing of criminal data for the purposes of knowing your customer (KYC) presents challenges. Article 10 requires data controllers processing criminal records to rely on legitimate interest. KYC obligations and the increased threat of sanctions have led banks to strengthen the collection, analysis and storage of personal data concerning individual customers, executives and shareholders, increasing the volume of data used. GDPR has a major impact on KYC obligations: a) to what extent does a KYC investigation need to be fully transparent? b) How can banks ensure data subject access ? c) to what do customers have a right to access the data they disclosed to banks in the context of the commercial relationship?; d) What retention period applies?
Read full response

Meeting with Anthony Whelan (Cabinet of President Ursula von der Leyen)

12 Dec 2019 · Cybersecurity, public-private cooperation

Meeting with Vivian Loonela (Cabinet of Vice-President Andrus Ansip)

11 Apr 2019 · 5G security, cybersecurity

Meeting with Carl-Christian Buhr (Cabinet of Commissioner Mariya Gabriel)

1 Oct 2018 · Cyber risk Management Frameworks ; EU cyber security Act proposal