The country’s leading ride hailing app is reportedly close to coming in line with the new data compliance requirements. Didi had about 377 million active users prior to its delisting from China app stores.
Data Protection
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
China's PIPL mirrors the GDPR in terms of many of its core requirements and penalties, but some requirements are nuanced and and may require a refresh review of the existing company policies and procedures, which may create additional operational burdens.
American lawmakers may once again be ready to seriously take up the idea of a federal privacy law. A report about the bill was quickly followed by publication of a discussion draft for public view.
The IAB project uses a single protocol that presently assists digital advertising with existing European Union (EU) and California Consumer Privacy Act (CCPA) privacy compliance requirements.
The EU Digital Markets Act (DMA) appears headed for adoption in May. Companies providing “core platform services”, as well as those potentially receiving data from such companies, should understand not only what the DMA requires, but also its impact on existing obligations under the GDPR.
Spanish data protection authority AEPD called the two infringements that led to the GDPR fine "very serious." Both relate to Google's transfer of EU citizen data to the US.
By 2024, it’s likely that almost every U.S. state will have its own data privacy regulations. Businesses getting prepared now are barely ahead of the curve; those that put it off till the laws hit the market will have to scramble to keep up.
A new data reform bill included in the 2022 Queen's Speech promises a "pro-growth" framework of greater benefit to both businesses and citizens of the UK. It could put an end to the data adequacy decision that allows personal data to continue flowing between it and the EU.
With increasing privacy regulations, how exactly can organizations prepare for the looming privacy-driven era of digital advertising? It starts with baking privacy and transparency into all facets of operations.
Digital Services Act would bring new restrictions on how targeted advertising can use sensitive personal information and a requirement that the inner workings of recommender algorithms be visible to the public.