Data Protection News, Insights and Resources

The Ohio law represented a novel approach to data protection by providing safe harbor if the entity’s cyber security program conforms to industry recognized cybersecurity frameworks or federal regulations cited in the Act.

Big tech companies are pushing for watered-down privacy regulations that would largely permit them to continue doing business as usual. There is reason to suspect that these tech companies now view federal privacy regulations as a way to construct barriers and moats around their core business.

The €50 million fine against Google is a sign that GDPR grade transparency is here to stay. Legalistic privacy policies will always be with us of course, but the privacy world is currently primed to embrace a new “layered notice” paradigm for delivering privacy information to users on their terms.

Germany set a new precedent with an antitrust ruling against Facebook, forcing the company to make major changes to their data collection practices – German users are to be given a greater degree of notice and choice in how their data is used.

The Google GDR fine has demonstrated that most historical data, analytics & AI, and decentralized processing is illegal under the GDPR. Companies must focus on more than consent to legally process analytics and AI when those processes cannot be described with the required specificity and voluntariness at the time of data collection.

Google received €50 million in GDPR fines from French regulator CNIL for failing to adequately inform users about their data collection practices, and not giving users enough control over how their information is used. What are the lessons learnt?

Citing a potential violation of the GDPR, privacy activist Max Schrems and his digital rights nonprofit organization noyb have filed GDPR complaints against eight major streaming companies, including YouTube, Netflix, Spotify, Apple and Amazon.

The GDPR has been in effect for a few months now, and it’s safe to say most businesses are familiar with it by now. It’s also likely a safe bet that at least a few view it as an inconvenience. Truth is, it’s anything but. From a business perspective, privacy regulations are one of the best things that could possibly exist - here’s why.

Second annual review of the EU-U.S. Privacy Shield went better than the first, but the European Commission is still waiting on the U.S. government to nominate a permanent Ombudsperson to handle potential complaints and requests from EU citizens.

While the proposed Data Care Act isn't quite a full-on EU GDPR equivalent, the bill still aims to bring the tech industry's practices more in line with current approaches for handling sensitive personal information.