The UK ICO guidelines specify that workplace monitoring must be disclosed to employees (along with its 'clearly defined' purpose), and the 'least intrusive' method must be used to accomplish the stated purpose.
Data Protection
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
TikTok has already faced several actions involving the privacy and security of children, who have always been one of the biggest demographic groups on the platform. A new FTC investigation has raised the issue again.
A new consumer privacy act has been signed into law in Utah and takes effect as 2023 ends, the fourth state bill of this nature to be passed. It is the most business-friendly of the bunch.
Failure to strictly follow children's privacy laws on the Xbox Live gaming service is about to cost Microsoft a substantial amount of money, as the company has settled a FTC case with a $20 million fine for inappropriate collection and storage of personal data.
Meta is facing a $220 million fine in Nigeria under data protection laws passed in 2023, the first major fine for the company in the region. The fine follows an extensive investigation that lasted 38 months, dating back to well before the current Data Protection Act was signed into law.
The fine centers on TikTok's failure to police underage users that sneak onto the platform, and collection and use of children's data without required parental consent. ICO says that TikTok should have been aware of some one million underage users.
The GDPR fine was sparked by a round of media reports in early 2021 documenting how the personal data of over 530 million Facebook users was left open to data scraping for an extended period thanks to faults in certain tools.
Amazon was penalized for excessive employee monitoring, insufficient data minimization, and failing to meet transparency and security requirements. Much of the GDPR fine centers on the hand scanners that are issued to warehouse employees.
One of the world's largest adtech companies is facing a €40 million GDPR fine over failure to collect proper consent for personal information processing. Criteo's targeted advertising program was also cited for transparency and right of access shortcomings.
Underage Instagram users were opting to ignore privacy settings and work around them by opening business accounts, leading to a GDPR fine of €405 Million by the Irish DPC.