Updates to Quebec’s Act to Modernize Legislative Provisions Respecting the Protection of Personal Information, more commonly known as “Law 25,” now requires businesses to respect consumer preferences and increase transparency surrounding the collection and use of their personal data.
Data Protection
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
Meta is now looking at an EU ban after the EDPB reached a decision on a case referred from Norway. The terms of the decision require Meta to stop behavioral advertising across most of the EU by November 10.
Employers must familiarise themselves with India's new Digital Personal Data Protection Act, and assess its implications for employee data. With compliance likely to require significant administrative and technical overhauls within organizations, it is prudent to begin readiness evaluations early.
A UK GDPR fine that would have cost Clearview AI £7.5 million fine has been overturned, as an appeals court found that lead regulator ICO was outside of its jurisdiction in penalizing the foreign facial recognition firm.
As the breadth and complexity of data grows, so does a company's vulnerability. A universal data authorization standard would make retrieving and using data more accessible for those with the appropriate authorization, while safeguarding sensitive data.
The Delete Act (SB 362) expands an existing right under California state law to have personal data deleted, but streamlines the process so that one request will be sent to all data brokers.
The UK ICO has wrapped up a preliminary investigation into Snap's AI chatbot, and has indicated that it is failing to adequately address children's privacy risks. There are numerous concerns about AI chatbots that are not yet resolved, but children's privacy seems to have driven much of the early action from regulators.
The UK ICO guidelines specify that workplace monitoring must be disclosed to employees (along with its 'clearly defined' purpose), and the 'least intrusive' method must be used to accomplish the stated purpose.
Canada Post has been scanning address data from the outside of envelopes it delivers and selling it to third-party mail marketing lists. The Office of the Privacy Commissioner of Canada (OPCC) found that this violates a Privacy Act requirement to obtain authorization from individuals before collecting information in this way.
Small businesses with under AUD 3 million annual turnover have been exempt from Australia's Privacy Act terms to date, but that has been taken off the table in a new round of reforms that could become law in 2024.