Even though NYPA has failed to pass legislation, all is not lost for data privacy as the introduction of Dashboard Act will require commercial data operators to disclose and assess the value of data collected from users.
Data Protection
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
With the LGPD (the Brazilian Data protection Law) coming into force in August 2020, how can companies address the challenges of customer experience?
Company’s IT department plays a critical role in data protection, however HR is equally important to handle human side of business through GDPR compliance, exit strategies and privacy policies.
Virginia is the latest state to adopt a consumer privacy law, with the Virginia Consumer Data Protection Act (CDPA) signed by the governor in early March. The bill adopts some of the terms seen in the CPRA.
There was some question as to whether Schrems II would extend to the similar Swiss-US Privacy Shield agreement, and that question has now been answered.
The pace of cross-industry fraud is accelerating and becoming more costly and this is exacerbating the identity theft problem. New fraud study from LexisNexis reports that 84% of organizations had been the victim of cross-industry fraud.
Recent ruling by the CJEU has given the region's data protection authorities a much greater ability to pursue cases against Big Tech companies that are not headquartered in their territory.
The EU Digital Markets Act (DMA) appears headed for adoption in May. Companies providing “core platform services”, as well as those potentially receiving data from such companies, should understand not only what the DMA requires, but also its impact on existing obligations under the GDPR.
IoT regulations without real penalties will let manufacturers and service providers continue their focus on ease of use at the expense of security and privacy best practices.
The implementation of CPRA and introduction of civil penalties for theft of login information should encourage businesses to establish a strong data security posture management (DSPM) strategy. This is a key first step to protect and monitor personal information more effectively and allow consumers to control data sharing.