The ADPPA is the first nationwide US privacy bill that stands a chance of being legislated and changing the face of the entire US privacy landscape. There is a general consensus that the proposed data minimization guidelines could significantly reshape the processes and procedures businesses will utilize to collect consumer data.
Data Protection
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
Germany is querying ChatGPT's GDPR compliance in terms of required access to stored personal information, its efforts to inform data subjects of their rights under the law, and how it is handling the data of minors.
Tech giants are facing hefty fines after France's CNIL ruled that their cookie consent processes were too confusing and difficult. Central to the case was the use of "dark patterns" by each site.
noyb's GDPR complaint asserts Meta’s privacy fee makes it impossible for existing service users to withdraw consent without paying. That in turn flies in the face of a GDPR stipulation (found in Article 7).
At a proposed value of £183 million, British Airways is facing the highest record of GDPR fines, Britain's DPA is making it clear that companies should protect customers’ data or be ready to pay.
This article is based on a presentation made during the Data Privacy Asia 2016 conference held on 9-11 November 2016 by well-known and widely respected information security, privacy and compliance expert Rebecca Herold. Rebecca addresses how IT leaders are increasingly challenged by the myriad of physical, legal, political and logical considerations for data residency.
U.S. push for COPPA update and UK publication of 16-point draft code of practice for children’s privacy show a move towards stronger data protection laws against tracking and monitoring of children.
A new consumer privacy act has been signed into law in Utah and takes effect as 2023 ends, the fourth state bill of this nature to be passed. It is the most business-friendly of the bunch.
The CCPA went live at the start of 2020, and study of data subject requests from the first half of its first year indicates that users are primarily using it to opt out of the sale of personal information.
Privacy activism group noyb, which has made headlines for its high-profile cases against Facebook in the EU, has brought a corruption complaint against the Irish DPC over its handling of a case that dates back years.