Some of the biggest names in Big Tech may be considering pulling out of Hong Kong. The reason is a recently-implemented "doxxing" privacy law developed in the wake of the 2019 pro-democracy protests.
Data Protection
Certain types of personal data are very valuable to criminals, and can be very damaging to an individual or business if it falls into the wrong hands. As the world becomes more digital and more connected, more of this sort of data is generated and passed between various sources on a regular basis.
Government regulations and supervisory authorities aren’t just about keeping irresponsible parties in line. They also provide vital security guidance to every type of organization that handles sensitive personal, business or government information.
Data protection regulations also ensure that the end user has a transparent view of and a say in the processing of personal data. These safeguards play a significant role in everything from the preservation of civil rights to ensuring that democratic institutions function properly.
Some types of personal data are clear candidates for regulation: medical records, banking information, national ID numbers and so on. But some of these regulations also cover items that might seem relatively innocuous at first glance: home addresses, email addresses, website profile information and so on. For example, the European Union General Data Protection Regulation (GDPR) has stipulations about anything that is unique to an individual to include phone numbers and social media accounts. People have varying levels of privacy preference with these items, but they are often protected by regulation because they can be used for targeted scams and attempts at identity theft.
Given that regulations often take the size and customer count of businesses into consideration in terms of penalties and the scope of protection of personal data, compliance is particularly important for enterprise-scale organizations. You do not necessarily have to have an active business presence in a country or region; simply storing data on or moving it through servers there may subject you to their data protection rules.
To not only comply with privacy regulations but honor customer requests for their right to be forgotten in the required time, your data storage, indexing and discovery needs to be well organized and maintained.
China's new data laws formalizes a legal architecture for Chinese government control over domestic data; a basis for the CCP to claim – and claim oversight over – information, including that of private companies.
Proposed new set of rules would force Chinese tech companies with over one million users to apply for special cybersecurity approval before listing, citing the national security risks associated with that data falling into the hands of foreign governments.
WeChat has suspended new user registrations until at least "early August" as it rolls out a security upgrade, assumed to be prompted by recent Chinese laws regarding the storage and transmission of the personal data of the country's citizens.
The Luxembourg CNPD has issued Amazon the largest GDPR fine to date, hitting the online shopping giant with a penalty of €746 million (about $887 million) over its targeted advertising practices.
China’s new GDPR-style data protection law does almost nothing to curb the state's unfettered access to data stored within the country, but does sharply limit the ways in which tech firms can handle and share it.
Germany's data protection authority has determined that Zoom's data transfers to the U.S. are in violation of the terms of the GDPR in light of the Schrems II ruling, and has issued a formal warning.
The UK is now firming up what its data handling and privacy rules will look like post-Brexit. The lead item is an announcement of partnerships with countries that have lost "trusted partner" status in the EU, most notably the United States.
Facebook, Google and Netflix are facing fines and actions for privacy violations, with Facebook assessed the second-largest amount in the country's history for its treatment of facial recognition templates.