IAPP Privacy Advisor https://iapp.org/news/privacy-advisor/ Privacy Advisor - Original reporting from IAPP staff and contributed features from IAPP members. Privacy community mourns Kurt Wimmer, 1959–2021 https://iapp.org/news/a/privacy-community-mourns-kurt-wimmer-1959-2021 https://iapp.org/news/a/privacy-community-mourns-kurt-wimmer-1959-2021 Respects and tributes are pouring out for longtime privacy professional Kurt Wimmer, CIPP/E, CIPP/US, who died April 2 at age 62 following a bout with cancer. Wimmer most recently co-chaired Covington & Burling’s global data privacy and cybersecurity practice in Washington, D.C., but his overall presence in the privacy space left an indelible mark.

[caption id="attachment_424880" align="alignright" width="300"] Kurt Wimmer, CIPP/E, CIPP/US[/caption]

"He was a brilliant lawyer, a talented writer and a longstanding and trusted adviser to many of our clients," said IAPP Senior Westin Research Fellow Jetty Tielemans, a colleague of Wimmer's for years at Covington. "Kurt was passionate about his work and accepted nothing less than excellence from every member of the team. He was an exceptional colleague and a mentor to many of our younger lawyers.

"But perhaps most importantly, Kurt was a warm and caring person. He made you feel welcome and an important part of the team, no matter how small your contribution to a project. He was confident in his abilities and calm and resilient in moments of stress."

Wimmer described himself as a "privacy and technology lawyer with the great good fortune to be working with the companies that I love and that present constantly evolving challenges." Among those clients were Facebook, Microsoft, Samsung and other multinationals, in addition to non-traditional clients, like the National Football League and National Hockey League.

Wimmer also enjoyed photojournalism and music, often pitting the two passions together. He noted in his biography that he started his career as a photojournalist and continued with freelance photography, "especially music (back when we could go to concerts.)" He even documented the "Juggalo March on Washington, DC" in 2017. 

He took a hiatus from his time at Covington to serve as senior vice president and general counsel of media company Gannett and was also a board member at nonprofit research foundation the Media Institute, chairing its First Amendment advisory council. 

"We are extremely saddened by the passing of our good friend Kurt Wimmer," Media Institute President Rick Kaplar said in a statement. "We had the pleasure of working with Kurt since 1999, and during that time he advanced the mission and goals of the Institute in myriad ways. We will miss his fine legal mind and his principled approach to public policy. But most of all we will miss the good and decent person he was, and the trusted friend he became.”

Tielemans noted Wimmer was a mentor to many younger lawyers, saying Covington "heard many testimonies from lawyers who set their first steps on the long road to a successful legal career under Kurt's guidance."

U.S. Naval Academy Assistant Professor of Cybersecurity Jeff Kosseff, CIPP/US, was among those who were drawn to Wimmer's guiding light.

"Working with Kurt on a project did not feel like work because I was always learning so much from him," said Kosseff, who cut his teeth in the legal field while working under Wimmer at Gannett and Covington. "He had a unique mix of expertise in First Amendment law and privacy law, and that really made him an exceptionally well-rounded practitioner. And he was the kindest person I've ever worked with. He took a sincere interest in all of the associates' professional development and personal well-being."

Kosseff lauded Wimmer's generosity, recalling when he was putting the finishing touches on his Section 230 book, "The Twenty-Six Words That Created the Internet," and reached out to Wimmer to help with some clarifications.

"There were a few legal details that I wanted a second opinion on, so I asked Kurt to look them over, as he was one of the nation's leading experts on digital speech law," Kosseff explained. "Rather than only giving me feedback on the few questions I asked, within a few days he sent pages of incredibly helpful suggestions for the entire manuscript. I can't even imagine how much time it took him to do this."

The kindness Wimmer showed extended beyond professional courtesies. Former U.S. Deputy Chief Technology Officer Nicole Wong, who first got to know Wimmer when they both served on the American Bar Association's Forum on Communications Law Governing Committee, remembered one of those non-business moments she shared with Wimmer in Las Vegas, Nevada, during the early 2000s.

"I had just come back from maternity leave with my first child. Kurt, as always, was warm and welcoming," Wong said. "In his soft-spoken voice, he told me how much fun it is to be a parent and that he was so excited to take a helicopter tour of the Grand Canyon with his then-teenage son later that day.

"Kurt answered every email, every call asking for help or advice, from where to send my kids to school to navigating global internet regulations. Even when he must have been impossibly busy, he was always gracious, kind and generous. There are lots of brilliant lawyers, but Kurt modeled being a whole person."

Photo by Yousef Espanioly on Unsplash

2021-04-08 10:04:43
CDPO/BR: una nueva certificación para una nueva era de protección de datos en Latinoamérica https://iapp.org/news/a/cdpo-br-una-nueva-certificacion-para-una-nueva-era-de-proteccion-de-datos-en-latinoamerica https://iapp.org/news/a/cdpo-br-una-nueva-certificacion-para-una-nueva-era-de-proteccion-de-datos-en-latinoamerica "It was all a dream…" —Christopher “Biggie” Smalls (conocido también como The Notorious B.I.G.) en su canción Juicy)

En primer lugar, espero que usted, su familia y amigos queridos estén a salvo y con salud mientras leen esta nota. Estamos en 2021 y el mundo se encuentra en medio de una enorme pandemia con efectos significativos en los entornos políticos y legales de América Latina y Brasil.

En el momento en que escribo esto, Brasil ha registrado más de 332.000 muertes debido a complicaciones relacionadas con el COVID-19. También me informaron que en el estado de São Paulo—la capital empresarial de Brasil y lugar donde vive la mayoría de nuestros profesionales de la privacidad—, murieron 74.652 ciudadanos, algunos sin acceso a cuidados paliativos adecuados. Por lo tanto, todas nuestras oraciones y solidaridad están con aquellos compañeros de privacidad que perdieron amigos, familiares y personas queridas.

A pesar de todo, y en medio de uno de los mayores desafíos de salud del mundo, alguna vez fue difícil imaginar que el Congreso brasileño sancionaría, y la Oficina Presidencial permitiría, en septiembre de 2020, la aplicación inmediata de la protección de datos de Brasil mediante la Lei Geral de Proteção de Dados Pessoais (Ley Nº 13709/18 o LGPD, por sus siglas en portugués).

Incluso con el período de gracia de 2 años para la LGPD de Brasil, que comenzó en 2018, muchos políticos locales querían posponer esa fecha debido a la pandemia. Sin embargo, con la ayuda de una floreciente comunidad local de protección de datos, la pandemia se interpretó como una oportunidad para más bien acelerar los esfuerzos que abarcarían las necesidades de privacidad inmediatas de nuestra sociedad y, el 18 de septiembre de 2020, la LGPD se hizo plenamente aplicable.

Esta misma comunidad de privacidad emergente es la razón principal por la que la IAPP decidió lanzar, en 2021, un programa de certificación único, adecuado para los profesionales de privacidad brasileños. En los últimos años, la membresía de la IAPP ha aumentado significativamente en Brasil, debido a las principales comunidades y grupos de interés formados para participar en el debate del texto final de la LGPD.

Desde unos pocos miembros en eventos internacionales (incluido yo) hasta cientos de colegas en eventos locales (y ahora webinars) manejados por nuestros audaces capítulos locales de KnowledgeNet en Brasil, era natural concluir que el interés en la IAPP y asuntos de protección de datos aumentó significativamente en nuestro país.

En unos meses, lo que era solo una visión, y tal vez un sueño para nosotros profesionales brasileños de privacidad, comenzó a hacerse realidad. Como parte de la expansión global de la IAPP, la LGPD posicionó a Brasil como una prioridad y, para hacer realidad este sueño, se formó un equipo de profesionales de la IAPP y otros expertos en la materia (subject matter experts o SMEs, por sus siglas en inglés) para abarcar temas de privacidad en Brasil.

Si bien este grupo de SMEs fue asignado para analizar profundamente los asuntos de privacidad brasileños y la LGPD, el propio equipo de la IAPP comenzó a trabajar arduamente en cada tema, ya sea grande o pequeño, para construir un programa de certificación con los mismos estándares de calidad y sustancia que hicieron la IAPP el gold standard para certificaciones internacionales de privacidad en todo el mundo.

Profesionales de varias áreas y equipos de la IAPP (marketing, educación, atención al cliente, liderazgo y otros) están trabajando sin descanso en esta nueva certificación, y estamos seguros de que la CDPO/BR abrirá una nueva era para los profesionales de la privacidad en Brasil y permitirá que ellos participen activamente en la comunidad de profesionales de privacidad líder del mundo.

En pocas palabras, para obtener la certificación CDPO/BR, un miembro debe aprobar el examen CIPM existente (que ahora estará disponible en portugués brasileño) y también realizar la prueba específica sobre la LGPD y asuntos de privacidad brasileños. Esta prueba está disponible, por el momento, solo en portugués brasileño. Si un miembro aprueba ambos exámenes, puede usar por igual el distintivo CIPM y CDPO/BR. Los materiales de estudio para el CIPM también se han traducido y adaptado al portugués brasileño, para facilitar la capacitación presencial y virtual para los profesionales locales de protección de datos.

En nombre del capítulo brasileño de la IAPP, es importante no solo compartir la emoción de tener una certificación específica para Brasil, sino también agradecer a todos los que ayudaron a hacerla una realidad, incluido nuestros dirigentes en América Latina. Tengo la esperanza de que este nuevo modelo de certificación evolucione y se expanda a toda América Latina y que, en un futuro próximo, exámenes similares estén disponibles en español y cubran las leyes de nuestros países.

Es natural para nosotros latinos poner nuestra alma y corazón en cualquier tarea o proyecto importante en el que estemos involucrados. La CDPO/BR representa un movimiento audaz, y solo fue posible gracias a la pasión y el arduo trabajo de todo el equipo de la IAPP, nuestros dirigentes y voluntarios que también creen, de corazón, en este sueño y lo están haciendo una realidad.

"Stay far from timid, only make moves when your heart’s in it, and live the phrase ‘sky’s the limit’." —The Notorious B.I.G. en su canción Sky’s the Limit)

2021-04-06 09:06:36
La ética desde el diseño como mecanismo para generar confianza en el uso y tratamiento de datos personales—Parte II https://iapp.org/news/a/la-etica-desde-el-diseno-como-mecanismo-para-generar-confianza-en-el-uso-y-tratamiento-de-datos-personales-parte-ii https://iapp.org/news/a/la-etica-desde-el-diseno-como-mecanismo-para-generar-confianza-en-el-uso-y-tratamiento-de-datos-personales-parte-ii Como se señalaba en la primera entrega de este artículo, el avance tecnológico y la economía digital han mostrado, en años recientes, las consecuencias que trae consigo el tratamiento de datos personales a gran escala. Lo que hoy en día conocemos como big data se ha convertido en el nuevo mercado de información que ha permitido el crecimiento exponencial de las grandes compañías de tecnología y servicios en línea.

Uno de los grandes problemas al que nos enfrentamos sin percatarnos de ello es que debemos observar desde múltiples perspectivas las consecuencias que conlleva el tratamiento de nuestros datos personales. En función de la categoría a la que correspondan (por ejemplo, generales, patrimoniales, sensibles), el consentimiento de los titulares respecto de su tratamiento debe ser especial para la categoría de que se trate. 

En este sentido, se han implementado algunas medidas que hoy en día son identificadas como buenas prácticas o, inclusive, han alcanzado el grado de recomendaciones específicas por parte de las autoridades de protección de datos que han servido como guías de orientación para que los responsables del tratamiento de datos personales adopten mecanismos que ayuden a generar confianza en sus usuarios, como los que abarcamos a continuación: 

Privacidad por diseño

Uno de los mecanismos que puede ser implementado para cumplir con las medidas de seguridad necesarias para la protección de nuestra información personal ante la inminente recolección de datos por parte de las empresas es la privacidad por diseño, término adoptado en los años 90 del último siglo para atender los efectos crecientes y sistemáticos de las tecnologías de la información y las comunicaciones, y de los sistemas de datos en red a gran escala.

Este concepto busca disminuir los efectos nocivos de la tecnología, ya que la privacidad no puede garantizarse solo mediante la implementación de marcos regulatorios, sino que debe considerarse como una parte esencial en el desarrollo de innovaciones tecnológicas y contemplar, desde su diseño, la inclusión de políticas de privacidad claras que sean transparentes y de fácil comprensión para los usuarios, con lo cual se pretende generar confianza en los mismos.

La protección de los datos personales debe ser de extremo a extremo, durante todo el ciclo de vida de su tratamiento. Es decir, los encargados del desarrollo de la tecnología deberán considerar, desde la fase inicial de su diseño, los principios y deberes legales, así como las mejores prácticas internacionales en cuanto a la protección de datos personales y privacidad.

El análisis de datos plantea una serie de problemas y cuestiones éticas que deben tenerse en cuenta, especialmente a medida que las organizaciones comienzan a aplicar o madurar sus capacidades de big data y ciencia de datos. Así nos lo explica Giovanni Buttarelli, ex Supervisor Europeo de Protección de Datos (traducido del italiano):

"La innovación humana siempre ha sido el resultado de actividades de grupos sociales específicos y contextos específicos, que generalmente reflejan las normas sociales de la época. Sin embargo, las decisiones de diseño tecnológico no deben dictar nuestras interacciones sociales y la estructura de nuestras comunidades, sino que deben respaldar nuestros valores y derechos fundamentales." 

Ética en el tratamiento de los datos

Las medidas impuestas, derivadas de la emergencia sanitaria que enfrentamos a nivel global, son uno de los más recientes y claros ejemplos en los que podemos identificar el tratamiento de datos de salud mediante la implementación de innovaciones tecnológicas como las aplicaciones de rastreo de contactos.

La experiencia acumulada con el paso de los meses nos ha permitido detectar que en distintos países y regiones del mundo algunos gobiernos han implementado acciones que han afectado, de manera directa, la esfera más íntima de las personas mediante el uso de nueva y avanzada tecnología.

Es importante reconocer que las soluciones inmediatas, sin una clara finalidad y propósito, podrían provocar una vulneración a los derechos humanos de los individuos, el uso de nuevas tecnologías relacionadas con la aplicación de sistemas desarrollados a partir de la inteligencia artificial, los datos biométricos y los sistemas de rastreo satelital, aunados a la falta de legislación o normatividad que regule la implementación de estas tecnologías, representan hoy en día el mayor reto al que se deben enfrentar las autoridades garantes de la protección de datos personales.

Una de las soluciones tecnológicas que ha demostrado eficacia y eficiencia en la detección, atención y prevención de contagios de esta enfermedad es el uso de las aplicaciones móviles en la lucha contra la pandemia COVID-19; no obstante, no dejan de ser un blanco constante de señalamientos que han llegado a referirlas como un posible nuevo modelo de control social. 

El uso de estas aplicaciones ha generado una falsa elección entre el derecho a la salud y el derecho a la privacidad. El autor Yuval Noah Harari escribió en marzo de 2020 que «las decisiones que hagamos ahora podrían cambiar nuestras vidas en los próximos años». El mismo autor nos recuerda que «las medidas temporales tienen el desagradable hábito de superar las emergencias, especialmente porque siempre hay una nueva emergencia al acecho en el horizonte».

Estas aplicaciones, que tanto gobiernos como sector privado han puesto en marcha, son creadas con base en distintas plataformas y requieren de diferentes autorizaciones y permisos para poder funcionar en nuestros dispositivos. Uno de estos permisos, y quizás el más controversial, es el acceso a la geolocalización de nuestros móviles, ya que, ante la diversidad de protocolos y tecnologías que existen hoy en el mercado, no podríamos asegurar con certeza que nuestra información personal está siendo tratada de manera correcta.

Lo anterior, con base en los hallazgos de diversos estudios que se han realizado en torno a las aplicaciones utilizadas en el combate a la pandemia, ha demostrado que pueden variar las tecnologías, de conformidad con la aplicación que sea utilizada, ya que pueden estar basadas en protocolos centralizados o descentralizados y hacer uso de tecnologías interoperables como Bluetooth o GPS, que permitan realizar el trazado y rastreo de contactos, además de ser contenedores de información sensible relativa a nuestro estado de salud.

Al respecto, Manuela Battaglini, coautora del estudio Un marco sociotécnico para el rastreo de contactos digitales (traducido del inglés), ha señalado en diversos medios que la ética es clave para el desarrollo y puesta en marcha de estas aplicaciones y que la ética digital debe comprender tres grandes bloques:

  • La ética de los datos, refiriéndose estrictamente a la recopilación de datos;
  • La ética de los algoritmos, que corresponde al tratamiento de los datos, las decisiones automatizadas y la confección de perfiles; y
  • La ética de la puesta en práctica, que incluye las implicaciones sociales que tiene en la vida de los individuos o grupos de individuos.

De igual manera, conforme lo señala la misma autora, existen mecanismos y recomendaciones éticas dirigidas a los desarrolladores tecnológicos con la finalidad de orientarlos a cumplir, de manera cabal, con los principios y deberes en materia de protección de datos personales. Entre ellas:

  • Orientaciones para realizar evaluaciones de impacto con enfoque en derechos humanos.
  • El diseño de aplicaciones con algoritmos auditables, neutrales y transparentes.
  • Un diseño ético y libre de sesgos, que impida la discriminación de los individuos a causa de sistemas de perfilado y decisiones automáticas.

Sobre estas bases, se considera que la ética, al igual que la privacidad por diseño, es una pieza clave. Por un lado, la ética permitirá orientar al sector de innovación tecnológica para contar con infraestructura y sistemas de protección de datos personales de extremo a extremo. La confidencialidad y protección de nuestra información personal serán garantizadas mediante políticas de tratamiento de datos con base en la ética digital, siempre con un enfoque que respete derechos humanos con algoritmos transparentes y auditables que permitan una correcta rendición de cuentas por parte de los responsables. Por otro lado, la ética refuerza los marcos de actuación de las autoridades de protección de datos personales, así como las legislaciones en la materia, ya que, a mayor calidad y apego a códigos de conducta éticos y transparentes, mayor será la confianza brindada al ciudadano.

Debemos recordar que, en el caso de emergencias sanitarias, o de cualquier otro tipo que pudiera surgir, tanto la privacidad como la salud (o como el derecho humano de que se trate), son derechos fundamentales, y, por ende, existirán marcos regulatorios nacionales o tratados internacionales que los garanticen uno sin detrimento del otro.

Por lo anterior, es muy probable que en el futuro inmediato se comience a trabajar en modelos capaces de resguardar la confidencialidad y seguridad de nuestros datos personales. Al mismo tiempo, es espera que éstos permitan la correcta implementación de soluciones tecnológicas que vayan de la mano tanto con los marcos regulatorios vigentes, así como con las autoridades de protección de datos que juegan un papel de suma importancia en este tipo de contextos. Así complementarán las medidas de seguridad que permitan contribuir a la solución de cualquier tipo de crisis que se pueda enfrentar.

Como bien lo señalaba el ex Supervisor de Protección de Datos Personales Giovanni Buttarelli, «Los avances tecnológicos, el procesamiento de big data más centralizado y la interconexión de los dispositivos digitales, permiten la recopilación y el uso de datos personales de formas cada vez más complejas y opacas, lo que plantea amenazas importantes para la privacidad y la protección de datos», por lo que se debe tener presente que «La ética viene antes, durante y después de la ley», (traducido del inglés).

Ciberseguridad y datos personales

Una de las ramas que debemos tener presentes al momento de hablar sobre el entorno digital, sin duda, es la ciberseguridad. No podríamos concebir la ciberseguridad sin involucrar el tratamiento de datos personales. Se podría decir que una de las razones por la que la ciberseguridad es necesaria sería justamente para brindar la protección y adecuadas medidas de seguridad a la información y datos personales que se encuentran en el entorno digital.

Ahora más que nunca, podemos afirmar que la crisis sanitaria ocasionada por el COVID-19, nos ha enfrentado a una realidad que nos hace vulnerables y dependientes de los servicios de conexión a Internet, ante un escenario en el que hemos volcado nuestras actividades cotidianas al modo digital. La manera en que adquirimos productos y servicios, o accedemos a actividades cotidianas fundamentales, como trabajar y estudiar, ahora es desde casa; es parte de nuestra denominada nueva normalidad.

En este contexto, en donde la conexión a Internet es fundamental para el desarrollo de nuestra vida diaria, las políticas de ciberseguridad son fundamentales para salvaguardar los derechos de los individuos en el entorno digital, tal como la protección de datos personales y la privacidad. Con la implementación de estas políticas se puede aumentar la confianza de los individuos en las tecnologías digitales, ya que, a partir de la correcta implementación de medidas en materia de ciberseguridad, los usuarios se sentirán más cómodos al hacer uso de servicios en red, aplicaciones o dispositivos móviles.

De acuerdo con Moisés J. Schwartz, Gerente de Instituciones para el Desarrollo del Banco Interamericano de Desarrollo (BID), "El crimen en línea ya supone, aproximadamente, la mitad de todos los delitos contra la propiedad que tienen lugar en el mundo. A nivel agregado, las cifras adquieren aún mayor magnitud pues los daños económicos de los ataques cibernéticos podrían sobrepasar el 1% del producto interno bruto (PIB) en algunos países. En el caso de los ataques a la infraestructura crítica, esta cifra podría alcanzar hasta el 6% del PIB".

Otro dato adicional muy importante que se señala en este informe es que solo 16 países del continente americano cuentan con leyes en materia de protección de datos personales, por lo que se debe alentar a los gobiernos a contar con normatividad en la materia en favor de los ciudadanos.

De igual manera, el informe destaca que 25 países en el continente americano no han firmado la Convención de Budapest, primer tratado internacional enfocado en la lucha contra los delitos informáticos y de Internet, mejor conocido como el convenio sobre la ciberdelincuencia. Además, señala que solo 12 países del continente cuentan con una estrategia de ciberseguridad, lo cual refleja la falta de regulación y normatividad en la que deberemos centrarnos en los siguientes años en toda la región. 

Reflexiones finales

En un mundo que vive en constante cambio debido al acelerado avance tecnológico, resulta imprescindible contar con herramientas y elementos normativos que generen confianza y otorguen certeza a los individuos sobre el tratamiento de sus datos personales para, con ello, crear y fortalecer una cultura de la protección de nuestra vida privada.

Hacia el futuro en donde quizás el desarrollo de nuestras actividades cotidianas dependa en su totalidad de estar conectados en red, debemos hacer conciencia sobre el buen manejo de nuestra identidad digital para evitar afectaciones tanto a nuestra vida privada como a nuestros datos personales.

Para ello, el papel que desempeñarán las autoridades de protección de datos personales es clave, tanto en el acompañamiento al individuo como en la orientación para entes del sector privado—encargados del desarrollo y las innovaciones tecnológicas—, que en la mayoría de las ocasiones es más que inminente el uso de datos personales para su funcionamiento.

Las áreas clave de cooperación para enfrentar los desafíos que aún están por llegar en cuanto a innovación tecnológica, deben ser atendidas desde ahora para que la dinámica de actualización no se quede atrás, ni sea insuficiente para garantizar tanto el derecho a la protección de datos personales como a la privacidad.

Algunos de las áreas de oportunidad que, no solo a nivel regional sino global, deben ser atendidas y estar presentes en las agendas de trabajo de las autoridades de control y reguladores son las siguientes:

  • Convergencia normativa—establecer bases mínimas para la protección de datos personales en un mundo interconectado, que, debido a su heterogeneidad, cuenta con diversos marcos normativos que garantizan diferentes niveles de protección para un mismo derecho alrededor del mundo.
  • Cooperación internacional entre autoridades de protección de datos personales por medio de las grandes redes de autoridades existentes mediante las cuales se puede impulsar el desarrollo de orientaciones específicas en materias de interés para la comunidad internacional.
  • Colaboración y comunicación estrecha entre el sector público (reguladores) y el sector privado (innovadores) en el desarrollo de nueva tecnología que será puesta en circulación en el mercado.
  • Perfiles multidisciplinarios—no se puede entender la protección de datos desde las leyes; este derecho fundamental es un derecho en construcción que requiere conocimientos técnicos y legales para ser entendido a cabalidad.
  • Transversalidad en ciberseguridad—las políticas de ciberseguridad son fundamentales para salvaguardar los derechos de los individuos en el entorno digital, tal como la protección de datos personales y la privacidad, ya que no puede entenderse la ciberseguridad sin el tratamiento de datos personales.
2021-04-06 09:05:54
La autoridad de protección de datos de Argentina publica su Informe Anual 2020 https://iapp.org/news/a/la-autoridad-de-proteccion-de-datos-de-argentina-publica-su-informe-anual-2020 https://iapp.org/news/a/la-autoridad-de-proteccion-de-datos-de-argentina-publica-su-informe-anual-2020 La Agencia de Acceso a la información Pública (AAIP, por sus siglas) publicó su Informe Anual 2020 en el cual indica aquellos aspectos más relevantes de su gestión en lo que hace a la protección de los datos personales.

Más allá de informar sobre su gestión operativa, el informe anual recuerda que el ex Director de la AAIP—Eduardo Bertoni—renunció con efecto a partir del 1º de enero de 2021 sin que aún se haya nombrado su reemplazo a cargo de la Agencia.

Por otro lado, el reporte anual enumera los distintos expedientes administrativos procesados por la AAIP durante 2020, remarcando lo siguiente:

  • Se iniciaron 275 expedientes por denuncias a la Ley de Protección de Datos Personales, con 13 sanciones por un monto total de ARS 1.226.305.
  • Se incorporaron 13.230 documentos de identidad al registro de Documentos Cuestionados.
  • Ingresaron 10.104 denuncias por el Registro No Llame (que derivaron en el inicio de 17 expedientes nuevos).
  • Se inscribieron 1.170 responsables de bases de datos y se registraron 2.362 bases de datos, de las cuales 2.278 corresponden a bases de datos privadas y 84 a públicas.
  • Se llevaron adelante 10 investigaciones espontáneas (una de las cuales era confidencial), dentro de las que se destacó la encargada por la subsecretaría de gobierno abierto y país digital en relación con el app CuidAR (el app del gobierno nacional relacionada con COVID-19; más información sobre el app CuidAR aquí).
  • Se prepararon tres (3) informes sobre el proceso de adecuación de la Argentina al RGPD de la Unión Europea.
  • Se prepararon dos (2) informes al Consejo de Europa sobre medidas tendientes a facilitar la entrada en vigor del Convenio 108.

Además, el informe anual remarca que, con motivo de la pandemia del COVID-19, la AAIP dictó tres (3) guías con información sobre:

    • Procesamiento de datos personales durante la pandemia del COVID-19.
    • Procesamiento de datos personales en el uso de herramientas de geolocalización.
    • Procesamiento de datos personales y control de temperatura.

Asimismo, tal como fuera anticipado en el informe anual de 2019 (más información aquí), la AAIP completó los proyectos relacionados con:

  • Nuevas guías de inspección [la AAIP aprobó la resolución Nº 332/2020 con nuevos lineamientos para los procedimientos de fiscalización y guías legales y técnicas a ser seguidas en tales procedimientos].
  • Guía Conjunta con la Autoridad del Uruguay sobre Evaluación de Impacto en materia de protección de datos personales [la AAIP aprobó una guía conjunta].

Por último, el informe anual indica que durante el período 2020 se recibieron 10.104 denuncias relacionados con el Registro No Llame y la AAIP impuso sanciones monetarias por un total de ARS 93.035.100 (aproximadamente USD 1.000.000).

2021-04-06 09:02:43
House Appropriations Committee passes amended WPA https://iapp.org/news/a/house-appropriations-committee-passes-amended-wpa https://iapp.org/news/a/house-appropriations-committee-passes-amended-wpa A version of the Washington Privacy Act amended by House of Representatives lawmakers last week to include a limited private right of action received pushback from industry representatives Thursday but was ultimately passed by the House Appropriations Committee in a 19–14 vote.

Of the 12 witnesses who testified during the committee’s public hearing, two spoke in favor of the newly amended WPA. Those opposed said the addition of a private right of action — with remedies limited to injunctive relief and “reasonable attorneys’ fees and costs” awarded to plaintiffs — substantially changes the version of the bill that passed the Senate by a 48–1 vote in early March and without public input. The House Civil Rights & Judiciary Committee amended the bill March 26 with a striking amendment that included adding the private right of action.

“The (Civil Rights & Judiciary) committee made significant policy changes to the bill with zero public input. The bill as it passed the committee introduces new and vague terms untested in any legislation around the country,” Internet Association Northwest Director of State Government Affairs Rose Feliciano said. “It is concerning that the House will pass a significant piece of legislation with no public testimony and no public input. This is a troubling precedent.”

The private right of action, according to Washington Technology Industry Association Vice President of Government Affairs Molly Jones, “would subject businesses of all types to frivolous lawsuits without creating additional protections for consumers.”

While industry voices claim they don’t want to be subject to excessive liability, Common Sense Media Director of State Advocacy Joseph Jerome, CIPP/US, said, “Let’s be honest for a moment … the reality we’re seeing is they want to avoid liability as much as possible.”

Now in its third legislative cycle, Jerome said the WPA “has had a long and winding road” resulting in a compromise that will “improve how companies will protect our most sensitive information” and is “better than the status quo.”  

Included in the amended WPA is the expiration of a right to cure provision one year after the bill’s effective date, which Consumer Reports Policy Analyst Maureen Mahoney said is important, “because otherwise, the attorney general could waste resources building cases that go nowhere.”

But TechNet Executive Director for Washington and the Northwest Samantha Kersul argued the right to cure would achieve the same goal as a private right of action with injunctive relief “at a much lower cost to both consumers and businesses in a much more expedited fashion without opening the floodgates for class action liabilities.” She added, “there should be no expiration date on a consumer’s ability to get a timely remedy from a company.”

According to the bill’s fiscal note, 3.5 full-time equivalents would be allocated to the Office of the Attorney General — which would receive $1.2 million in 2021 through 2023 and $1.09 million in 2023 through 2027 — for enforcement. The office’s Consumer Protection Division anticipates three full investigations per fiscal year, the document states.

American Civil Liberties Union of Washington Volunteer Attorney William Block called that “grossly inadequate to address the scope of the problem,” adding the private right of action is “illusory.”

“This bill needs a lot of amendments to be truly protective,” he said. “Unless you are going to increase the attorney general’s funding, the bill must create a true private right of action for damages or it will be completely ineffective.”

According to the Washington State Legislature calendar, the House would have until April 11 to pass the bill, while the last day of the regular session is April 25.

Photo by Zhifei Zhou on Unsplash

2021-04-02 11:50:09
NIS representation in the EU and UK — Was the March 31 deadline a turning point? https://iapp.org/news/a/nis-representation-in-the-eu-and-uk-is-the-march-31-deadline-a-turning-point https://iapp.org/news/a/nis-representation-in-the-eu-and-uk-is-the-march-31-deadline-a-turning-point Under the recent amendments to the U.K. Network and Information System Regulations, digital service providers needed to appoint a NIS representative by March 31, 2021, in the U.K.

The NIS Directive (EU 2016/1148 – NISD) aims to achieve a high standard network and information systems security in the European Union, including the U.K. when initiated. It applies to two types of organizations: operators of essential services and DSPs.  

Due to its legal nature, the NIS Directive is different from the EU General Data Protection Regulation, as it is not directly applicable in the EU member states. It needed to be transposed into national law. Technically, there are 28 different NIS laws in force. It is important to note that the NISD or its transposition into national laws has extraterritorial scope like the GDPR, which means companies based outside the EU or U.K. can also be affected by these national laws. The core obligation arising from the extraterritorial scope is the requirement for companies located outside the EU/U.K. to appoint a NIS representative.

What is a DSP?

A DSP is any legal person that offers a digital service. However, not all digital services are subject to NIS, only specific services. The following DSPs are subject to NIS.

Online marketplaces: An online marketplace allows consumers and traders to conclude online sales or service contracts with traders and function as the destination for the conclusion of those contracts. Application stores, which operate as online stores enabling the digital distribution of applications or software programs from third parties, are understood as being a type of online marketplace.

They do not include online services that serve only as an intermediary to third-party services through which a contract can ultimately be concluded.

Online search engines: An online search engine allows the user to perform searches of websites based on a query on any subject. It can also be focused on websites in certain languages.

Search functions that are limited to the content of a specific website, even if the function is provided by an external search engine, are not subject to NIS. Online services that compare the price of products or services from different traders and then redirect the user to the preferred trader to purchase the product are also not included.

Cloud computing services: Cloud computing services allow access to a scalable and elastic pool of shareable computing resources, such as networks, servers or other infrastructure, storage, applications, and services. The NISD mentions three properties a cloud computing service must have to be qualified as a cloud service:

  • Scalable resources: Resources can be flexibly allocated by the cloud services provider irrespective of their geographical location to handle fluctuations in demand.
  • Elastic pool of resources: Computing resources that are provisioned and released according to demand to increase and decrease resources available depending on workload.
  • Shareable: Computing resources are provided to multiple users who share common access to the service, but the processing is carried out separately for each user even though it is provided from the same electronic equipment.

Included are different models, such as infrastructure as a service, platform as a service or software as a service.

As the NISD aims to improve network and information systems security, it applies to companies with a particular impact on such infrastructure; therefore, small businesses are exempt. Neither the EU NISD and its national transpositions nor the U.K. NIS Regulation applies to businesses with less than 50 staff members and an annual turnover or balance sheet of fewer than 10 million euros.

Assessing if the company offers services within the EU or UK

When it comes to assessing whether a DSP is offering its services to a certain market, the NISD seems to pursue a similar approach to the GDPR. The recitals of the NISD suggest it must be apparent the DSP is trying to offer its services to one or more member states in the EU, or in other words, evidence of "actively targeting" a particular market. When it comes to the U.K.'s NIS Regulation, they will likely follow a similar approach. 

Like with the scope of GDPR, the mere accessibility of a website or using a language typically used in different countries is not sufficient to ascertain the intention to target a specific market. However, here are some criteria to be considered that might suggest such intentions: 

  • Using a language or a currency used in one or more member states or the U.K.
  • The possibility of ordering services in those languages. 
  • The mentioning of customers or users who are in the EU or U.K.

Implications of Brexit on the requirement for a representative 

The NISD was transposed into U.K. law through the Network and Information System Regulations when the U.K. was still part of the EU. Brexit did not affect the NIS Regulation's validity; however, it has been amended to fit a U.K.-only application. At first, the U.K. NIS Regulation did not include the obligation to appoint a NIS representative. The Brexit amendments of the NIS Regulation introduced the obligation. Under the new regulations, non-U.K. companies must appoint a U.K. representative if: 

  • They are a DSP (online marketplace, online search engine or cloud computing service).
  • Their head office is not located in the U.K. 
  • They offer services in the U.K. 

The obligation to appoint a U.K. representative, even if the company has a branch in the U.K. that is not its headquarters, might be the most significant and hard-hitting difference between the NIS Regulation's and the GDPR's approach to appointing a representative.

If all of this applies, a company is considered a DSP under U.K. law and must comply with U.K. NIS Regulations. This means they should have appointed a representative before the March 31 deadline. Furthermore, DSPs should have appropriate and proportionate security measures to manage risks to the network and information systems that support their services. They must notify the U.K. Information Commissioner's Office in the event of incidents that substantially impact the provision of their services.

It needs to be highlighted that the U.K. NIS Regulation is not the GDPR's little sibling but an equal partner when it comes to the fines stipulated for noncompliance. According to the U.K. NIS Regulation, the ICO (as the relevant authority) may issue fines up to 17 million GBP in the most serious cases, like the fines stipulated in the GDPR.

NIS representation in the EU

Article 18 (2) of the NISD requires member states to provide national measures that oblige DSPs established outside the EU offering their services in the EU to appoint a European representative, which is similar to the obligation under Article 27 of the GDPR. However, this requirement was implemented differently in the various member states. Some, including the U.K. at first, did not implement such obligation at all. 

But does the March 31 deadline to appoint a U.K. representative also apply to a European representative's appointment? The answer is no since the deadline is U.K. specific, triggered by the fact that the U.K. only adopted their representative obligation with the recently introduced Brexit amendments. The amendments to the U.K. NIS Regulation provide for a three-month timeframe to appoint a representative, which began when the amendments came into force, Jan. 1, 2021. 

In the EU, the NISD introduced the obligation to appoint a representative and its transposition into national law. Therefore, it has already existed for quite some time. 

What companies should do now

There are certain impacts on DSPs arising from Brexit, which should be carefully assessed in view of the above. The key issue is that there are now two legal frameworks that might require companies to appoint a NIS representative. These frameworks apply to: 

  • DSPs that do not have headquarters in the U.K., which may be companies in or outside the EU.
  • U.K. DSPs and relevant DSPs without an establishment in the EU.  
  • DSPs without their headquarters in the U.K. and an establishment in the EU.

We have created a detailed FAQ about the NIS representative requirements for further guidance.

Companies that need an EU or U.K. NIS representative or both are very likely to need an Article 27 (U.K.GDPR representative. The NIS representative can be the same as the GDPR representative, so it is possible to have the same person or entity be your GDPR and NIS representative, which is probably the easiest and most favorable option, especially when it comes to data breaches.

Choosing the European representative does have implications on the jurisdiction to be applied to the DSP since it is under the member state jurisdiction where their representative is established. The DSP must comply with the domestic NIS law, which includes implementing technical and organizational measures to manage risks posed to the security of network and information systems and reporting obligations in case of incidents that substantially impact the provision of their service.

Photo by Rocco Dipoppa on Unsplash

2021-04-01 13:30:07
Privacy self-assessment toolkit for SMEs in Ukraine https://iapp.org/news/a/privacy-self-assessment-toolkit-for-smes-in-ukraine https://iapp.org/news/a/privacy-self-assessment-toolkit-for-smes-in-ukraine On Feb. 23, 2021, Ukraine's Ministry of Digital Transformation, in cooperation with the United Nations Development Program, NGO "Privacy Hub," and other partners, launched a data protection self-assessment tool. Aimed at aligning personal data protection with international and European standards, Ukraine developed a framework to help Ukrainian small- to medium-sized enterprises understand Ukrainian privacy laws and the EU General Data Protection Regulation.


Currently, Ukrainian privacy issues fall under the 2011 personal data protection law. This law is heavily influenced by Directive 1995, which implies Ukraine still lives in the 20th century regarding data protection. Even though the country has adopted and ratified Convention 108, it has yet to do so with Convention 108+. Additional information on the current status quo can be found in our article on the reality and future of privacy legislation. So, it is apparent Ukraine does need to improve the situation with personal data protection. This tool is one of the many initiatives that aim to raise awareness and educate the public. 

According to our research, Ukrainian companies aware of privacy legislation and work within the European Economic Area market use the U.K. Information Commissioner's Office's data protection self-assessment. However, for obvious reasons, it does not cover Ukrainian legislation. So, it was only right to develop Ukraine's own tool that would provide assessment for organizations from both perspectives — European and national. As is the case with the ICO's framework, we believe the Ukrainian self-assessment tool will be useful for people from other countries, as well. With that in mind, the tool was translated into English so people from different jurisdictions would be able to use it. 

We also interviewed Ministry of Digital Transformation Data Protection Officer Bogdan Pashynskyi to hear what he had to say about the tool: "One of the things I like about the tool is that it breaks down complex Ukrainian and EU data protection legislation into 'digestible' requirements that can be understood by non-lawyers, as well as lawyers whose specialization is not related to privacy. Another great feature is the score-based system which helps illustrate the areas the business should focus on to improve its privacy program." 

Pashynskyi, who was involved in the creation of the tool, emphasized, "Our self-assessment tool is much about ensuring compliance with applicable privacy requirements as it is about helping Ukrainian businesses stay competitive on the market, in particular, the EU where privacy considerations cannot be neglected."

The details

The primary target audience of the toolkit is Ukrainian SMEs. Considering many Ukrainian IT companies and startups work in the European market, the tool allows them to conduct self-assessments under both the Law of Ukraine On Personal Data Protection and the EU General Data Protection Regulation.

How does the tool work? First, a user must answer a few questions that identify the laws applicable to the business and its roles in the data processing. The toolkit contains four tests: one for controllers and one for processors under Ukrainian law, and one for controllers and one for processors under the GDPR.

The sections cover different areas of privacy compliance:

  1. Data protection principles (for controllers only).
  2. Information provision and data subject rights.
  3. Information security.
  4. Accountability and governance.

The answers to questions assess the organization's level of preparedness based on the result from each section. A test taker may end up in a green, yellow or red zone. Each answer is supported by personalized recommendations on how to improve the current compliance situation. 

Users can take the assessment anonymously if they would like to refrain from sharing the results with the governmental platform or as a registered user to save and later access results and recommendations. Both anonymous and registered users will have the ability to share results via different social media or simply via result link. However, only the registered users will be able to save results on the "Diia.Business" platform. Then, the saved results can be used as an actionable road map for the user.

Follow-up presentations and training 

The toolkit would not be complete without explaining how to use it and what data protection requirements are. Otherwise, its value would equal zero. Test takers have access to a recording of a roundtable discussion and a series of four video training sessions that are prepared by Certified Information Privacy Professionals. 

The roundtable discussion is devoted to how businesses can benefit from protecting personal data where various stakeholders answer what advantages of data protection compliance are for their organizations.

The training recordings answer the following questions:

  1. Does your business fall under the GDPR, and what measures to take to comply with the regulation?
  2. How to conduct an audit within the organization, what documentation and procedures are needed to meet the requirements of Ukrainian and European legislation on personal data protection?
  3. How to implement technical and organizational measures aimed at ensuring the confidentiality of personal data?
  4. What are effective ways to raise awareness of employees in the field of personal data protection?


The privacy self-assessment toolkit is a part "Diia.Business," which helps owners of SMEs create, launch and manage their businesses. 

It is very important and logical to educate and guide the owners from the beginning on what to do with personal data they collect, store and share with third parties. The other idea behind the toolkit is to develop the privacy culture and take an important step on the road to mass digitization, increasing privacy and data protection awareness among the population.

Photo by Max on Unsplash

2021-04-01 13:27:43
House committee advances WPA with limited private right of action https://iapp.org/news/a/house-committee-advances-wpa-with-limited-private-right-of-action https://iapp.org/news/a/house-committee-advances-wpa-with-limited-private-right-of-action House lawmakers in Washington state on Friday advanced an amended version of the Washington Privacy Act that adds a limited private right of action and incorporates changes in alignment with California privacy law.

In a partisan 11–6 vote, the House Civil Rights & Judiciary Committee approved a striking amendment that adds a private right of action for consumers alleging a violation of the bill’s consumer data rights, including the right to access, correct or delete data. Remedies would be limited to injunctive relief, with “reasonable attorneys’ fees and costs” awarded to plaintiffs.

Other amendments include defining a minor as someone at least 13 and under age 16, expiring a right to cure provision one year after the bill’s effective date, and adding a 45-day timeline within which controllers must respond to data requests. Also, under the amended bill, as of July 31, 2023, a consumer can exercise their right to opt out of the sale of their data and targeted advertising by “designating an authorized agent or via user-enabled global privacy controls.”

“I think this bill is reasonable and moves us forward,” said Committee Chair State Rep. Drew Hansen, D-Wash., who proposed the striking amendment. “California has enacted provisions in this area by initiative. The striking amendment incorporates some of what California has done, aligning some of the definitions closer to what California has done already and is already law.”

Ranking minority member State Rep. Jim Walsh, R-Wash., did not support the amendments, saying they “fall short” in effectively protecting consumer privacy.

“We are concerned that the structure of the bill currently will open the floodgates of legal actions, but not effectively guarantee or improve any Washingtonians digital privacy,” he said. “We just don’t feel comfortable that this bill does what it purports to do. We all want to protect data privacy for Washington citizens and residents; we just don’t feel this gets there.”  

A third iteration of the WPA passed the Senate in early March.

The lack of a private right of action within the proposal has long been a point of contention, including for the Washington State Office of the Attorney General, tasked with sole enforcement authority under previous iterations. Speaking before the Civil Rights & Judiciary Committee during a hearing earlier this month, Legislative Director Yasmin Trudeau addressed the lack of a private right of action as one of the office’s two ongoing concerns, along with a call for a sunset date for the right to cure provision.

“The attorney general has always strongly believed there should be a private right of action,” she said. “In short, this is because we believe that everyone should have access to the courts to enforce their rights, including privacy rights.”

Following the House Committee’s passage of the amended WPA, Future of Privacy Forum Policy Counsel Pollyanna Sanderson called it “the strongest version of the (WPA) that we’ve seen at this point.”

“It’s more sophisticated. (There have) been three years of conversations with stakeholders on this,” she said, adding the changes are “an interesting and positive development.”

She noted the enforcement debate blocked the bill’s passage last year, and while it’s important for the law to have a strong enforcement mechanism, opinions differ on what that looks like.

“Even though the enforcement is limited to certain provisions and only injunctive relief, I’m still going to be interested to see how it does on the floor with these changes,” she said.

The amended bill gained support from some privacy advocates.

Consumer Reports said the latest changes “are a significant improvement over the previous version passed by the Washington state Senate.” The organization has been neutral on earlier versions, Senior Policy Analyst Maureen Mahoney said, but the recent changes strengthen the bill for consumers and businesses.

“In our view, the (WPA) would provide strong privacy protections for consumers, stronger than the (California Consumer Privacy Act),” she said. “We urge legislators in Washington to pass this version of the bill, and we’re pleased that the House has particularly strengthened enforcement.”

Common Sense Media Multistate Policy Director Joseph Jerome, CIPP/US, said he has been calling for stronger enforcement and protections for teens, as well as better addressing the targeted advertising opt-out.

“The amendment that passed out of committee today does all three of those things, so I think that’s a big deal,” he said.

Photo by Charles Lenhart on Unsplash

2021-03-29 12:22:13
For DHS' Lynn Parker Dupree, CPO role is a homecoming https://iapp.org/news/a/for-dhss-lynn-parker-dupree-cpo-role-is-a-homecoming https://iapp.org/news/a/for-dhss-lynn-parker-dupree-cpo-role-is-a-homecoming After spending time working in the private sector, Lynn Parker Dupree, CIPP/G, CIPP/US, is heading home.

Dupree has been named the new chief privacy officer of the U.S. Department of Homeland Security after a stint as the director of governance and controls at Capital One. She returns to DHS after previously serving in the Privacy Office and the Office of the General Counsel at the agency.

"I am very honored to be the new chief privacy officer," Dupree said. "My very first job in privacy was actually in the DHS privacy office. To be back in this capacity is both an honor and a privilege and is humbling, and I take it very seriously."

The privacy industry has noticeably evolved since Dupree left the Department in 2014. As she begins her tenure as CPO, Dupree wants the agency to be equipped to adapt and respond to the ever-changing privacy landscape.

Dupree's eyes are set on addressing the growth of technologies that have an "outsized impact" on personal privacy. One of her goals is to ensure the agency is well-represented when discussions take place on technology and other privacy-related topics.

"What I would like to see for the Privacy Office is that any time there is a policy decision being made, our subject matter experts will have a seat at the table to help craft responsible policies and practices that govern the way we collect, use, share and maintain information and really be transparent about how we work," Dupree said.

While it has been a few years since Dupree roamed the halls at DHS, she expects her previous experience to play a big part as CPO. Dupree said in her first stint with the agency, she spent time working on information sharing and assisting with the trainings for Fusion Centers, which are "state-owned and operated centers that serve as focal points in states and major urban areas for the receipt, analysis, gathering and sharing of threat-related information between State, Local, Tribal and Territorial, federal and private sector partners."

Dupree gained experience not just in privacy matters, but also in the Freedom of Information Act responsibilities tasked to the office. In particular, Dupree's time in the Office of the General Counsel gave her wider exposure to how DHS operates, which she said will inform how she approaches her new title.

But it won't just be her time at DHS that will shape Dupree's stint as CPO. Dupree held several titles when working at the U.S. Privacy and Civil Liberties Oversight Board, the last of which was executive director.

As executive director, Dupree interacted with DHS in various capacities, giving her a different viewpoint into the Department's activities. By getting an outsider's view, Dupree said it helped flesh out how the Department's work could be perceived by those who are not immersed in the minutiae. 

"Our responsibility is to always think about the transparency aspect of what we are doing," Dupree said. "Does the public understand fully, or as much as they can, how we are collecting, using, maintaining and storing their data? If the expectations aren’t consistent with reality, what is it that needs to happen to make those things line up? Being at the (PCLOB) really drove that home to me, so that is how I think will approach this role, making sure what we do is consistent with what we are saying publicly and what expectations might be."

Most of Dupree's privacy career has been government adjacent, but her latest role was in Capital One's Data Ethics and Privacy Office. Dupree said her time in the private sector taught her the core privacy skills obtained throughout her career transfer easily regardless of the environment.

Dupree said the ethical quandaries she considered while working at Capitol One match up well with the core work of the DHS Privacy Office.

"When we are thinking about data ethics, it’s not only what is legally required or how we handle and use data, but also what is the right thing to do beyond what the law requires. That’s what I spent a lot of time thinking about in the private sector," Dupree said. "As a policy office, the Privacy Office is poised to do that. There are questions about what is legal, but there is a separate question and a separate analysis of what is prudent."

Though her tenure as CPO for DHS is only in its infancy, Dupree is excited for the opportunities to have the privacy office become an important resource for the entire Department. Returning to the agency has been a full-circle moment for Dupree, and she is happy to be back home.

"I am very optimistic about the future of the privacy office and the service that we can provide to the rest of the department, and I’m looking forward to working with everybody across the department and with the team of dedicated professionals that are currently here," Dupree said. "Because I’ve worked at the Privacy Office before and because in all my other capacities I have engaged with the privacy offices across the federal government, including the DHS office, what I know is this team is tirelessly dedicated to doing their job at the highest levels of their ability. I appreciate that, and I appreciate and am very thankful to have them."

Photo by Maria Oswalt on Unsplash

2021-03-29 12:20:53
TikTok settlement highlights power of privacy class actions to shape US protections https://iapp.org/news/a/tiktok-settlement-highlights-power-of-privacy-class-actions-to-shape-u-s-protections https://iapp.org/news/a/tiktok-settlement-highlights-power-of-privacy-class-actions-to-shape-u-s-protections In February, Tiktok agreed to settle a class-action lawsuit in the U.S. District Court for the Northern District of Illinois Eastern Division that consists of 21 putative class actions. The multiple lawsuits stem from the "collection, use, and transmission of highly sensitive personal data" through the TikTok application, which violated national and state laws. By settling, the court will not have a chance to litigate the issues presented by the complaint. The settlement highlights the possible power of privacy class actions over companies that handle data in the U.S., especially because they imposed sizeable monetary relief and substantive obligations. 

The complaint against TikTok

The first case in the class action was filed in November 2019 in the Northern District of California. Subsequent cases in the class action were filed in other jurisdictions, Illinois and other districts in California.

The complaint details 10 causes of action, including alleged violations of Illinois' Biometric Information Privacy Act and other laws, including the U.S. Computer Fraud and Abuse Act, California Comprehensive Data Access and Fraud Act, and Video Privacy Protection Act.

The complaint states the app used "automated software, proprietary algorithms, AI, facial recognition, and other technologies to commercially profit" from TikTok users. Beyond using and profiting off users' "biometric data and information," it also alleges the app "clandestinely vacuumed up and transferred" information about users to servers located in China. The plaintiffs claim TikTok collected user data without notice or consent upon signing up for the app. 

BIPA allegations

The complaint states that TikTok violated BIPA in several ways. It states the app collected, stored and used users’ face geometry scans (a biometric identifier under BIPA Section 10) without notifying or receiving written releases from users. Second, it also alleges TikTok possessed and profited from users’ biometric identifiers “by using them for targeted advertising, improvements to artificial intelligence technologies, patent applications, and the generation of increased demand for and use of other products.” Third, the complaint posits TikTok impermissibly disclosed and disseminated users’ biometric data without consent and without an allowed reason under BIPA, such as a subpoena.

The complaint also alleges the app used face scans, artificial intelligence and facial recognition to make recommendations for users partially based on their perceived race/ethnicity or age and to suppress content made by users with so-called "ugly facial looks."

Additionally, the complaint states TikTok's augmented reality filters can change a person's face on the app employ code with names such as "FaceDetectManager" and "maxScanTime," which reveals the app scans users' face geometries to perform the AR filters correctly.

By settling the agreement, the question of what is considered "biometric information" under BIPA will not be litigated. In the settlement agreement, TikTok admitted to using "demographic classification," which included "recognizing visual patterns that indicate age, gender or other characteristics." However, the company has stated they believe using demographic classifications is different than using face scans "because it does not create facial templates and is not capable of identifying a user."

A related BIPA settlement 

TikTok is not the only technology company to face a lawsuit due to Illinois's BIPA statute. In February, a federal district court judge approved a $650 million class-action settlement against Facebook for a BIPA violation. The judge described it as a "landmark result" that is expected to "put at least $345 into the hands of every class member interested in being compensated."

The Facebook and TikTok settlements illustrate the power of Illinois's BIPA law, which has contributed to two multimillion-dollar settlements and has forced both companies to modify their behavior regarding information collected, stored, shared and used. BIPA is unique because it has a private right of action. Although TikTok settled before the case could wind through the court system, which could have led to a narrowing or broadening of the term "biometric identifier," the two settlements set the stage for continued litigation under BIPA and the possibility of huge settlement amounts.

Allegations beyond BIPA

The TikTok complaint also alleged the company violated two federal statutes, the Computer Fraud and Abuse Act and the Video Privacy Protection Act, as well as several California state laws and state consumer protection statutes. It further states TikTok intruded upon users' seclusion and was unjustly enriched, two common law claims.

While the company agreed to a settlement, it has not agreed with the complaint's allegations. In a statement, TikTok said while the company "disagree[s] with the assertions, rather than go through lengthy litigation, we'd like to focus our efforts on building a safe and joyful experience for the TikTok community."

What does the settlement entail? 

The proposed settlement includes monetary and injunctive relief for two different classes: the Nationwide Class and the Illinois Subclass. Combined, the two classes cover 89 million U.S.-based TikTok users, with some class members as young as 8 years old.

The Nationwide Class consists of "all persons who reside in the United States who used the app prior to the issuance of the Preliminary Approval Order." The Illinois Subclass covers "all persons who reside in the State of Illinois and used the App in the State of Illinois to create videos prior to issuance of the Preliminary Approval Order." The Illinois Subclass consists of approximately 1.4 million Illinois-based TikTok users.

Monetary relief

TikTok agreed to pay a total of $92 million to settle the claims. The settlement agreement asserts "a recovery of this magnitude ranks among the nation's highest privacy-related settlements."

If every potential class member submitted a valid claim, each Nationwide Class claimant would receive $0.96, and each Illinois Subclass claimant would receive $5.75. The actual amount claimants may receive may be higher because not every potential claimant will make a claim. However, 22% of potential claimants filed a claim for Facebook's BIPA settlement — an "usually high" number. If 22% of all possible claimants file a claim, Illinois Subclass members will receive $174.57, and Nationwide Class members would receive $29.10. 

Injunctive relief

Beyond monetary payment, the company agreed not to take specific actions, unless "disclosed expressly in the TikTok Privacy Policy and in compliance with all applicable laws." The actions include using the app to: 

  • "Collect or store a user's biometric information or identifiers.
  • Collect geolocation or GPS data.
  • Collect information in users' clipboards.
  • Transmit U.S. user data outside of the U.S.
  • Store U.S. user data in databases outside of the U.S.
  • Pre-upload U.S. user-generated content."

However, if the company's privacy policy discloses the above actions and is in compliance with "all applicable laws," they will be allowed to perform them.

Furthermore, the proposed settlement agreement would require TikTok employees and contractors to complete annual data privacy compliance training. It would also be required to hire a third party "to review the data privacy law compliance training for a period of three years and to provide verification of this review."

The proposed settlement, however, has hit a roadblock. U.S. District Judge John Lee did not approve the proposed settlement but instead requested further information about how class members would be notified of the settlement, specifically asking why users would not be notified about the settlement through the app itself. If settlement notifications appear on the app, there is a chance the claim rate would exceed the predicted claim rate of about 2%. If TikTok only notified class members through email, it would only reach the 30 million users who have provided an email address out of the 89 million users who could potentially make a claim.


This is not the first time TikTok settled for allegedly violating privacy law. In 2019, the company, then known as Musical.ly, settled with the U.S. Federal Trade Commission for violating the Children's Online Privacy Protection Act. The FTC alleged the company violated COPPA for being a website or service directed at children and did not receive "parental consent before collecting personal information from children under the age of 13." The company agreed to pay $5.7 million — the largest monetary settlement in a COPPA case.


This settlement is just the latest in what will probably be an increase in litigation coming out of both California and Illinois. Illinois' BIPA has shown to be a vehicle by which individual consumers of technology can force changes to large companies' behavior and policies. Even though the $92 million settlement was not nearly as large as Facebook's $650 million settlement, it highlights that companies can end up owing both monetary and injunctive relief under BIPA and other national privacy laws without ever fully litigating the issues. As more lawsuits arise under BIPA, the IAPP will be ready to analyze them.

Photo by Bill Oxford on Unsplash

2021-03-23 14:12:47
Finn Myrstad on privacy case against Grindr, 'dark patterns' https://iapp.org/news/a/finn-myrstad-on-privacy-case-against-grindr-dark-patterns https://iapp.org/news/a/finn-myrstad-on-privacy-case-against-grindr-dark-patterns The Norwegian Consumer Council made waves in early 2021 after its complaint to Norway's data protection authority, Datatilsynet, against Grindr resulted in an intention to fine the company $12 million, the highest fine ever levied by the nation’s DPA. The fine amounts to 10% of the company’s annual global turnover. Grindr has now responded to the proposed enforcement action, arguing it has refined its consent mechanism and believes the DPA will find Grindr is committed to complying with the EU General Data Protection Regulation. The NCC has long worked with other advocacy organizations to bring protections and awareness for consumers around privacy issues in the marketplace. In 2018, they released an in-depth report on “dark patterns” to demonstrate how companies nudge users into making decisions that may not always be in their best interest. IAPP Editorial Director Jedidiah Bracy, CIPP, recently caught up with the NCC’s Finn Myrstad to discuss the NCC's case against Grindr and, more broadly, what companies can do to avoid using dark patterns at the expense of their users.

2021-03-23 14:11:35
Analyzing the CPRA’s new contractual requirements for transfers of personal information https://iapp.org/news/a/analyzing-the-cpras-new-contractual-requirements-for-transfers-of-personal-information https://iapp.org/news/a/analyzing-the-cpras-new-contractual-requirements-for-transfers-of-personal-information New Year’s Day 2023 will usher in many new changes for California (and, by extension, the U.S.) privacy law when the California Privacy Rights Act becomes fully operative. One significant change will be the CPRA’s expansion of contracting requirements for transfers of personal information to other entities. The California Consumer Privacy Act only requires contracts to establish service provider relationships. The CPRA will expand that requirement to include transfers to third parties and “contractors,” a new category of entities under the CPRA. It also will significantly expand what the contract must include.

Although these changes will not go into effect for another two years, businesses subject to the CPRA should be mindful that identifying applicable data transfers and negotiating agreements can be a monumental task.

CCPA contractual requirements

The CCPA created three categories of entities: businesses, service providers and third parties. Generally speaking, "businesses" are entities that collect personal information from California residents, while "service providers" and "third parties" are entities to which businesses transfer that personal information. Unless an exception applies, a transfer of personal information to a third party likely constitutes a “sale,” triggering the business’s obligation to provide the right to opt out. In comparison, transfers of personal information to service providers do not trigger the right to opt out because service providers are contractually limited in using personal information.

To qualify as a service provider relationship under Section 1798.140(v), the business’s disclosure of personal information must be pursuant to a written contract that prohibits the receiving entity “from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business [i.e., the business purpose], or as otherwise permitted by [the CCPA], including retaining, using, or disclosing the personal information for a commercial purpose other than [the business purpose].”  

In practice, parties also routinely look to the definitions of “third party” and “sale” in Sections 1798.140(w) and (t)(2)(C), respectively, and incorporate those definitions into service provider contracts to avoid triggering the right to opt out.

“Third-party” is defined by what it is not. A third party is a person who is not the business that collects the personal information nor a person to whom the business discloses a consumer’s personal information for a business purpose pursuant to a written contract provided that the contract prohibits the person from:

  1. Selling personal information.
  2. Retaining, using or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract, including retaining, using or disclosing the personal information for a commercial purpose other than providing the services specified in the contract.
  3. Retaining, using or disclosing the information outside of the direct business relationship between the person and the business.

The receiving entity must also certify that it understands these contractual restrictions and will comply with them.

Similarly, the definition of “sale” states that a business does not sell personal information when it “uses or shares with a service provider personal information of a consumer that is necessary to perform a business purpose if” (1) the “business has provided notice of that information being used or shared in its terms and conditions consistent with Section 1798.135” of the CCPA and (2) the “service provider does not further collect, sell, or use the personal information of the consumer except as necessary to perform the business purpose.”

Notably, Section 999.314(c) of the final CCPA regulations creates a list of permissible uses by a service provider that contracting parties often overlook. For example, that section states that service providers can retain and employ another service provider as a subcontractor, where the subcontractor meets the service provider requirements. The CCPA’s failure to discuss subcontracting was a glaring omission that the CCPA regulations fixed (and, which, as discussed below, the CPRA also remedies).

CPRA contractual requirements


The CPRA adds a new category, “contractors,” which are entities to which businesses “make available” personal information. In comparison, service providers are entities that “process” personal information on behalf of a business and receive personal information “from or on behalf of the business.” These definitions are in Sections 1798.140(j) and (ag).

The comments to the initial annotated version of the CPRA ballot measure state that the new contractor category was taken from the CCPA’s third-party definition. A contractor, therefore, is any entity that receives personal information from a business and enters into a contract with the above-noted restrictions (subject to some changes/additions as discussed below). The suggestion that the contractor category already exists in the CCPA is interesting. However, the comments acknowledge that a contractor “[e]ssentially functions identically to ‘Service Provider,’ with the distinction that SP’s process [personal information] received ‘from or on behalf of a business,’ whereas contractors uses [sic] [personal information] ‘disclosed by’ a business.” That contractors and service providers are virtually identical also is reflected in the fact that CPRA’s definitions of those two terms closely track each other.

New contractual requirements

Perhaps the most notable change with respect to transfers of personal information is found in Section 1798.100. A business that collects a consumer’s personal information and “sells that personal information to, or shares it with, a third party or that discloses it to a service provider or contractor for a business purpose” must enter into an agreement with that third party, service provider or contractor that:

  1. Specifies that the personal information is sold or disclosed by the business only for limited and specified purposes.
  2. Obligates the third party, service provider or contractor to comply with applicable obligations of the CPRA and obligates those persons to provide the same level of privacy protection as is required by the CPRA.
  3. Grants the business rights to take reasonable and appropriate steps to ensure that the third party, service provider or contractor uses the personal information transferred in a manner consistent with the business's obligations under this title.
  4. Requires the third party, service provider or contractor to notify the business if it decides it can no longer meet its obligations under this title.
  5. Grants the business the right, upon notice, including under Paragraph (4), to take reasonable and appropriate steps to stop and remediate unauthorized use of personal information.
  6. As noted, this new requirement extends the duty to contract to third-party transfers, which is currently not required by the CCPA.

In addition to those five requirements, businesses wishing to establish service provider or contractor transfers will need to include additional provisions in the contract.

First, the transfer must be for a “business purpose” as defined by the CPRA. The CPRA substantially revises the definition of “business purpose” such that it will be important for businesses to review the new definition when drafting these contracts.

Second, the contract must state that the service provider or contractor is prohibited from:

  1. Selling or sharing personal information.
  2. Retaining, using or disclosing personal information for any purpose other than for the business purposes specified in the contract, including retaining, using or disclosing personal information for a commercial purpose other than the business purposes specified in the contract or as otherwise permitted by the CPRA.
  3. Retaining, using or disclosing the information outside of the direct business relationship between the contractor and the business.

These requirements mirror and harmonize the requirements currently found in Sections 1798.140(v) and (w), as discussed above. 

Third, the contract must prohibit the service provider or contractor from combining the personal information it receives from the business with personal information it receives from or on behalf of another person or persons or that it collects from its own interaction with the consumer. However, the receiving entity will be able to combine the personal information to perform certain business purposes that will be identified in regulations adopted by the California Privacy Protection Agency.

Contractor contracts (but not service provider contracts) must also include a certification from the contractor to understand the above restrictions and comply with them. This divergent requirement is a by-product of the CPRA copying the CCPA’s language from Section 1798.140(w) to create the new definition of a contractor.

Fourth, subject to agreement with the service provider or contractor, the contract should allow the business to monitor the receiving party’s compliance with the contract through measures, including but not limited to ongoing manual reviews and automated scans and regular assessments, audits or other technical and operational testing at least once every 12 months. The slightly different wording regarding this right to monitor found in Sections 1798.140(j)(1)(C) and 1798.140(ag)(1)(D) suggests that it may be mandatory for transfers to contractors but permissive for transfers to service providers.

Finally, if the service provider or contractor engages a sub-processor or a sub-processor engages a sub-processor, the service provider or contractor is required to notify the business and enter into a contract with the sub-processor containing the above requirements.

Responding to consumer requests

Finally, although the CPRA does not require contractual provisions concerning responding to consumer requests, Sections 1798.105(c)(3) and 1798.130(a)(3)(A) contain some requirements that parties may want to incorporate into these contracts. Service providers and contractors are not required to respond to consumer requests submitted to them when acting as a service provider or contractor. However, service providers and contractors “shall” cooperate with businesses in responding to verifiable consumer requests, including deleting personal information or enabling the business to do so, and notifying their own service providers or contractors to delete the personal information. Service providers and contractors also must provide the business with the personal information in their possession that was obtained in their capacity as a service provider or contractor for the business. In addition, they must correct any inaccurate personal information.


Although the CPRA will not become fully operative until January 2023, businesses should use the coming months to address the CPRA’s new contractual requirements to ensure that they are fully compliant by such date.

Photo by Helloquence on Unsplash

2021-03-23 14:10:52
How one organization raises awareness over connected vehicle privacy https://iapp.org/news/a/how-one-organization-raises-awareness-over-connected-vehicle-privacy-concerns https://iapp.org/news/a/how-one-organization-raises-awareness-over-connected-vehicle-privacy-concerns Legendary golfer Tiger Woods was driving a Genesis GV80 when he suffered a horrific rollover crash that resulted in his hospitalization and surgery on his leg. The Genesis features the same technology many vehicles have today, which allows drivers to sync their phones to the cars to make phone calls, send texts and listen to music.

Should Woods have done that with the Genesis he was loaned, Andrea Amico said a lot of personal information about the golfer could have been gleaned from an examination of the car's systems. It could be anything from a list of the famous people listed in Woods' contacts to perhaps details about a deal with Nike that had not been made public yet.

It's a high-profile example of the many privacy questions surrounding connected vehicles. Amico has made it a goal to raise awareness about the potential issues when storing data in an automobile. One of the ways he aims to accomplish this goal is through a company he founded in 2019.

Privacy4Cars is a technology company that produces an application to help drivers wipe personal data from a vehicle. The company produces offerings for both consumers and wholesalers, service providers and dealerships. Amico said Privacy4Cars has a 99.7% completion rate when used to remove data from a vehicle. He compared it to the traditional method of having a professional manually wipe the information themselves, which he said only results in a compliance rate of 30%.

Amico said the back-end component of the app helps car dealers, wholesalers and service providers demonstrate their commitment to removing data from connected vehicles. 

"We have an entire compliance engine and reporting engine so that you can see the car, what steps were followed, by whom, when was it done and which systems were reset," Amico said. "We bring it all up in a certification and a warranty and then we publish it in a number of places to provide shared visibility over what happened. This is the way in which companies can have not just a policy, but confidence the policy has been applied and they have the receipts to prove they are doing the right thing."

The application is only one part of what Privacy4Cars does in the automotive space. Amico said the organization is also committed to raising awareness around data in connected cars. Privacy4Cars has done this by reaching out to the media, expanding its efforts to include Canada and Europe. Amico said his organization has worked with nonprofits and even reached out to members of U.S. Congress to inform lawmakers of issues that may require their attention.

Amico said Privacy4Cars needs to perform all these activities because knowledge in this area is sorely lacking, and it isn't just the drivers who need an education.

"I’m not just talking about individuals," Amico said. "I’m also talking about industry people. We spend a lot of time doing education on what happens when you sync your phone. What people don’t realize is when you do that, you create a mini clone of your phone stored locally in your car. The data you find ranges from, for older vehicles that have just Bluetooth, your contacts, your call logs, a copy of text messages plus a lot of metadata that allows you to be reidentified as a user. Newer cars have a lot more stuff. We’ve seen calendar entries, browsing history, the apps they use on their phone and the photos they are taking." 

So what can be done to protect the information stored in these connected vehicles?

Back in 2015, the Driver Privacy Act of 2015 was passed as part of the $300 billion Highway Deal. The bill prohibits anyone but the owner from accessing data in a vehicle except under specific circumstances. Amico points out the bill only covers the information collected from a car's electronic data recorder.

A car's EDR is only one small avenue for how a car can collect data on its driver, and Amico believes the bill could be expanded upon once it is eventually revisited.

"Congress took action in 2015, but they just focused on one of the 60 to 150 computers in the car," Amico said. "I’m not sure why the other 99% got left out, but the Highway Bill is due for re-up and so that could be a very good initiative to do to expand the same rights and protections to all the other devices in the car, not just the EDR."

Revisions of the bill may also have to tackle who owns the data within the car. The Driver Privacy Act states the data is "the property of the owner or lessee of the vehicle in which the recorder is installed, regardless of when the vehicle was manufactured."

This creates a problem in cases similar to the one Woods faced. Amico said since the car was loaned to Woods, any data uploaded to the vehicle would be the property of Genesis. This discrepancy is one Amico called a "sticky situation" and must be addressed in future iterations of the bill. 

Congress may play a part in protecting drivers' privacy, but for Amico, they are only one piece of the puzzle. For data concerns to be assuaged, Amico feels it ultimately needs to take a village.

"Our view is that the traditional view of saying ‘this is a problem that manufacturers and their tier-one suppliers have’ is not accurate," Amico said. "This is like saying that the privacy of computers is a problem for Dell and Intel. It takes an entire ecosystem and right now we have this very siloed view of who is responsible for finding a solution. Everyone is responsible. Consumers should be informed and should be able to do things on their own, but also the industry, at different layers, should set multiple safety nets to ensure the protection of their personal information." 

Photo by Arteum.ro on Unsplash

2021-03-23 14:10:39
Alan Butler talks leading EPIC in time of ‘rapid technological, social change’ https://iapp.org/news/a/alan-butler-talks-leading-epic-in-time-of-rapid-technological-social-change https://iapp.org/news/a/alan-butler-talks-leading-epic-in-time-of-rapid-technological-social-change From the COVID-19 pandemic and related privacy challenges, to the move toward federal privacy legislation amid continued regulatory progress at the state level, to ever-emerging technologies and more, there’s no shortage of issues in the privacy world.

As the Electronic Privacy Information Center’s newly appointed executive director, Alan Butler is diving into the organization’s global work as a public interest research center focused on emerging data protection and civil liberties issues. Butler, who first joined EPIC in 2011 and most recently served as general counsel, took over as interim executive director in April 2020. The organization’s board of directors recently announced his appointment following a six-month international search.

Butler is “thrilled” to begin a new chapter in EPIC’s history in a time of such “rapid technological and social change” when he said the organization’s mission has never been more important.

[caption id="attachment_422555" align="alignright" width="250"] Alan Butler, Electronic Privacy Information Center executive director[/caption]

“I was really honored by the opportunity from the board to take on the leadership role to help us think about what are the most cutting-edge issues that we want to be working on today, how can we set up our staff, our projects, to tackle the issues that we’ll see tomorrow,” he said. “It’s really exciting to go from working in the nitty-gritty of projects to helping lead the staff to think critically through what those issues will be and how we can really advance the cause.”

Key among those issues, Butler said, is advocating for a comprehensive baseline privacy law in the U.S. and a data protection agency to ensure that the law is fully enforced.

EPIC has been closely tracking the progress of state privacy laws, Butler said, including the California Privacy Rights Act and most recently passage of Virginia’s Consumer Data Protection Act. It's also is in the process of updating its “Grading on a Curve” report, which reviews recent privacy law developments, identifies key characteristics of legislation and assesses pending proposals, to reflect the most recent advances. The organization is also connecting with coalitions and constituency groups to work through the strategies and substance behind legislative proposals.

While there are many priorities on the minds of lawmakers, Butler said he does think federal privacy legislation is a “near-term priority for a lot of folks on the Hill.”

“I do think it will be revisited in this session,” he said, “especially because one of the most interesting things about privacy as a legislative issue is it has been one of those areas where there is bipartisan interest. We’ve seen bills across the political spectrum. We may reach a point in the current Congress where other issues that are a bit more polarizing can’t move and there may actually be an instinct to look toward what issues can.”

Sticking points in the conversation around federal privacy legislation have, of course, been over private right of action and preemption. EPIC argues it’s not “reasonable or viable” to have federal legislation that preempts state privacy laws but advocates for a federal baseline that gives states, which Butler said might be in the best position to address emerging privacy issues, the flexibility to implement legislation.

“We shouldn’t have to wait for federal action, where, check the calendar, we’ve been waiting for federal action on privacy regulation for 20-plus years, and it hasn’t come. The states are a really important tool,” he said, adding they could “in many ways, drive the demand for a comprehensive federal system.”

The COVID-19 pandemic and issues it has raised throughout work, school and health environments has brought to light the need for a comprehensive set of rules and potentially “a real robust updating of some of the rules we already have,” Butler said. The pandemic has also brought attention to the intersection between public health response and data protection, with a need to ensure response systems are designed and deployed in a way that preserves privacy, he said.

“What we’ve seen now more broadly is there is, one, a development of technologies and systems in the private sector, in many cases, divorced from any direct regulatory regimes that I think probably demands more attention from federal and state regulators and potentially legislative response, though we do think it’s more important to do comprehensive rather than piecemeal legislation on most of these issues,” he said. “In the workplace setting, in the educational context, and even in the health adjacent context, we’ve seen a lot of technologies and systems emerge and be introduced this year that pose significant privacy risks and challenges and there needs to be a continued and aggressive response to that.”

Other emerging privacy issues on EPIC’s agenda include protecting sensitive location data, ensuring that privacy regimes work in tandem with fundamental rights, and establishing redress mechanisms for victims of data misuse and abuse, Butler said.

“There’s so much to do and our field has grown enormously. We’ve been around for more than 25 years, and the scope of what we work on expands almost exponentially every year. We always have to think about short-term priorities, but keep in mind the importance of our long-term goals,” he said. “There’s so much to do, and we hope we can make a real contribution to these areas. That’s what we strive to do every day.”

Photo by Iñaki del Olmo on Unsplash

2021-03-23 14:09:54
What the CPPA's appointments say about enforcement priorities, strategy https://iapp.org/news/a/do-cppa-appointments-say-anything-about-priorities-strategy https://iapp.org/news/a/do-cppa-appointments-say-anything-about-priorities-strategy With any newly assigned leadership group, it is fair to wonder if the appointments provide any clues as to how they might approach their duties. It is a question being asked and explored in the days following the appointments to the California Privacy Protection Agency board.

The inaugural board members for the first privacy-focused regulatory body in the U.S. were announced by California government officials March 17. University of California, Berkeley Clinical Professor of Law Jennifer Urban has been tapped to chair the CPPA, which was created with the approval of the California Privacy Rights Act in November 2020. Joining Urban are LA 2028 Senior Vice President of Government Relations John Thompson, California Chief Assistant Attorney General of the Public Rights Angela Sierra, Squire Patton Boggs Of Counsel and IAPP member Lydia de la Torre, and Greenlining Institute Attorney Vinhcent Le.

"In passing (the) CPRA and creating the CPPA, California demonstrates national and international leadership," Urban said in a statement. "California — with explicit privacy protections in our State Constitution, many existing innovative privacy laws, and leadership from an expert Attorney General’s office — has long been a leader in privacy. But as the world grows ever more data-driven, a dedicated body to protect consumer privacy rights, provide guidance to businesses, and enforce the law, is necessary."

What stood out immediately to Perkins Coie Partner Dominique Shelton Leipzig, CIPP/US, was the range of backgrounds the board members represent. Those areas include academia, business, law, social justice, consumer protection and more.

"This reflects the necessary diversity needed to tackle the complex issues that we face as a society with our increasing reliance on technology for everything from education, work and health" Leipzig said. "Trust and integrity will be key."

Berkeley Adjunct Professor of Information and Law Chris Jay Hoofnagle believes initial appointments, in general, are crucial, noting how questionable appointments to the U.S. Federal Trade Commission over the years in some instances created "a corrosive effect on agency trust." The appointment of Urban, Hoofnagle's colleague, is a strong one from his point of view.

"Appointing Jennifer Urban is a visionary step," Hoofnagle said. "I would compare her to Janet Steiger, President (George) H.W. Bush's chair of the FTC. Steiger was so incorruptible, fair, and consensus-focused that she repaired the Reagan-era damage to the FTC and was kept on by President (Bill) Clinton. Jennifer is circumspect, fair and takes seriously the arguments and interests of stakeholders. She has a serious amount of practice experience; she is not just an academic. She understands (Silicon) Valley business models."

Specific stances and motivations for Urban's agenda are yet to be determined, but she will be focused on a "level playing field" that supports consumers and compliant businesses. She said that Californians "deserve control over their personal information, protection from privacy-invasive practices, and the ability to trust that their data is secure." While acknowledging the need for "clear rules" for businesses, Urban also made clear she envisions a regulatory landscape that "allows them to build privacy-protective products and services."

High Tech Law Institute Co-Director and Privacy Law Certificate Faculty Supervisor Eric Goldman gave high remarks on Urban but also viewed the appointment of de la Torre as an essential step. De la Torre's wealth of knowledge regarding the CPPA's future responsibilities and privacy law on a global level helped her stand out in the selection process.

"They need the privacy practitioner perspective, and I think Lydia is the best example of that on the board," Goldman said. "The other reason she is so helpful is that she's a bona fide (EU General Data Protection Regulation) expert. Having someone who really understands the GDPR will help the board. A U.S.-trained lawyer, no matter how much they've thought about the GDPR, probably won't be as expert as Lydia will be."

The biggest surprise to Goldman was not any particular inclusion to the board but a striking omission. He expected Californians for Consumer Privacy Founder Alastair Mactaggart, the architect of the CPRA and the California Consumer Privacy Act, to be one of the first five board members.

"I can also see why it makes sense for him not to be on the board," Goldman said. "It might be overly limiting to the work he wants to do. But Alastair's absence frees up the board to be a little more aggressive. If he was there to defend, I felt like it would really distort the dynamic."

An obvious first order of business for the CPPA will be staffing. Covington & Burling Partner Lindsey Tonsager points out the board will need to appoint several employees, including an executive director and chief privacy auditor, sooner rather than later. Tonsager said staff loans from the attorney general's office are a common practice with past agency appointments, but doing so for the CPPA is not a given due to the exit of Attorney General Xavier Becerra — who was confirmed as secretary of the U.S. Department of Health and Human Services last week — and subsequent shakeup his former office will see.

Also firmly in the CPPA's sights is July 1, 2022, the deadline to complete CPRA rulemaking to give companies ample time to comply prior to the law's Jan. 1, 2023, effective date.

"The CPPA's regulations will cover broader ground than the existing CCPA regulations from the attorney general," Tonsager said. "For example, the new regulations will address opt-outs for cross-context behavioral advertising, opt-outs and access rights for automated decision-making technologies, restrictions on the use of so-called 'dark patterns,' and processes for exercising and responding to new consumer rights."

As it embarks on drawing up regulations and other duties, Leipzig would prefer the CPPA conduct its work with an all-inclusive and thoughtful approach.

"In order to tackle these important issues, all stakeholders will need to be part of the solutions," Leipzig said. "That's consumers, business, regulators and legislators. We can't reach solutions without everyone's involvement. I am hopeful that the board will provide a sounding board for consumers, as well as businesses, regarding how to implement the CPRA."

On the other hand, Goldman is less optimistic the new regulator can properly fulfill its mandated work. 

"I don't think they'll be able to fix the structural problems with the CPRA, but I'm less nervous than I was before," Goldman said. "The CPRA has baked into its DNA that it has to prioritize consumer interests over all other privacy considerations. Because of that, I feel like the board will inevitably become dysfunctional as it reaches decisions that I don't think are going to truly be in the best interest of Californians in general."

Photo by Tim Foster on Unsplash

2021-03-23 14:09:51
Why some data subject request services create compliance concerns https://iapp.org/news/a/why-some-dsr-services-create-compliance-concerns https://iapp.org/news/a/why-some-dsr-services-create-compliance-concerns If you are responsible for handling data subject requests made pursuant to the EU General Data Protection Regulation or verified consumer requests made pursuant to the California Consumer Privacy Act, chances are you have come across one or more of the myriad companies that purport to be advocating for consumers in making requests on their behalf. 

These companies include MinePrivacy BeeDeleteMe and Revoke. While these services take different approaches, their core service attempts to automate requests on behalf of consumers. However, in some cases, these companies have never interacted with the consumer and often reference inapplicable laws or proposed bills. While many companies' first inclination may be to "give the benefit of the doubt" to these requests and treat them all as if they were valid DSRs or VCRs made by data subjects that have those rights, doing so can be problematic. 

At present, these requests are focused mainly on deletion or right-to-be-forgotten requests, i.e., a request that the company deletes information relating to the consumer. Before examining some specifics of these requests, companies need to consider which privacy regulations they are subject to and the mechanisms those regulations have to protect both the company and consumer. In particular, companies must consider the mechanisms relating to the submission of requests, any exemptions for personal data not subject to the right, verification of the consumer's identity, and verifying that a consumer has authorized an agent to act on their behalf.

These legal mechanisms, specifically addressed in the privacy regulations, provide protections that benefit consumers and companies against fraud or mistakes. Therefore, although these mass request disseminators purport to be consumer advocates, at least some of their practices can have the exact opposite effect by ignoring or attempting to sidestep regulations that protect consumers. Further, by sending out large volumes of these requests without regard to whether the consumer interacted with the company in the past, these disseminators add confusion that exacerbates this problem.

These requests continue to evolve, but they are predominantly directed at sites with a public email address for contact. Some of these requests are being sent to correspondence email addresses not designated for privacy requests at all. One company, Privacy Bee, has been sending out a significant number of these, taking a broad shotgun approach to sending requests. Although it is difficult to discern their precise methodology, it appears they are building a database of email addresses for companies and sending bulk requests on behalf of their users without regard to whether the user ever interacted with the company.


Many of those acts and bills cited are not "applicable right-to-be-forgotten legislation," for reasons including that some were never passed and are not laws at all. Aside from citing inapplicable non-laws, the email has a few other problematic features. Privacy Bee sends the email and provides in the body only a name and email address of the user that is the subject of the request. The request includes a link to what purports to be a power of attorney, which appears to have been signed using DocuSign. It contains the individual's name and the date and purports to appoint Privacy Bee as an authorized agent, specifically mentioning CCPA, GDPR and Australia's Privacy Act. The emailed request also contains an arbitrary countdown timer for a response, which from the analysis of one request was set for 33 calendar days or 25 business days, and a link to a portal that allows the aforementioned power of attorney to be viewed. The portal also allows the company to "[t]ake action on the Privacy Request" with buttons that read "I agree" or "I refuse." 

How should you handle these requests if you're in the US and not subject to GDPR?

Here are some suggestions for approaching this new "privacy advocate" industry.

  • Draw clear lines and only provide rights to those who have them by law: As it currently stands, companies only really have to consider CCPA requests for California residents, and while a tendency may be to extend the rights as a courtesy or for operational convenience, companies should carefully consider that approach. The CCPA regulations contain a significant amount of detail around verification requirements designed to protect consumers, which, when companies follow those procedures, also protects them. If companies get in the habit of responding to requests to delete or requests to know for individuals in other jurisdictions, they have no guidance on what constitutes reasonable diligence in verification. For a California resident, if the information is mistakenly deleted or inadvertently disclosed after following the regulations, the company can point to having followed that guidance to defend their actions. But for a resident of any other state, that diligence might not carry any weight. Therefore, companies should carefully balance the risks of expanding or limiting rights to the individuals, specifically considering the risks imposed by expanding these rights to jurisdictions that have not provided guidance on how to accommodate those rights and minimize risk to the consumer.
  • Rely on the regulations and provide specified methods to submit CCPA requests: The CCPA regulations make it clear that a company can specify methods of submitting requests and can direct anyone making a request otherwise to use those methods:

999.312 (e) If a consumer submits a request in a manner that is not one of the designated methods of submission, or is deficient in some manner unrelated to the verification process, the business shall either:

(1) Treat the request as if it had been submitted in accordance with the business's designated manner, or

(2) Provide the consumer with information on how to submit the request or remedy any deficiencies with it, if applicable.

Given the influx of these requests by email, companies should consider utilizing a webform to specify the specific fields needed for a valid request. A second method can be a toll-free number where the agents ask for similar information. With these in place, companies can respond to these emailed requests instructing the sender to submit a request one of the approved ways.

  • Invoke other elements of the statute and regulations: Although the CCPA is largely silent on how an individual can identify themselves as a California resident, it is clear that only California residents get rights under the CCPA. Although companies should be careful not to burden actual California residents with onerous requirements, it should be acceptable for companies to screen for California residency particularly when it is readily apparent that these "privacy advocates" are making no attempt to limit their requests to those that individuals have rights to make. Other aspects of the statute and regulations can help mitigate the shotgun approach, such as (1) requiring a signed declaration submitted under penalty of perjury for requests to know specific pieces of information and requests to delete if warranted; (2) requiring the individual to confirm they want their information deleted; (3) requiring the individual to "[d]irectly confirm with the business that they provided the authorized agent permission to submit the request" as allowed by Section 999.326 (in situations where there is not a power of attorney that meets California Probate Code 4121 to 4130).

Although some of these requests have been around for a while, they seem to have exploded in frequency recently. Given some of the practices outlined above, one can only expect them to continue to increase for any company with public-facing privacy-related email addresses on their site. Implementing some of the strategies outlined herein can help mitigate the disruptive effect of these mass requests.

For more information on this issue and other updates and alerts regarding privacy law developments, subscribe to Bradley's privacy blog Online and On Point.

Photo by freestocks on Unsplash

2021-03-23 14:07:32
Privacy is not dead; it's powerful https://iapp.org/news/a/privacy-is-not-dead-its-powerful https://iapp.org/news/a/privacy-is-not-dead-its-powerful For decades, people have proclaimed a now-common refrain that "privacy is dead." So get on with it, they say. 

You probably know some of the most famous of the post-privacy pundits. No doubt, the oft-quoted Scott McNealy, then CEO at Sun Microsystems, eternally quipped, "You have zero privacy anyway. ... Get over it." In 2010, Facebook CEO Mark Zuckerberg argued that social norms were changing and people would go along with Facebook's nudging toward more data sharing. You can even go back to 1970 and see that Newsweek featured a "privacy is dead" cover story. 

More than 50 years later, we know that privacy did not die in 1970 or in 2010. And it doesn't have to die in 2021, either, that's according to Carissa Véliz in her new, compelling book, "Privacy Is Power: Why and How You Should Take Back Control of Your Data." 

In recent years, a new phrase has entered the lexicon: "surveillance capitalism." Made famous by Shoshana Zuboff, surveillance capitalism describes an economic system built around the commodification of personal data. Companies are springing up all over the digital landscape, using personal data for profit. Just look at Clearview AI, for example, a company that scraped facial photos from across the internet to amass a giant database with millions of people's faces to turn around and sell them to law enforcement organizations. Cambridge Analytica, by amassing digital dossiers of people through online quizzes, is another now-infamous company thought to have played a role in the Brexit and 2016 U.S. presidential elections (we'll leave those debates for another day). 

And though surveillance capitalism is running full steam, privacy is far from dead, but it is at an inflection point, and we all have a role to play, according to Véliz. She writes, "It's too late to prevent the data economy from developing in the first place — but it's not too late to reclaim our privacy. ... The decisions we make about privacy today and in the coming years will shape the future of humanity for decades to come." 


This urgency, this moment in time when people need to play a role in "reclaiming their privacy," is a driving force behind Véliz's call to action. 

The key to her argument is privacy's inexplicable ties to power. Whether we are talking about individuals, groups or entire societies, privacy plays a key role. "Human beings need privacy to be able to unwind from the burden of being with other people," Véliz writes. "We need privacy to explore new ideas freely, to make up our own minds. Privacy protects us from unwanted pressures and abuses of power. We need it to be autonomous individuals, and for democracies to function well, we need citizens to be autonomous." 

It's no coincidence that some of the most successful — and powerful — companies in the world have amassed incredible amounts of personal data. Tied to power, she points out — citing French post-structuralist philosopher Michel Foucault — is knowledge. The more knowledge companies have on individuals, the more ability they have to influence and nudge people. Privacy, on the other hand, can be empowering, allowing for more self-determination and personal dignity, or as Véliz points out, "Autonomy is the ability and right to govern yourself." 

Our autonomy, however, is challenged in a surveillance capitalist society.

Companies have an economic motivation to keep us attuned to our news feeds, to keep us on their application, website or service, so we can be served up more advertisements and buy more products. Tied to this is personalization. What I see in my news feed — from social posts to product advertisements to political propaganda — is based on my known interests and history online. That will be different than other individuals out there, even my neighbor or coworker. 

Taken to its logical extension, ubiquitous personalization, Véliz argues, creates an ecosystem that lacks a shared reality.

Taken to its logical extension, ubiquitous personalization, Véliz argues, creates an ecosystem that lacks a shared reality. Sure, it might behoove me to see those killer pair of kicks from Blundstone, but if I'm only seeing political advertisements from the far right, I'm likely not going to have a very easy conversation with a friend who only sees left-leaning political advertisements.

It's this lack of shared reality, on top of lack of personal autonomy, that has a greater impact beyond the individual. Surveillance capitalism, Véliz argues, challenges the health of liberal democracy. 

"As the Cambridge Analytica disaster shows, when you expose your privacy, you put us all at risk," she writes. She likens the paradigm to environmental issues. Everyone, for example, needs to reduce their carbon footprint for it to have an effect on global warming. Likewise, as we know all too well post-2020, public health during a pandemic, requires everyone to wear a mask and keep socially distanced. 

The same goes for privacy. Individual choices — say, my decision to use a DNA testing kit, even though my sister would rather I didn't — ultimately has an effect on my sister and the entire family. Véliz also notes that losses of privacy have a collective effect. "A culture of exposure damages society. It hurts the social fabric, threatens national security ... allows for discrimination, and endangers democracy." 

Indeed, Véliz's call to action is lofty, especially her belief that surveillance capitalism must end, which may sound uncomfortable to some privacy pragmatists and blatantly antithetical to others. Additionally, parts of the book are very consumer-oriented, so for the seasoned privacy pro, you've likely heard many of the examples within the book before, but there is plenty of fresh and important thinking in this book that's worth considering. 

Véliz calls on practitioners to exercise their moral and ethical compass within their businesses and organizations. This is a sentiment she echoed in an interview on The Privacy Advisor Podcast late last year. Through actions like privacy by design and default, employees can help empower individuals. "Whatever the case may be, if you are part of the workforce constructing our digital architecture, you have a big role to play in baking privacy into your products from the start," she writes. 

"In addition to thinking about profit," she adds, "those who build tech ought to ask themselves how they want to be remembered. ... Do you want to be seen as one of the people who broke democracy? Or do you want to be remembered as one of the people who helped fix the data landscape by offering users a way to navigate life in the digital age while retaining their privacy?" 

Policymakers have something to read here, as well. As governments consider more data protection laws and regulators explore privacy and antitrust enforcement, there's plenty of sage advice within Véliz's book. 

"We are not witnessing the death of privacy," Véliz contends. "Even though privacy is in distress, we are in a better place now to defend it than we have been for the past decade. This is only the beginning of the fight to safeguard personal data in the digital age." 

Photo by Nayani Teixeira on Unsplash

2021-03-23 14:07:04
DNA is no longer just for 'Law and Order' reruns anymore https://iapp.org/news/a/dna-is-no-longer-just-for-law-and-order-reruns-anymore https://iapp.org/news/a/dna-is-no-longer-just-for-law-and-order-reruns-anymore Maybe it's just me, but it seems like it's nearly impossible to keep track of all the different TV shows debuting on streaming services nowadays. Sure, Disney does well promoting its Marvel and Star Wars shows, but they also have enough money to outright own several states in the American Midwest if they wanted to.

In addition to the newly released Paramount+, there's Hulu, Netflix, Amazon Prime Video, Disney+, Apple TV+, HBO Max, Peacock and CBS All Access. Each one of these services has its own original programming they release throughout each month, and out of nowhere, one will all of a sudden become a big hit. "Bridgerton" debuted on Netflix last December and almost instantly it became an online sensation, but for the life of me, I can't remember any news about it before it was released.

The same can be said about a show that recently premiered on Netflix titled "The One," a show that follows a pair of business partners as they launch a company that helps people find their soulmate using DNA.

The show answers a question no one asked: What if Ancestry and Tinder became best friends?

Deoxyribonucleic acid has been a staple of cop shows for decades now. Nearly every episode of "Law and Order: Special Victims Unit" has at least one scene where DNA evidence is analyzed to try and catch a suspect. If you haven't seen "SVU," just turn on the USA Network. They play reruns of it approximately 14 hours a day.

But this is an example of DNA affecting a plot that doesn't involve a gruesome crime scene, and perhaps we shouldn't be surprised. Genealogy companies, such as Ancestry and 23andMe, have skyrocketed in popularity over the past decade, so it makes sense to see DNA testing find its way into pop culture.

Genealogy could be the basis for plenty of rich stories, as long as the material is handled with care. An example of this not being the case would be the 2013 film "Delivery Man." The movie features Vince Vaughn as a guy who discovered he fathered 533 children via a sperm bank. When a large group of that 533 sue to force a fertility clinic to reveal the identity of the donor, Vaughn's character counter-sues to maintain his privacy.

The plot is beyond outrageous, and the number of children they decided to have Vaughn sire makes it beyond parody. How are you supposed to think about privacy when a man fathered FIVE HUNDRED AND THIRTY-THREE CHILDREN?

This was marketed as a comedy by the way, and I hope I never have to talk about anything in the preceding paragraphs ever again. I feel like even writing out the synopsis of the movie has tanked whatever credibility I've accrued in my five years at the IAPP.

When I originally set out to write this column, I was going to talk about the real-world implications of DNA testing, particularly as it relates to when genealogy companies are tapped for law enforcement investigations. For example, privacy advocates raised concerns about FamilyTreeDNA in 2019 when it was discovered the organization allowed law enforcement to use 1.5 million genetic records without a warrant or consent.

Genetic genealogy helped track down the infamous "Golden State Killer," and the debate around whether these large banks of DNA should be used for the greater good is one that may cause some people to hesitate before spitting into a plastic tube.

Those were the talking points before I looked a little further into "The One." That's when I found out that genetic dating sites actually exist.

May I introduce you to DNA Romance and GenePartner.com. These websites claim they can find a person's perfect match by analyzing their genes. DNA Romance claims it can measure "romantic chemistry compatibility" using DNA markers. GenePartner centers its bizarre theories around finding romance based on having the opposite human leukocyte antigen molecules.

That wasn't my main takeaway from GenePartner. I couldn't stop staring at their homepage, which literally looks like it hasn't been touched since 2006.

I don't use this term lightly, but I am completely flabbergasted. I cannot believe these services actually exist, and I'm 99.6% sure they absolutely do not work. You don't have a Bush administration–looking website if your company is raking in the money.

I just can't wrap my head around who would actually sign up for this type of service either. Now even though I work for a privacy organization, I'm not super paranoid about my interactions with some of these things. I am currently awaiting Ancestry results as we speak, and I use the Amazon Echo Dot my brother gave me quite frequently.

But these services just seem like you are begging to have your information abused or, at the very least, the risk involved seems to greatly outweigh the reward. There are plenty of online dating services that don't require you to mail in your spit.

It's really strange, but I guess I shouldn't be too surprised at the end of the day. Art imitating life. Life imitating art. Sometimes the Venn diagram is just one circle.

Photo by Photoholgic on Unsplash

2021-03-23 14:06:33
Structured versus unstructured data, an engineer’s take on the privacy implications  https://iapp.org/news/a/structured-versus-unstructured-data-an-engineers-take-on-the-privacy-implications https://iapp.org/news/a/structured-versus-unstructured-data-an-engineers-take-on-the-privacy-implications For engineers who have to write privacy regulations into their code and lawyers who need engineering support to create scalable privacy programs, the difference between structured versus unstructured data makes a world of difference. 

Anyone who works in privacy will likely agree that unstructured data is one of the harder problems we face. Yet, privacy laws don’t care whether data is structured or unstructured – the regulations are still the same.

As an engineer and founder of a data privacy infrastructure company, here’s my first-hand account of the privacy implications for structured versus unstructured data. 

I’ll focus on exploring answers to three central questions that I hear time and time again from privacy teams building automated privacy requests at the code-level: 

1. What are the basics of structured data versus unstructured data?

2. What are the engineering implications for the two different types of data? 

3. How do engineers solve the challenges that unstructured data represent to privacy issues, like access and deletion requests? 

First, the basics of structured and unstructured data 

Let’s quickly unpack the difference between structured and unstructured data using relevant engineering examples. 

Structured data is data or user information represented inside a system in a strict, field-based format, making it easier to operate on data inside that structure. An overly simplified example of structured data is data filed under the First Name, Last  Name and Email fields in a database.  

Unstructured data is when data or user information is stored in a disorderly or unregulated way. Examples of this could include free form text in a software system, such as messages in a workplace chat software or text in a Word document. It is unstructured because it may appear randomly and isn’t arranged in any form or fashion, such as being linked to a particular user. 

What are the engineering implications of structured data? 

There are a few key engineering implications to consider for structured data. First off, structured data is typically stored in a “relational database,” such as MySQL or PostgreSQL. 

You can think of a relational database as an Excel spreadsheet. Imagine a table that keeps track of registered users, where the columns have headers for “User ID,” “First Name,” “Last Name” and “Email,” and each row contains the information of one registered user. 

Structured data also has relational structures. Continuing with our Excel spreadsheet analogy, at an e-commerce company, there will be a second table describing all purchases, where the columns have headers for “Order Number,” “Total Price” and “User ID,” and each row contains the details of a purchase and a reference to the User ID of the registered user who made the order. This shows the "relations" between the purchases table and the "registered users" table. When engineers talk about structured data for data privacy, they’re discussing data that is easier to operate on because engagement rules are more precise. 

For this reason, structured data is easier for engineers when handling a data privacy request. An engineer can write code to delete everything related to a particular user and watch with joy as it cleanly finds and deletes the appropriate data without harming or messing with anything else in the database. 

That’s not to say that every structured data system is easy. The application programming interfaces to operate on data in a given system can be tricky to work with, but the engineering concept is relatively straightforward: The data is stored in a strict format; an engineer can operate on it with consistency. 

In general, the most common engineering implication for structured data is a question about whether it is worth the effort to build versus buy all of the integrations needed to process a data subject access or deletion request across the many data systems a company uses. API integrations come with maintenance (e.g., APIs can change), and the build cost can require an engineering investment of many months.  

For companies that have hundreds of different data systems, engineers may look for privacy developer tools that can empower them to have structured data system integrations that easily process thousands of access and deletion requests a month with absolutely no humans in the loop. 

What are the engineering implications of unstructured data? 

Unstructured data, in contrast to structured data, is a much harder challenge. That said, all is not lost. The good news is the engineering implications of unstructured data may not be as dire or impossible as you might think. 

First off, if you’re frustrated by unstructured data, you are not alone. In an IAPP-EY governance survey, more than half of respondents (56%) said “locating unstructured personal data” was the most difficult issue in responding to data subject access requests. Unstructured data far outpaced the challenges of “monitoring data protection/privacy practices of third parties” (36%), “data minimization” (28%), or developing a centralized opt-out tool (25%).

It’s no surprise unstructured data can be challenging for engineers and data privacy program managers because unstructured data offers fewer engagement rules to guide the writing of code. To put it another way, it is harder to write code to automate user deletion and access requests if it is harder to identify where a user’s data is, find all of it completely, untangle it from the other data it may live within, and write clean "rules of engagement" for performing the necessary privacy task.  

To bring this problem to life, you can imagine an unstructured data system as an artistic drawing as opposed to our neat structured excel sheet discussed above with all sorts of different users and user information looped together and inter-related in all sorts of swoops and patterns. The data might depend on each other to tell a bigger story, or it may be presented in random brush strokes with no apparent rhyme or reason for an engineer to code against. 

When I think of unstructured data, I often think first of the data system of a messaging application in which millions of messages are being populated about various topics and people across hundreds of channels, from main channels, direct message channels, specific channels and more. Unstructured data is also common in customer support tickets or emails. Finding and deleting all the mentions of one person’s data from that mess can feel impossible.

Locating where the user data is in an unstructured data system is a part of an engineer’s challenge. If you don’t have some sort of user identifier to search for, your engineers are going to struggle. Imagine an employee’s data as an example: someone talking about a particular employee but with their first name and not their corresponding email address or phone number. How is an engineer supposed to find that when they are given no user identifier that locates the information? In general, it’s easier to find if there is some sort of unique search term, such as a phone number, email address or account name. The key or identifier plays a big first step in helping engineers create powerful systems that operate on data in unstructured data systems. 

To dive deeper into unstructured data, let’s look at processing a deletion request. An engineer working to encode deletion requests into unstructured data systems will need to find a way to erase at scale one person’s data from a big, messy pool of mixed data. For the engineer or, more likely, an engineering team, there will not be a neat and tidy entry point to make a clean cut — i.e., a way to reliably get in and get out without impacting the rest of the data, doing an incomplete job or executing deletion on the wrong data. In unstructured data, an engineer can’t just delete an individual user’s row or the data fields within a larger dataset.

And if you thought the engineering implications of deletion in unstructured data was hard, access requests are even harder. Often in unstructured data, the data doesn’t belong to just one person. Engineers can’t give users access to mixed data, like a chat message, because it doesn’t just belong to them. So instead, with access requests and unstructured data, engineers often have to create a system to give data access to one specific person. 

For most privacy teams, unstructured data stands in the way of being automated and fully privacy compliant across their privacy program. Many companies find the task so daunting that they are pushing it to the background or working through inefficient manual searches. But that’s part of a false option that exists in the market today. If you are a large company that wants to get to more efficient and resource-light privacy compliance, you need the ability to handle unstructured data with automation — and the tools exist to do so.

Tying it all together

From an engineer’s perspective, the difference in difficulty between structured and unstructured is immense. In fact, it is so stark that on the engineering side, I often see teams prematurely attempt to build their own automated solutions when they have only dipped their toes into structured data systems. A common assumption is they’ll handle a few APIs here and there and perhaps some overhead maintenance and done! But when these same teams start to encounter unstructured data, they quickly realize that doing this on their own may be more costly than they expected in terms of the financial and staff investment. 

Many legal privacy leaders, as well, have been taught that unstructured data is too complicated to be automated, but this is no longer true. There are engineering options that remove ever-growing headcount costs, negating the need for workflow tooling or shoulder-tapping, and creating fully automated end-states that operate on access and deletion requests in the data layer. The best part is that it’s not just access and deletions; operating on unstructured data can also automate litigation holds and other legal operations so they run and compile as quickly as the software performs the task (often in seconds or minutes). 

The takeaway is that despite all of the engineering challenges, unstructured data is not something that should continue to stump privacy teams. For example, our own tools power privacy requests for unstructured data in numerous data systems for other companies in finance, retail and consumer technology. 

Lastly, when looking at engineering implications, it’s always worth considering what’s coming around the corner. In the future, I believe unstructured data systems will only continue to get easier to grapple with, as engineers continue to apply advancements in artificial intelligence and machine learning models that can help offer predictive insights to where user data might be. 

Today’s data-mapping capabilities can give way to future predictions and modeling for where data could end up later on. We can already locate any key instance in an unstructured data system anywhere for access or deletion. In the future, we may want the ability to create forward-looking maps of where data might be. 

In the end, with structured and unstructured data, both can present their own engineering challenges unless you have sufficient data privacy infrastructure in place and a plan for the future. 

Photo by Sai Kiran Anagani on Unsplash

2021-03-23 14:05:14
Vaccine passports gaining traction, privacy conversations key https://iapp.org/news/a/vaccine-passports-gaining-traction-privacy-conversations-key https://iapp.org/news/a/vaccine-passports-gaining-traction-privacy-conversations-key It has been just over a year since COVID-19 halted international travel, emptied sports stadiums and event venues, and transported many employees’ workdays from offices to homes. As vaccinations against the virus continue to rise, a return to normalcy is anxiously anticipated, with attention quickly turning to just what navigating a post-pandemic world could look like.

Digital vaccine passports or health credentials that could be used to verify a person’s COVID-19 vaccination status or test results are gaining traction around the world to potentially reopen travel and more.

The European Commission last week proposed a “Digital Green Certificate” that would verify a person’s vaccination against a COVID-19 negative test result or recovery from the virus. The certificate would include a QR code to confirm authenticity. European Commission Vice President for Values and Transparency Vĕra Jourová called it “a good message in support of recovery,” adding, “Our key objectives are to offer an easy to use, non-discriminatory and secure tool that fully respects data protection.”

China has already launched a vaccine passport for domestic travelers. Air New Zealand is planning to launch a digital health application next month that features a vaccine passport program. And in the U.S., though the Centers for Disease Control said even those vaccinated should avoid travel, airlines are asking for federal guidance on temporary health credentials to monitor travelers’ negative COVID-19 tests and vaccinations. 

But the idea of using digital vaccination credentials to regain access to areas of society is concerning for some, like Italy’s data protection authority, the Garante, which issued guidance stating vaccination data is “particularly delicate,” and “incorrect treatment can have very serious consequences for the life and fundamental rights of people.”

Hogan Lovells Partner Eduardo Ustaran, CIPP/E, said vaccine passports raise questions around necessity, fairness and reliability, familiar questions for those dealing with personal data protection. But applying data protection principles to the rollout of vaccine passports could enable them to play a fair and safe role in a return to normalcy, he said.

In particular, he said any health-related data should only be used for the intended purpose, only necessary data should be collected and used, and accuracy, data security and accountability should be ensured.

“It is obvious to me that you have to apply the concept of a data protection impact assessment. You basically assess what information do we need here, how is it going to be stored and shared and for how long and who has access to this information,” Ustaran said. “It’s almost like a brainstorming mechanism to really think that through so that when you go and design the product or the tool, you’ve taken into account those issues, those principles.”

Data sharing, use ‘is actually pretty straightforward’

Future of Privacy Forum Vice President of Policy John Verdi said sharing data in the context of COVID-19 vaccination passports “is actually pretty straightforward.” While other health diagnoses can include medical scans, clinical notes, blood test results or symptoms, for example, a digital COVID-19 vaccination passport would detail whether an individual had been vaccinated or not. He likened it to a driver’s license used to determine whether an individual is 21 years or older before purchasing alcohol in the U.S.

The EU’s Digital Green Certificate would include an individual’s name, birthdate, date of issuance, and vaccine, test or recovery information, according to the European Commission, and the certificate system would be suspended when the World Health Organization declares the end of the health emergency.

“In this case, you’re not talking about reams of health data; you are talking about a simple fact. Has this person been vaccinated or not?” Verdi said. “The mere fact of vaccination or not does run the risk of pulling in a whole host of other health data in order to validate it in the same way that a clinical diagnosis might.”

Proof of vaccinations is not a new concept, said Verdi, who added examples of mass vaccination initiatives have been seen in the U.S. and around the world.

“One would say that we really have one every summer when young people start to go through K-12 school,” he said. “These sorts of mass vaccination initiatives are not new, they are different than what is going on with (COVID-19), but they have implications for students attending school, they have implications for teachers and other adults who attend those schools, they have implications in the workplace, they have implications regarding travel.”

Verdi pointed out that as vaccine passport programs are designed and implemented, it will be important to be realistic about authenticity and the potential for falsified vaccination data and plan accordingly.

“Going in and saying we know these vaccine passports to be 100% accurate is probably not going to align with the real world,” he said. “When individuals must be vaccinated in order to return to work, school, to travel, there are massive incentives to either get vaccinated or if you cannot because of limited supply or other reasons, there are incentives to falsify.”

Ustaran said it is crucial the authenticity of vaccine passports be verified, noting technology “can play a very crucial role in securing things.”

“It’s not just a matter of data security or cybersecurity, from a public policy perspective this has to work. If you have a percentage of these that are fake, what’s the value,” Ustaran said.

Opening doors

The Fédération Internationale de Football Association’s Club World Cup 2020 held in early February – the organization’s first post-COVID-19 event – welcomed fans to two stadiums in Qatar.

“This was the first testing event, a very small event that wanted to open the doors to fans, and in fact, it opened the doors to fans,” FIFA Head of Data Protection Jorge Oliveira, CIPM, said of the competition that gathered teams from Qatar, Egypt, Germany, Brazil, Mexico and Korea.

Games were held at two stadiums, each match attended by approximately 20,000 fans, he said, and the only known case of COVID-19 to be identified was prior to the games. A German player tested positive, subsequently isolating for 14 days and not playing in the competition, Oliveira said.

Stadiums were limited to approximately 30% capacity, Oliveira said, and fans were asked to provide proof of vaccination or immunity due to being infected with COVID-19 in the three months prior to the competition. Those who were not vaccinated or previously diagnosed were required to take a COVID-19 test at the Qatar National Convention Centre within the 72 hours prior to the event and could only collect tickets if tested negative.

Oliveira said these details were organized by the Qatari Supreme Committee for Delivery & Legacy, with FIFA ensuring any data accessed and collected was done correctly. “Concerning the plan from our perspective, it was very important to ensure the privacy and security of the fans themselves,” Oliveira said.

FIFA is now reviewing the event and will use data on attendance, the number of attendees vaccinated and so on to craft a plan for the FIFA World Cup to be held in Qatar in December 2022, Oliveira said. It is also negotiating with the committee about implementing a “Fan ID,” potentially including immunity passports, during the FIFA Arab Cup to be held in December 2021, he said.

“From a data protection perspective, we need to ensure the security of individuals’ information, if we are really working with health data that we collect with the consent of individuals,” he said.

While the concept of vaccine passports is not a new one, it’s clear privacy and authenticity are key considerations as these initiatives continue to be contemplated and rolled out around the world in response to COVID-19. While organizations like FIFA are exploring options with privacy and security in mind, approaches will be different everywhere, and as Verdi said, “the future is unwritten.”

“I think it remains to be seen what role these sorts of immunity passports or vaccine licenses will play,” he said. “Will it be a small role? Will it be a large role? Will it largely be a beneficial role? Will it be something in the middle? We don’t know.”

Photo by CDC on Unsplash

2021-03-23 14:05:14