Adapting Privacy Programs for New Challenges: Your H1 2024 Roadmap

By Sam Castic

This past year has been a busy year for privacy leaders and professionals, and the pace of change underscores that reactive approaches to new laws, regulations, and enforcement actions are not effective ways to build or scale privacy programs.  Laws and risks will continue to evolve, and strategically planning and evolving existing privacy programs may be the best way to keep them effective. 

Read More

Draft California Automated Decisionmaking Technologies Regulations to Be Revised Before Formal Rulemaking

By Charlotte Lunday

On December 8, 2023, the CPPA met to discuss these and other proposals they are considering for formal rulemaking in 2024. The December 8th meeting produced lively discussions and ultimately concluded with a motion (which passed) to provide CPPA staff more time to solicit individual feedback from Board members to revise the current draft of ADMT and risk assessment regulations.

Read More

California Issues Discussion Draft of Regulations on Automated Decision-Making Technology Ahead of Board Meeting  

By Charlotte Lunday

On November 27, 2023, the California Privacy Protection Agency (“CPPA”) issued a discussion draft of regulations on automated decisionmaking technology (“Discussion Draft on ADT”) and amended regulations on risk assessments (“Discussion Draft on Risk Assessments”) (collectively, “the Discussion Drafts”). The Discussion Drafts include requirements related to (1) notice, (2) opt-outs, and (3) access rights, which are discussed below. Importantly, the CPPA has not initiated the formal rulemaking process and the Discussion Drafts are intended only to “facilitate Board discussion and public participation.” The CPPA’s announcement of these Discussion Drafts indicates that formal rulemaking will not begin until 2024, although the exact timing is still unknown.  

Read More

EDPB Publishes Draft Guidelines on Tracking Technologies Under the ePrivacy Directive

By Cameron Cantrell

On Wednesday, November 15, 2023, the European Data Protection Board (“EDPB”) announced new draft guidance titled “Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive” (the “Guidelines”), which the EDPB says “aims to clarify which technical operations, in particular new and emerging tracking techniques, are covered by the Directive, and to provide greater legal certainty to data controllers and individuals.”

Read More

Summary Chart of India’s Digital Personal Data Protection Act

By Alex Schlight

After 5-years of legislative back and forth, India passed its new comprehensive privacy law, the Digital Personal Data Protection (“DPDP”) Act, last month.

This week, India’s Minister of State for Electronics and IT said that companies will be given around a year’s time to comply with the Act (though certain organizations like small companies or start-ups may have more time). Given the number of important differences under the Act when compared to the EU’s GDPR or recent US state privacy laws, organizations should start working towards compliance with the Act now.

Read More

FTC Orders Data Brokers to Pay $5.8 million for FCRA and FTC Act Violations

By Destiny Ginn

Under a proposed stipulated order dated September 11, 2023, background check providers, Instant Checkmate, TruthFinder, The Control Group media company, IntelicareDirect, and PubRec, will be required to pay $5.8 million for alleged violations of the Fair Credit Reporting Act (FCRA) for activities as consumer reporting agencies (CRA) and of the Federal Trade Commission Act (FTC Act) for deceptive activities.  

Read More