January 2025

Data Privacy Frontline Report

January 2025

Here are key highlights from January 2025 detailing global news and regulatory updates.

US & Canada

  • Alberta updates its public sector access and privacy legislation, establishing rules about de-identification that explicitly address synthetic data
  • California attorney general reminds businesses and healthcare entities developing or using AI of their obligations under state law and provides an overview of existing laws that may apply
  • Canada’s proposed Bill C-27 faces an uncertain future following the resignation of Canada’s prime minister as party leader
  • US current president revokes executive order that aimed to mitigate AI risk, with some supporters of the move arguing the executive order was onerous and forced companies to disclose trade secrets

EMEA

  • EU Council of the European Union adopts regulation establishing the European Health Data Space (EHDS) to improve individual access to health data and enable reuse of certain health data for research and innovation
  • EU European Commission presents action plan to reinforce cybersecurity of hospitals and healthcare providers
  • EU European Data Protection Board (EDPB) publishes draft guidelines on pseudonymization, including a discussion of how pseudonymization can reduce legal risks
  • EU European General Court ruling clarifies that the EDPB can oblige supervisory authorities in the EU to further explore GDPR violations
  • Kenya presents draft AI strategy that includes a comprehensive framework for the development of AI
  • Spanish ministry for digital transformation releases guidance on privacy enhancing technologies (PETs), exploring what they are and how they work

Gain confidence to use and share sensitive data

Find out how our advisory services can help you safely leverage data derived from information about people. Watch this 15-minute webinar.

APAC

  • Asia’s Association of Southeast Asian Nations (ASEAN) issues introductory guide to anonymization of personal data, primarily targeting governments and industry associations that process personal data
  • India holds public consultation on draft rules to operationalize the Digital Personal Data Protection Act (DPDPA), which was finalized in August 2023

LATAM

  • Argentina approves cybersecurity and cybercrime prevention plan, which seeks to promote security of information technologies

Global

  • Data protection and privacy laws now enacted in 144 countries around the globe, with new privacy laws in 2024 in Cameroon, Ethiopia, Malawi, the Republic of Moldova, and the Vatican City

Archiving / Destroying

Are you unleashing the full value of data you retain?

Your Challenges

Do you need help...

OUR SOLUTION

Value Retention

Client Success

Client: Comcast

Situation: California’s Consumer Privacy Act inspired Comcast to evolve the way in which they protect the privacy of customers who consent to share personal information with them.

Evaluating

Are you achieving intended outcomes from data?

Your Challenge

Do you need help...

OUR SOLUTION

Unbiased Results

Client Success

Client: Integrate.ai

Situation: Integrate.ai’s AI-powered tech helps clients improve their online experience by sharing signals about website visitor intent. They wanted to ensure privacy remained fully protected within the machine learning / AI context that produces these signals.

Accessing

Do the right people have the right data?

Your Challenges

Do you need help...

OUR SOLUTION

Usable and Reusable Data

Client Success

Client: Novartis

Situation: Novartis’ digital transformation in drug R&D drives their need to maximize value from vast stores of clinical study data for critical internal research enabled by their data42 platform.

 

Maintaining

Are you empowering people to safely leverage trusted data?

Your Challenges

Do you need help...

OUR SOLUTION

Security / compliance efficiency

CLIENT SUCCESS

Client: ASCO’s CancerLinQ

Situation: CancerLinQ™, a subsidiary of American Society of Clinical Oncology, is a rapid learning healthcare system that helps oncologists aggregate and analyze data on cancer patients to improve care. To achieve this goal, they must de-identify patient data provided by subscribing practices across the U.S.

 

Acquiring / Collecting

Are you acquiring the right data? Do you have appropriate consent?

Your Challenge

Do you need help...

OUR SOLUTIONS

Consent / Contracting strategy

Client Success

Client: IQVIA

Situation: Needed to ensure the primary market research process was fully compliant with internal policies and regulations such as GDPR. 

 

Planning

Are You Effectively Planning for Success?

Your Challenges

Do you need help...

OUR SOLUTION

Build privacy in by design

Client Success

Client: Nuance

Situation: Needed to enable AI-driven product innovation with a defensible governance program for the safe and responsible use
of voice-to-text data under Shrems II.

 

Join the next 5 Safes Data Privacy webinar

This course runs on the 2nd Wednesday of every month, at 11 a.m. ET (45 mins). Click the button to register and select the date that works best for you.