June 2023

Data Privacy Frontline Report

June 2023

Here are key highlights from June 2023 detailing global news and regulatory updates.

US & Canada

  • Canada’s draft Artificial Intelligence and Data Act (AIDA) explored in a scholarly review of the content and constraints shaping the Act
  • Canada’s Office of the Privacy Commissioner (OPC) provides guidance on the practice of data de-identification in a new report of findings from a completed investigation
  • Florida enacts a privacy law, but one that only applies to companies making more than $1 billion in annual revenue
  • Nevada passes a health data privacy bill modeled after Washington’s My Health My Data Act, with finalization of the bill pending the governor’s approval
  • Oregon is set to finalize SB 619, an act related to protecting the personal data of consumers that would take effect July 1, 2024
  • Quebec’s Bill 64—with most of its key provisions entering into force on September 22—places the province’s privacy laws between those of Canada and Europe
  • Texas is poised to become the 10th state to have a comprehensive privacy law, with the new bill slated to take effect on July 1, 2024
  • US Federal Communications Commission (FCC) announces the establishment of a new Privacy and Data Protection Task Force to coordinate on privacy and data protection sector needs
  • US Federal Trade Commission (FTC) proposes changes to clarify the Health Breach Notification Rule, formalizing interpretations consistent with recent enforcement decisions, such as against GoodRx
  • US and UK announce the Atlantic Declaration, the latest step in a comprehensive partnership on data and artificial intelligence that would provide organizations in the UK with a streamlined route to transfer data to the US (also in EMEA)

EMEA

  • EU appears to be moving towards a more pragmatic risk-based approach to anonymization
  • France’s data protection authority (CNIL) imposes fine of 40 million euros on the Internet advertising group Criteo for violations related to ad retargeting that did not sufficiently anonymize individuals
  • Nigeria’s President signs the Nigeria Data Protection Bill, 2023, into law, establishing the Nigeria Data Protection Commission and replacing the Nigeria Data Protection Bureau (NDPB) established in February
  • UK’s Information Commissioner’s Office (ICO) urges organizations to harness the power of data safely by using privacy enhancing technologies
  • UK’s ICO recommends changes to the definition of personal data in the UK’s draft Data Protection and Digital Information
  • UK National Health Service (NHS) trusts shared patient details with Facebook without consent through covert tracking tools in their websites
  • UK and US announce the Atlantic Declaration, the latest step in a comprehensive partnership on data and artificial intelligence that would provide organizations in the UK with a streamlined route to transfer data to the US (also in US & Canada)

Gain confidence to use and share sensitive data

Find out how our advisory services can help you safely leverage data derived from information about people. Watch this 15-minute webinar.

Watch On-Demand Now

APAC

  • India’s Digital Personal Data Protection Bill to appear on their parliament’s upcoming agenda

LATAM

  • Bermuda’s Personal Information Protection Act (PIPA) 2016 to take effect on January 1, 2025
  • Brazil’s national data protection authority (ANPD) publishes guidance on the processing of personal data for academic purposes (Portuguese only)
  • Ecuador’s Personal Data Protection Law (PDPL), which came into effect May 26, 2023, may still be challenging to implement

Global

  • G7 data protection authorities endorse 3-pillar plan and are engaged in discussions to foster a common understanding of key concepts such as anonymization, de-identification, and privacy enhancing technologies

Archiving / Destroying

Are you unleashing the full value of data you retain?

Your Challenges

Do you need help...

  • Unleashing the full value of retained data so they can be put to work safely and responsibly in line with privacy regulation?
  • Defining and implementing effective archival and disposal processes for personal data?

OUR SOLUTION

Value Retention

  • Retain the business value in your data through anonymization.
  • Ensure compliance in your retention & destruction strategy.
  • Maximize the reuse of information by removing what is personal.

Client Success

Client: Comcast

Situation: California’s Consumer Privacy Act inspired Comcast to evolve the way in which they protect the privacy of customers who consent to share personal information with them.

Read the full story >

Evaluating

Are you achieving intended outcomes from data?

Your Challenge

Do you need help...

  • Optimizing the use / analysis of data to achieve your organization’s intended outcomes with measured success?

OUR SOLUTION

Unbiased Results

  • Reduce / minimize risk of bias in your data for machine learning.
  • Ensure transparency, fairness, and AI ethics / compliance.
  • Ensure data ethics & compliance in your data models and results.

Client Success

Client: Integrate.ai

Situation: Integrate.ai’s AI-powered tech helps clients improve their online experience by sharing signals about website visitor intent. They wanted to ensure privacy remained fully protected within the machine learning / AI context that produces these signals.

Read the full story >

Accessing

Do the right people have the right data?

Your Challenges

Do you need help...

  • Ensuring the right people have access to the right data at the right times?

OUR SOLUTION

Usable and Reusable Data

  • Enable internal access and / or external sharing of data for primary and / or secondary uses.
  • Ensure data are useful and reusable in alignment with FAIR principles.
  • Ensure data have the right level of privacy protection for the use.

Client Success

Client: Novartis

Situation: Novartis’ digital transformation in drug R&D drives their need to maximize value from vast stores of clinical study data for critical internal research enabled by their data42 platform.

 

See the full story >

Maintaining

Are you empowering people to safely leverage trusted data?

Your Challenges

Do you need help...

  • Maintaining / processing data securely and efficiently to promote data enablement with auditable proof of compliance?

OUR SOLUTION

Security / compliance efficiency

  • Creating synthetic versions of data to be used for innovation / AIML.
  • Applying data minimization principles to reduce your risk exposure.
  • Transforming your data for secondary uses and access.

CLIENT SUCCESS

Client: ASCO’s CancerLinQ

Situation: CancerLinQ™, a subsidiary of American Society of Clinical Oncology, is a rapid learning healthcare system that helps oncologists aggregate and analyze data on cancer patients to improve care. To achieve this goal, they must de-identify patient data provided by subscribing practices across the U.S.

 

Visit ASCOPubs.org to read the full story >

Acquiring / Collecting

Are you acquiring the right data? Do you have appropriate consent?

Your Challenge

Do you need help...

  • Ensuring the acquisition / collection of the right data under the appropriate consent / contracts to maintain corporate integrity?

OUR SOLUTIONS

Consent / Contracting strategy

  • Developing a consent / contractual framework for collecting / sourcing.
  • Creating a comms strategy for internal / external stakeholders.
  • Ingesting and transforming data safely to earn trust.

Client Success

Client: IQVIA

Situation: Needed to ensure the primary market research process was fully compliant with internal policies and regulations such as GDPR. 

 

Read the full story >

Planning

Are You Effectively Planning for Success?

Your Challenges

Do you need help...

  • Defining a clear data strategy to achieve desired outcomes?
  • Getting it right at the start to avoid costly privacy missteps later?

OUR SOLUTION

Build privacy in by design

  • Building privacy into your data plan / platform / pipeline upfront.
  • Establishing a trusted data strategy (ethics, compliance, privacy).

Client Success

Client: Nuance

Situation: Needed to enable AI-driven product innovation with a defensible governance program for the safe and responsible use
of voice-to-text data under Shrems II.

 

Visit Nuance.com to read the full story >

Join the next 5 Safes Data Privacy webinar

This course runs on the 2nd Wednesday of every month, at 11 a.m. ET (45 mins). Click the button to register and select the date that works best for you.

Register Now