March 2022

Data Privacy Frontline Report

March 2022

Here are key highlights from March 2022 detailing global news and regulatory updates.

US & Canada

Canadian Bar Association identifies ways to improve the next federal privacy bill

US, EU, agree ‘in principle’ to new trans-Atlantic data agreement, details still unknown

US state of Utah enacts comprehensive consumer privacy legislation, taking effect Dec. 31, 2023

US Senators propose commission to study modernizing HIPAA: more details

US President Biden signs law on reporting critical infrastructure cyberattacks, with relevant entities to report attacks within 72 hours

US lawsuit gives peek into shadowy world of data brokers and shows need for data privacy law


African data protection authorities sign MOU to advance enforcement and harmonization of data protection laws

EU, US, agree ‘in principle’ to new trans-Atlantic data agreement, details still unknown (as noted above under US & Canada)

EU Parliament, Council reach deal on Digital Markets Act to regulate large tech platforms

EU proposal for the European Health Data Space Regulation revealed, addressing both primary and secondary health data use

EU’s EDPB releases guidelines on “dark patterns”, practices that manipulate online user decisions about personal data

EU cybersecurity agency ENISA calls for research on pseudonymization to bolster data protection in the healthcare sector

Saudi Arabia’s data and AI authority postpones data protection law implementation until Mar. 2023

UAE law in Dubai International Financial Centre enacted, including amendments to Data Protection Law of 2020

UK‘s post-Brexit international data transfer agreement enters into force, broadly mirroring GDPR rules

UK Information Commissioner’s Office (ICO) requests feedback on latest chapter of its guidance on anonymization, pseudonymization and privacy enhancing technologies


China’s Personal Information Protection Law: An in-depth look at the rules on international data transfers

Singapore’s Personal Data Protection Commission publishes guide on anonymization

Sri Lankan parliament passes data protection act after a series of amendments


No updates reported this month

Archiving / Destroying

Are you unleashing the full value of data you retain?

Your Challenges

Do you need help...


Value Retention

Client Success

Client: Comcast

Situation: California’s Consumer Privacy Act inspired Comcast to evolve the way in which they protect the privacy of customers who consent to share personal information with them.


Are you achieving intended outcomes from data?

Your Challenge

Do you need help...


Unbiased Results

Client Success


Situation:’s AI-powered tech helps clients improve their online experience by sharing signals about website visitor intent. They wanted to ensure privacy remained fully protected within the machine learning / AI context that produces these signals.


Do the right people have the right data?

Your Challenges

Do you need help...


Usable and Reusable Data

Client Success

Client: Novartis

Situation: Novartis’ digital transformation in drug R&D drives their need to maximize value from vast stores of clinical study data for critical internal research enabled by their data42 platform.



Are you empowering people to safely leverage trusted data?

Your Challenges

Do you need help...


Security / compliance efficiency


Client: ASCO’s CancerLinQ

Situation: CancerLinQ™, a subsidiary of American Society of Clinical Oncology, is a rapid learning healthcare system that helps oncologists aggregate and analyze data on cancer patients to improve care. To achieve this goal, they must de-identify patient data provided by subscribing practices across the U.S.


Acquiring / Collecting

Are you acquiring the right data? Do you have appropriate consent?

Your Challenge

Do you need help...


Consent / Contracting strategy

Client Success

Client: IQVIA

Situation: Needed to ensure the primary market research process was fully compliant with internal policies and regulations such as GDPR. 



Are You Effectively Planning for Success?

Your Challenges

Do you need help...


Build privacy in by design

Client Success

Client: Nuance

Situation: Needed to enable AI-driven product innovation with a defensible governance program for the safe and responsible use
of voice-to-text data under Shrems II.


Join the next 5 Safes Data Privacy webinar

This course runs on the 2nd Wednesday of every month, at 11 a.m. ET (45 mins). Click the button to register and select the date that works best for you.