Here are key highlights from May 2023 detailing global news and regulatory updates.
US & Canada
- Canada’s Bill C-27 still needs work to get over the finish line and may not pass this year, while the draft Artificial Intelligence and Data Act (AIDA) leaves many questions unanswered
- Canada’s Office of the Privacy Commissioner submits recommended changes to Bill C-27, (see also the Canadian Anonymization Network (CANON) proposed amendments)
- Florida lawmakers pass a privacy bill with limited opt-out rights
- Indiana governor signs a comprehensive privacy act into law
- New York State has regulation under review that requires disclosure of any use of synthetic data
- Quebec’s data privacy authority announced a consultation on the collection of consent, with comments due by June 25
- Texas set to become the tenth state—and the fifth in 2023—to pass comprehensive privacy legislation
EMEA
- African Union Convention on Cyber Security and Personal Data Protection (the “Malabo Convention”) set to come into force after Mauritania becomes 15th state to submit its ratification
- EU Court of Justice of the European Union rules that a data subject has the right to obtain a “faithful and intelligible reproduction” of all data, including entire documents or database extracts if necessary
- EU GDPR Data Protection by Design and by Default (Article 25) obligations and related enforcement trends analyzed in a report from the Future of Privacy Forum showing Article 25 is a frequent source of some of the highest GDPR fines
- EU General Court ruling nuances the threshold between pseudonymous and anonymous data, opening the possibility of pseudonymized data not being deemed personal data
- EU members of the European Parliament adopt a resolution arguing that the European Commission should not grant an adequacy decision to the United States
- EU’s GDPR turns 5 years old (with an IAPP infographic)
- France’s national data protection authority fines DOCTISSIMO €380,000 for failing to comply with obligations under the GDPR, including storing data for longer than necessary
- Meta fined GDPR-record 1.2 billion euros in data transfer case for the unlawful processing, including storage, in the U.S. of personal data
- Spain’s data protection authority issues guidance on data spaces—such as the European Health Data Space—recommending anonymization, pseudonymization and data minimization before data is stored
- Taiwan increases its fines for data breaches
Gain confidence to use and share sensitive data
Find out how our advisory services can help you safely leverage data derived from information about people. Watch this 15-minute webinar.
APAC
- Australia’s labor government appoints dedicated privacy commissioner to combat data breaches
- Australia’s Medibank, a major private health insurer, faces a third class-action suit over an October 2022 data breach, in part for failing to destroy or de-identify customer data
- Australian and New Zealand privacy commissioners announced a landmark joint investigation into the hack of Latitude Financial, which exposed personal details of millions of consumer finance customers
- China announces the issuance of 12 sets of national standards on cybersecurity, including one on personal information de-identification
- New Zealand’s privacy commissioner outlines expectations around AI use outlining seven points of advice to help businesses and organizations engage with the potential of AI in a way that respects people’s privacy rights
LATAM
- Chile’s Chamber of Deputies approves personal data processing rules
Global
- International anonymization and de-identification requirements—including from the EU, the UK and the US—examined in this IAPP article