May 2023

Data Privacy Frontline Report

May 2023

Here are key highlights from May 2023 detailing global news and regulatory updates.

US & Canada

  • Canada’s Bill C-27 still needs work to get over the finish line and may not pass this year, while the draft Artificial Intelligence and Data Act (AIDA) leaves many questions unanswered
  • Canada’s Office of the Privacy Commissioner submits recommended changes to Bill C-27, (see also the Canadian Anonymization Network (CANON) proposed amendments)
  • Florida lawmakers pass a privacy bill with limited opt-out rights
  • Indiana governor signs a comprehensive privacy act into law
  • New York State has regulation under review that requires disclosure of any use of synthetic data
  • Quebec’s data privacy authority announced a consultation on the collection of consent, with comments due by June 25
  • Texas set to become the tenth state—and the fifth in 2023—to pass comprehensive privacy legislation

EMEA

  • African Union Convention on Cyber Security and Personal Data Protection (the “Malabo Convention”) set to come into force after Mauritania becomes 15th state to submit its ratification
  • EU Court of Justice of the European Union rules that a data subject has the right to obtain a “faithful and intelligible reproduction” of all data, including entire documents or database extracts if necessary
  • EU GDPR Data Protection by Design and by Default (Article 25) obligations and related enforcement trends analyzed in a report from the Future of Privacy Forum showing Article 25 is a frequent source of some of the highest GDPR fines
  • EU General Court ruling nuances the threshold between pseudonymous and anonymous data, opening the possibility of pseudonymized data not being deemed personal data
  • EU members of the European Parliament adopt a resolution arguing that the European Commission should not grant an adequacy decision to the United States
  • EU’s GDPR turns 5 years old (with an IAPP infographic)
  • France’s national data protection authority fines DOCTISSIMO €380,000 for failing to comply with obligations under the GDPR, including storing data for longer than necessary
  • Meta fined GDPR-record 1.2 billion euros in data transfer case for the unlawful processing, including storage, in the U.S. of personal data
  • Spain’s data protection authority issues guidance on data spaces—such as the European Health Data Space—recommending anonymization, pseudonymization and data minimization before data is stored
  • Taiwan increases its fines for data breaches

Gain confidence to use and share sensitive data

Find out how our advisory services can help you safely leverage data derived from information about people. Watch this 15-minute webinar.

APAC

  • Australia’s labor government appoints dedicated privacy commissioner to combat data breaches
  • Australia’s Medibank, a major private health insurer, faces a third class-action suit over an October 2022 data breach, in part for failing to destroy or de-identify customer data
  • Australian and New Zealand privacy commissioners announced a landmark joint investigation into the hack of Latitude Financial, which exposed personal details of millions of consumer finance customers
  • China announces the issuance of 12 sets of national standards on cybersecurity, including one on personal information de-identification
  • New Zealand’s privacy commissioner outlines expectations around AI use outlining seven points of advice to help businesses and organizations engage with the potential of AI in a way that respects people’s privacy rights

LATAM

  • Chile’s Chamber of Deputies approves personal data processing rules

Global

  • International anonymization and de-identification requirements—including from the EU, the UK and the US—examined in this IAPP article

Archiving / Destroying

Are you unleashing the full value of data you retain?

Your Challenges

Do you need help...

OUR SOLUTION

Value Retention

Client Success

Client: Comcast

Situation: California’s Consumer Privacy Act inspired Comcast to evolve the way in which they protect the privacy of customers who consent to share personal information with them.

Evaluating

Are you achieving intended outcomes from data?

Your Challenge

Do you need help...

OUR SOLUTION

Unbiased Results

Client Success

Client: Integrate.ai

Situation: Integrate.ai’s AI-powered tech helps clients improve their online experience by sharing signals about website visitor intent. They wanted to ensure privacy remained fully protected within the machine learning / AI context that produces these signals.

Accessing

Do the right people have the right data?

Your Challenges

Do you need help...

OUR SOLUTION

Usable and Reusable Data

Client Success

Client: Novartis

Situation: Novartis’ digital transformation in drug R&D drives their need to maximize value from vast stores of clinical study data for critical internal research enabled by their data42 platform.

 

Maintaining

Are you empowering people to safely leverage trusted data?

Your Challenges

Do you need help...

OUR SOLUTION

Security / compliance efficiency

CLIENT SUCCESS

Client: ASCO’s CancerLinQ

Situation: CancerLinQ™, a subsidiary of American Society of Clinical Oncology, is a rapid learning healthcare system that helps oncologists aggregate and analyze data on cancer patients to improve care. To achieve this goal, they must de-identify patient data provided by subscribing practices across the U.S.

 

Acquiring / Collecting

Are you acquiring the right data? Do you have appropriate consent?

Your Challenge

Do you need help...

OUR SOLUTIONS

Consent / Contracting strategy

Client Success

Client: IQVIA

Situation: Needed to ensure the primary market research process was fully compliant with internal policies and regulations such as GDPR. 

 

Planning

Are You Effectively Planning for Success?

Your Challenges

Do you need help...

OUR SOLUTION

Build privacy in by design

Client Success

Client: Nuance

Situation: Needed to enable AI-driven product innovation with a defensible governance program for the safe and responsible use
of voice-to-text data under Shrems II.

 

Join the next 5 Safes Data Privacy webinar

This course runs on the 2nd Wednesday of every month, at 11 a.m. ET (45 mins). Click the button to register and select the date that works best for you.