October 2024

Data Privacy Frontline Report

October 2024

Here are key highlights from October 2024 detailing global news and regulatory updates.

US & Canada

  • California AB 1008 enactment poses challenges for determining whether generative AI models contain personal information

  • Canada’s Office of the Privacy Commissioner report summarizes legal and policy definitions of anonymization, pseudonymization and de-identification, highlighting similarities and differences between G7 nations

  • Texas lawmaker releases draft of a comprehensive AI regulation bill, which could become a model for other US states

  • US Federal Trade Commission (FTC) reaches a tentative settlement containing what could be the FTC’s first-ever “right to be forgotten” requirement

  • US payment processing company suffers breach affecting 100M people, making it the largest breach of healthcare data reported to US regulators

EMEA

  • Algeria’s data protection authority signs a cooperation agreement with its Mauritanian counterpart

  • EU European Data Protection Board (EDPB) adopts guidelines on the processing of personal data based on legitimate interest, and provides an infographic on invoking legitimate interest

  • EU EDPB releases its work program for 2024–2025, which includes guidelines on anonymization and pseudonymization

  • German regional court issues a more flexible risk-based decision on data transfers from the EU to the US

  • Saudi Arabia’s data protection authority publishes a procedural guide for handling data breach incidents

  • UK government unveils its Data Use and Access Bill, its latest effort to modernize the UK General Data Protection Regulation

  • UK parliamentary committee posts letter containing key conclusions from their UK-EU data adequacy inquiry and addressing whether the UK should seek to retain EU adequacy status

Gain confidence to use and share sensitive data

Find out how our advisory services can help you safely leverage data derived from information about people. Watch this 15-minute webinar.

APAC

  • Australia’s data protection authority provides privacy compliance guides for the use of AI products and personal information for training AI models

  • Singapore’s cybersecurity agency publishes guidance to help organizations adopt AI securely

LATAM

  • Argentina’s data protection authority releases a guide for the responsible use of artificial intelligence for both private and public organizations (in Spanish)

Global

  • Global privacy authorities issue a joint statement on data scraping after engaging with social media companies, stating that publicly accessible personal information is subject to laws in most jurisdictions

Archiving / Destroying

Are you unleashing the full value of data you retain?

Your Challenges

Do you need help...

OUR SOLUTION

Value Retention

Client Success

Client: Comcast

Situation: California’s Consumer Privacy Act inspired Comcast to evolve the way in which they protect the privacy of customers who consent to share personal information with them.

Evaluating

Are you achieving intended outcomes from data?

Your Challenge

Do you need help...

OUR SOLUTION

Unbiased Results

Client Success

Client: Integrate.ai

Situation: Integrate.ai’s AI-powered tech helps clients improve their online experience by sharing signals about website visitor intent. They wanted to ensure privacy remained fully protected within the machine learning / AI context that produces these signals.

Accessing

Do the right people have the right data?

Your Challenges

Do you need help...

OUR SOLUTION

Usable and Reusable Data

Client Success

Client: Novartis

Situation: Novartis’ digital transformation in drug R&D drives their need to maximize value from vast stores of clinical study data for critical internal research enabled by their data42 platform.

 

Maintaining

Are you empowering people to safely leverage trusted data?

Your Challenges

Do you need help...

OUR SOLUTION

Security / compliance efficiency

CLIENT SUCCESS

Client: ASCO’s CancerLinQ

Situation: CancerLinQ™, a subsidiary of American Society of Clinical Oncology, is a rapid learning healthcare system that helps oncologists aggregate and analyze data on cancer patients to improve care. To achieve this goal, they must de-identify patient data provided by subscribing practices across the U.S.

 

Acquiring / Collecting

Are you acquiring the right data? Do you have appropriate consent?

Your Challenge

Do you need help...

OUR SOLUTIONS

Consent / Contracting strategy

Client Success

Client: IQVIA

Situation: Needed to ensure the primary market research process was fully compliant with internal policies and regulations such as GDPR. 

 

Planning

Are You Effectively Planning for Success?

Your Challenges

Do you need help...

OUR SOLUTION

Build privacy in by design

Client Success

Client: Nuance

Situation: Needed to enable AI-driven product innovation with a defensible governance program for the safe and responsible use
of voice-to-text data under Shrems II.

 

Join the next 5 Safes Data Privacy webinar

This course runs on the 2nd Wednesday of every month, at 11 a.m. ET (45 mins). Click the button to register and select the date that works best for you.