One company settled an action in 2024 with a payment of US$16.5 million to the FTC for collecting consumers’ browsing information through its browser extensions and software and then selling the information without providing adequate notice nor obtaining consent. Many states have their own deceptive practices statutes, which impose additional state penalties where violations of federal statutes are deemed to be deceptive practices under the state statute. However, the purchaser of the list should correlate it with the national DNC list and the purchaser’s email opt-out lists.
White & Case represents clients in all stages of domestic and international litigation worldwide, in established and emerging markets. Paul’s practice also includes advising companies on cybersecurity risks and compliance, and guiding companies in responding to data breaches. F. Paul Pittman is a Partner in White & Case’s international Data, Privacy & Cybersecurity legal practice.
The Information Commissioner’s Office (ICO), headed by the Information Commissioner, is responsible for enforcing the UK-GDPR. The UK-GDPR took effect on January 1, 2021 following Brexit to ensure there was no gap in data protection after the EU GDPR ceased to apply in the UK at the end of the transition period on December 31, 2020. It works alongside the Data Protection Act of 2018 (DPA) and the Privacy and Electronic Communications (EC Directive) Regulations of 2003 to form the UK’s data protection framework. While the GDPR centers on data privacy, DORA focuses on operational resilience and ICT risk management, with data security measures forming a key component of that framework. In rare cases, high‑risk providers may process sensitive data (like health, racial, or religious information) solely for the purpose of detecting and correcting biases. The regulation does permit AI with reasonably high risks, but requires these systems to maintain use logs, offer transparency reports, allow human oversight, and conduct risk assessments before and after market entry.
The Digital Operational Resilience Act (DORA)
The GDPR also applies to data controllers and processors outside of the European Economic Area (EEA) if they are engaged in the “offering of goods or services” (regardless of whether a payment is required) to data subjects within the EEA, or are monitoring the behaviour of data subjects within the EEA (Article 3(2)). Pseudonymisation is a privacy-enhancing technology and is recommended to reduce the risks to the concerned data subjects and also to help controllers and processors to meet their data protection obligations (Recital 28). Under the CCPA, California residents can request details about the data collected on them by businesses, opt out of data sales and request data deletion.
Obligations of Data Controllers and Processors 2
- 10.3 Please describe any legislative restrictions on the sending of marketing via other means (e.g., for marketing by telephone, a national opt-out register must be checked in advance; for marketing by post, there are no consent or opt-out requirements, etc.).
- It applies to financial institutions, which the law defines as “any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities.”
- 7.1 Is there a legal obligation on businesses to register with or notify the data protection authority (or any other governmental body) in respect of its processing activities?
- A data controller has the responsibility of deciding how personal data is processed and protecting it from harm.
In this way, data protection lays the foundation for achieving data privacy. Data protection ensures organizations have the necessary security measures in place to protect sensitive information and comply with privacy regulations. Data protection has precise aims to ensure the fair processing (collection, use, storage) of personal data by both the public and private sectors Data protection is about protecting any data relating to an identified or identifiable natural (living) person (“data subject”), including names, dates of birth, photographs, video footage, email addresses and telephone numbers
Industry Examples of Data Protection (Risk → Control → Outcome)
Businesses need to assess new technologies, their potential risks and how to mitigate those risks. It enables businesses to better protect personal data and cybercriminals to attack and compromise data. Companies should plan and allocate sufficient resources to ensure impacted stakeholders are up to speed with regulatory requirements and align consumer consent terms with data protection regulations. Businesses must build trust among consumers by ensuring data privacy consent agreements are in plain language and a consumable length, giving consumers a complete 360-degree view of their information and offering consumers an easy opt-out option for their data being used. “Until and even after the authorities provide https://consultprofound.com/mckinseys-2024-tech-trends-what-gemini-claude-think-about-them.html?noamp=mobile implementation details,” Moore conjectured, “industry practitioners will want to work with their advisors to help assess the law’s implications.” “The GDPR’s principle-based approach becomes less effective at guiding practices when organizations are determined to participate in the AI race regardless of the consequences,” said Sophie Stalla-Bourdillon, senior privacy counsel and legal engineer at data security platform provider Immuta.
Similar Resources
Having a sound security plan in place to collect only what you need, keep it safe, and dispose of it securely can help you meet your legal obligations to protect that sensitive data. Consumers care about the privacy of their personal information and savvy businesses understand the importance of being clear about what you do with their data. Think your company doesn’t make any privacy claims?
Researchers have found opioid-addiction treatment apps sharing sensitive data. We’ve read about the US government buying location data from a prayer app. And those risks vary widely, in part because there’s no single, comprehensive federal law regulating how most companies collect, store, or share customer data. The interests in undermining data protection are stronger than ever. As such, government agencies and companies have been working hard to undermine these legal instruments.
This extended the rights of consumers to include the right to correct inaccurate data a business collected about them and the right to limit the use and disclosure of sensitive data. The CCPA allows consumers the right to know what personal information a business collects and to whom it is sold, the right to delete personal information collected by the business, the right to opt-out of the sale of personal information and the right to nondiscriminatory treatment for exercising privacy rights. Passed in 2018 and known as the strictest data privacy law in the country, the CCPA applies to a business that collects personal information about consumers and outlines specific rights consumers have. Parents must have the opportunity to access their child’s data, review or delete it and prevent the company from collecting further data about their child. The law requires these institutions, including “companies that offer consumers financial products or services like loans, financial or investment advice, or insurance,” according to the Federal Trade Commission, to safeguard sensitive data and explain how it uses customer data.
The California Consumer Privacy Act (CCPA), adopted on 28 June 2018, has many similarities with the GDPR. The European Parliament and Council of the European Union adopted the GDPR on 14 April 2016, to become effective on 25 May 2018. The GDPR’s goals are to enhance individuals’ control and rights over their personal information and to simplify the regulations for international business. Imperva’s data security solution protects your data wherever it lives—on-premises, in the https://nutritioninpill.com/digital-medicine-digital-health-plus-evidence-plus-humility-forbes/ cloud, and in hybrid environments. Failure to comply can result in fines of up to 4% of worldwide sales or 20 million euros.
Whitney Merrill, privacy attorney and data protection officer, phone interview, July 26, 2021 In place of that, experts are pushing for the ability to use browser extensions or other tools that opt out automatically. Alongside the right to sue companies, opt-in consent is proving to be one of the hardest things to get into privacy laws. Such an arrangement would make accounts private initially, and apps wouldn’t have any permissions. All of the experts we spoke with preferred an opt-in consent model and “privacy by default” concepts. When every app and website is asking you for dozens of permissions, it becomes easier to accept the status quo than to manually opt out of every tracking technology.
