Topic: Privacy law
Subscribe to Privacy law RSS feedOCR and FTC Issue a Joint Letter Suggesting Enforcement Actions May Be in the Pipeline
On July 20, 2023 HHS and the Federal Trade Commission (“FTC”) issued a joint letter to approximately 130 companies regarding their online data collection processes. The letter follows the much discussed December 1, 2022, Bulletin that expanded the kinds of websites and applications governed by HIPAA (you can read about our analysis of the bulletin … Continue reading
European Commission and ASEAN releases Guide to ASEAN Model Contractual Clauses and EU Standard Contractual Clauses
Posted in Data Protection, Data Transfer, PDPA, Privacy law
Introduction To enable international businesses to comply with cross-border personal data transfers and the relevant laws across the European Union (EU) and South-East Asia, on 24 May 2023 the European Commission and the Association of Southeast Asian Nations (ASEAN) published a Reference Guide to ASEAN Model Contractual Clauses (ASEAN MCCs) and EU Standard Contractual Clauses … Continue reading
The ICO urges organisations to start using privacy enhancing technologies to share personal data safely, securely and anonymously
Posted in General, Privacy lawTexas enacts comprehensive privacy law
Posted in Privacy lawValidating State Privacy Law Opt-Out Signals
Posted in CCPA, Data Protection, Privacy lawPrivacy law is becoming more technically sophisticated. So should you.
Posted in Compliance and risk management, Privacy lawPractical steps for businesses to comply with Bill C-27: part 2
In our previous update, we summarized key operational elements that businesses should be aware of under the proposed Consumer Privacy Protection Act (CPPA), and provided practical tips to help businesses comply with these new requirements. As currently drafted, the CPPA codifies a number of best practices and recommendations issued by the Office of the Privacy Commissioner of Canada … Continue reading
Privacy Act Review report
Posted in Privacy law
The Attorney General’s Department released its Privacy Act Review report on 16 February 2023, that includes the broad suite of reforms you would expect to bring Australia’s privacy laws in to line with both international standards and the reality of our data-based economy. These include enhanced data subject rights and increased accountability requirements for organisations collecting and … Continue reading
Autonomous Vehicles – Canada’s Current Legal Framework: Privacy (Part 4)
Posted in Cybersecurity, Data Protection, Privacy law
Across the globe, the race is already underway among vehicle manufacturers to develop fully autonomous vehicles (AVs). AVs currently under development make sense of their surroundings and control vehicle operation through data gathered about the outside world. Like other connected vehicles, AVs can also collect and use specific personal information about a driver (e.g., through … Continue reading
Bring-Your-Own-Device Programs: A Balance Between Privacy and Cybersecurity
Posted in Cybersecurity, Privacy law
A ”bring your own device” (BYOD) program is a popular arrangement used by employers, whereby employees use their personal devices (e.g., smartphones, laptops, or tablets) for both personal and business purposes. Last year, about two-thirds of Canadian private sector employers had at least one employee using personal devices for business-related activities.[1] While the BYOD approach … Continue reading
ICYMI – Late December in privacy and cybersecurity
Posted in Cybersecurity, Privacy law
Late December and early January tend to be a busy time for everyone, so you may have missed a privacy update or two during that time. We have set out some updates in the form of questions, with some links where you can find more information. Answers are below. 1. Colorado issued a revised draft … Continue reading
Ontario Court of Appeal Limits Application of Tort of Intrusion Upon Seclusion for Cyberattacks
In three recent cases, the Court of Appeal for Ontario effectively curtailed the ability of privacy breach victims to advance claims under the tort of intrusion upon seclusion against organizations for failing to prevent unauthorized access to personal information by third parties. However, while these cases should provide some reassurance that a cyberattack may not … Continue reading
New guidance on direct marketing
Posted in Data Protection, Privacy lawDraft European Commission EU-US Data Privacy Framework adequacy decision published
Posted in Data Protection, Privacy law
On 13 December, the European Commission launched the process to adopt an adequacy decision for the EU-US Data Privacy Framework (EU-US DPF). The draft decision – available here – addresses the concerns raised by the Court of Justice of the European Union (CJEU) in its Schrems II decision of July 2020. These concerns centred around … Continue reading
What you should do now in light of the Privacy Reform bill
Posted in Cybersecurity, Privacy lawPrivacy and Cybersecurity Due Diligence Considerations in M&A Transactions
Privacy and cybersecurity practices of target companies are being increasingly scrutinized throughout the due diligence process in M&A transactions. Particularly, buyers want to understand the risk and value inherent in sellers’ data assets and sellers want to manage transactional and post-closing risks. In the course of their privacy and cybersecurity due diligence, buyers should consider … Continue reading
Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities: Paving the way toward adequacy
Posted in Privacy lawOSFI’s Technology and Cyber Risk Management Guideline: Part 2
Posted in Cybersecurity, Privacy lawIn July of this year, the Office of the Superintendent of Financial Institutions (OSFI) released the final version of its Guideline B-13 (the Guideline), setting out technology and cyber risk management expectations for all federally regulated financial institutions (FRFIs), such as banks, insurance and trust companies. FRFIs will need to ensure that they have taken steps to … Continue reading
Autonomous Vehicles – Canada’s Current Legal Framework: A Primer (Part 1)
Posted in Cybersecurity, Privacy law
In recent years, autonomous vehicle (AV) technology has undergone rapid development and it is predicted that AVs may soon be in a state to displace human driving altogether. In Ontario, the Automated Vehicle Pilot Program is currently in place to permit the testing of certain AVs by vehicle manufacturers. As AV technology continues to develop, however, … Continue reading
California Age-Appropriate Design Code Act
Posted in Privacy lawAnother Day, another large BIPA Settlement
Posted in BIPA, Compliance and risk management, Privacy lawIt appears Snap has become the most recent company to pay a settlement for alleged violations of Illinois Biometric Information Privacy Act (“BIPA”). The law, which gives consumers a private right of action, has become a popular class action and source of significant penalties. Indeed, Snap joins a string of other companies that have already … Continue reading
Practical steps for businesses to comply with Bill C-27: Part 1
Posted in Compliance and risk management, Privacy lawThe House of Commons recently introduced Bill C-27, the successor to Bill C-11, which died on the docket when Parliament was dissolved in the fall of 2021. Bill C-27 introduces three new acts: the Consumer Privacy Protection Act (“CPPA”), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (“AIDA”), which … Continue reading
Maybe This Time : Federal Government Proposes the American Data Privacy and Protection Act
Posted in CCPA, Compliance and risk management, Privacy law
