The Baden-Württemberg Commissioner for Data Protection and Freedom of Information released an FAQ about deceptive design patterns. It touches on several topics including what obstruction and overloading can look like as well as what kinds of protections against deceptive design are in the EU General Data Protection Regulation.Full story
IAPP Westin Research Fellow Kayla Bushey examined the latest decision in NetChoice v. Bonta, where the U.S. Court of Appeals for the 9th Circuit upheld and vacated aspects of an injunction against the California Age-Appropriate Design Code Act. She explored how the decision navigates an increasingly tricky landscape of protecting free speech with protecting youth privacy and safety online. Full story
The National Institute of Standards and Technology released a report from its Internet of Things Advisory Board about the challenges of adopting IoT technology in the U.S. The board identified privacy concerns that "undermine trust" as well as cybersecurity barriers, while indicating AI is "critical to unlocking and accelerating the value of IoT" despite "significant challenges."Full story
The Netherlands' data protection authority, Autoriteit Persoonsgegevens, investigated eight tourist facilities' use of facial recognition technology and said the tech can only be used for personal and authentication purposes.
The Saudi Data and Artificial Intelligence Authority issued guidance on how to handle personal data breach incidents under the Personal Data Protection Law. The guide includes definitions of terms used and a breakdown of the three phases of notifications, incident containment and documenting the breach.Full story
The Record reports on why software liability policy continues to be a thorny topic among the technology industry years after U.S. Congress received recommendations on how to improve the country's digital security.
Italy's data protection authority, the Garante, announced it issued a 900,000 euro fine to software company Postel after its alleged cybersecurity vulnerabilities led to a ransomware attack. The Garante also separately ruled against companies' use of software to monitor and collect employee emails, fining an unnamed company 80,000 euros over such monitoring.Full story
The CyberPeace Institute is urging EU member states to vote against the proposal to adopt the UN Cybercrime Convention due to human rights and platform accountability concerns.
The shift away from strict proposed data localization requirements in the final version of India's Digital Personal Data Protection Act was a positive development, independent law and policy advisor Vrinda Pareek writes in an op-ed.
A group of privacy advocates gained access to a tool that can map smartphone movements called Locate X, made by Babel Street, and shared the results with 404 Media. The tool has been sold to various U.S. law enforcement agencies and could be used to monitor specific device movements in and out of sensitive locations, such as a reproductive health care clinic.Full story