Ireland's Data Protection Commission published a guidance note to assist data controllers in compliance with Article 30 of the EU General Data Protection Regulation, which requires a maintained record of processing activities.
Following the implementation of the EU Whistleblower Directive in 2021, companies' data protection officers were tasked with setting up secure reporting channels. As these data protection and whistleblowing systems are exercised by the same unit, is it reasonable for companies to combine the DPO and whistleblower roles? PBK Technology Compliance and Operational Risk consultant František Nonnemann, CIPP/E, lays out the commonalities between DPOs and whistleblowing officers, such as their independence and access to top management.
The European Commission announced the adoption of a proposal for the EU Cyber Solidarity Act. The draft legislation intends "to strengthen cybersecurity capacities in the EU" by offering "support detection and awareness of cybersecurity threats and incidents, bolster preparedness of critical entities." The commission said the legislation would lead to greater member state cooperation and "response capabilities" across the EU.Full Story
A panel of judges on the Ninth U.S. Circuit Court of Appeals ruled Amazon must face a national class-action lawsuit, which alleges the company illegally monitored private Facebook groups where drivers discussed working conditions, Reuters reports. The lawsuit was brought by Amazon driver Drickey Jackson in 2020, and the appeals court decision nullified an agreement between Jackson and Amazon that would have required him to bring work complaints to arbitration instead of court. The class is comprised of more than 800 drivers.
The European Commission announced the opening of the European Centre for Algorithmic Transparency. The oversight group will perform assessments on algorithms used by organizations characterized as "Very Large Online Platforms" and/or "Very Large Online Search Engines" under the Digital Services Act. ECAT members include representatives from EU institutions, academia, civil society and industry.
The U.S. Department of Commerce's International Trade Administration announced the U.K. applied to be an associate in the Global Cross-Border Privacy Rules Forum. The U.K. application marks the first potential addition to the forum since its creation in 2022.
As a 5-year-old in Saudi Arabia, Sue Khan, CIPP/E, observed patients of her mom's medical practice, especially women seeking treatment without understanding their bodies. The experience taught Khan, now vice president and data protection officer at Flo Health, the importance of clear communication and education for women's health and wellbeing. It also sparked her interest in health care and health technology.
BBB National Programs announced work on a new Digital Health Privacy Program for companies collecting and using consumer health data. The accountability program is still in development as BBB builds off the Executives for Health Innovation's Consumer Privacy Framework for Health Data.
The Future of Privacy Forum published an overview of Tanzania's Personal Information Protection Act, 2022. Tanzania is the "35th country in Africa to enact a standalone data protection law and effectively extends data protection safeguards to more than 63 million people," Policy Analyst Mercy King'Ori and Policy Counsel for Global Privacy Katerina Demetzou write.