IAPP Westin Research Fellow Amy Olivero parsed through the EU General Data Protection Regulation's data protection officer provisions, spelling out key considerations companies and DPOs should bear in mind as regulators begin their enforcement sweep. Topics include designating, positioning and tasking a DPO, looking ahead, as well as additional resources.Full Story
How a GDPR-mandated DPO should operate
The Wall Street Journal reports Meta intends to offer EU users the option to opt out of data processing practices for targeted advertising. The change will be exclusive to EU Facebook and Instagram users as Meta works to meet a compliance order from Ireland's Data Protection Commission concerning legal bases for data processing under the EU General Data Protection Regulation.
U.S. District Court for the Northern District of California Judge Vince Chhabria granted preliminary approval to Facebook's USD725 million settlement in a class-action lawsuit related to the 2018 Cambridge Analytica claims, the plaintiff's law firm Keller Rohrback said in a statement.
Data adequacy designations are on the rise as countries around the world move to adopt or update data protection laws. IAPP Research and Insights Director Joe Jones generated an infographic depicting the jurisdictions that vest powers in either a data privacy regulator or government authority to designate other jurisdictions as having "adequate" data privacy standards to facilitate cross-border data transfers. This overview does not detail how adequacy capabilities are exercised, nor does it show available mechanisms and guidance for transferring personal data to nonadequate countries.
France ratified the Council of Europe Convention 108+, modifying the original Convention 108 for the protection of individuals with regard to the automatic processing of personal data.
Privacy Commissioner of Canada Philippe Dufresne submitted recommendations on including privacy considerations in potential reforms to Canada's Competition Act.
The European Union Agency for Cybersecurity launched a new tool for small and medium-sized enterprises to help assess their level of cybersecurity "maturity." ENISA’s tool performs a cybersecurity evaluation around the areas of personnel-related risks, technology and its processes for responding to cybersecurity threats and also provides a "personalised" remediation plan.Full Story
Axios reports on children's privacy measures anticipated to come before U.S. Congress, as states take separate action. Sens. Richard Blumenthal, D-Conn., and Marsha Blackburn, R-Tenn., are expected to reintroduce the Kids Online Safety Act in April, while Utah passed two bills limiting online activity of those under age 18 and other states are considering similar proposals. "With inaction by Congress, we have states with different laws, and time is of the essence," said Rep.
U.K. Information Commissioner John Edwards said protecting the privacy rights of "people (who) may not even be aware those rights exist" was a core function of the Information Commissioner's Office following a U.K. High Court ruling that found the "immigration exemption" in the Data Protection Act 2018 illegal. The ruling came after EU rights group The3Million and Open Rights Group originally brought the complaint.
The African Union's Data Policy Framework released in July 2022 broadly "contains many features that align with international approaches to data protection," Future of Privacy Forum Policy Analyst Mercy King'ori writes. However, it also features "nuanced views" of topics including separating data sovereignty from data localization and advocating against member states adopting stringent data localization requirements.