The U.S. Federal Trade Commission enforcement action against online alcohol marketplace Drizly demonstrates how the agency plans to give teeth to its new emphasis on data minimization, IAPP Managing Director, Washington, D.C., Cobun Zweifel-Keegan, CIPP/US, CIPM, writes. This is the first time the agency has spelled out the details of a granular data minimization program and privacy pros should pay close attention.
The U.S. Department of Justice said it reached a “first-of-its-kind resolution” with Google over the loss of data related to a 2016 search warrant, Reuters reports. Under the agreement, Google will form “its legal process compliance program to ensure timely and complete responses to legal process such as subpoenas and search warrants,” the department said.
The U.K. Information Commissioner’s Office warned it will investigate organizations using emotion analysis technologies irresponsibly, urging risk assessments before systems are implemented. The ICO said emotion analysis technologies collect, store and process data that is “far more risky than traditional biometric technologies” and bring a risk of systemic bias, inaccuracy and discrimination. “Developments in the biometrics and emotion AI market are immature. They may not work yet, or indeed ever.
Block, the parent company of point-of-sale service Square, was found to sell access to customers’ email inboxes who had their receipts emailed to them from a Square system, according to an investigation conducted by Protocol. However, privacy experts concluded the practice does not necessarily violate data protection laws.
So-called mobile application “privacy nutrition labels,” created by Apple and Google, “too often seemed inconsistent with information in the apps' privacy policy,” Carnegie Mellon University Bosch Distinguished Professor in Security and Privacy Technologies Lorrie Cranor, CIPT, writes for Communications of the Association for Computing Machinery.
Global data breaches increased 70% in the third quarter of 2022, InfoSecurity Magazine reports, citing a study from cybersecurity company Surfshark. Of the 108.9 million accounts compromised, Russia saw the highest total of breaches with 22.3 million, followed by France, Indonesia, the U.S. and Spain. France had the highest breach density with an average of 212 accounts hacked per 1,000 people.
The U.S. Federal Trade Commission finalized the agenda for its Nov. 1 virtual PrivacyCon 2022.
France’s data protection authority, the Commission nationale de l'informatique et des libertés, and South Korea’s Personal Information Protection Commission signed a declaration of cooperation to conduct joint research on new technologies and data protection issues, share best practices and experiences, and organize joint training initiatives.
The U.S. Federal Trade Commission announced an enforcement action against online alcohol marketplace Drizly and its CEO James Cory Rellas related to data security issues that led to a 2020 data breach involving 2.5 million customers. The order calls on Drizly to destroy unnecessary data and requires implementation of data minimization and information security programs. Rellas will be bound to the enforcement action in any new position or venture beyond Drizly.
The California Privacy Protection Agency announced a rescheduled board meeting for Nov. 4 to discuss California Privacy Rights Act rulemaking. The meeting will follow identical board meetings dedicated to discussion of CPRA draft regulations Oct. 28-29. The agency canceled similar meetings Oct. 21-22 for undisclosed reasons.