For years, U.S. Federal Trade Commission settlements required companies to develop comprehensive information security programs that did not necessarily contain specific requirements to protect consumer privacy. However, since the 2018 LabMD case, the FTC has rethought its approach, and settlements have included specific remedies for organizations.
Reuters reports Indonesian lawmakers overwhelmingly passed a long-awaited data protection bill into law Sept. 20. Indonesia is the fourth most-populous nation in the world.
Following the overturning of Roe v. Wade by the U.S. Supreme Court, data brokers exploiting data of pregnant individuals has come under greater scrutiny. However, data brokers’ practice of selling women’s sensitive data predates the Supreme Court’s decision, Duke University Sanford School of Public Policy Senior Fellow Justin Sherman writes for Lawfare.
A non-binding opinion from Court of Justice of the European Union Advocate General Athanasios Rantos states that a competition authority may take into account the compatibility of a commercial activity with the EU General Data Protection Regulation. The opinion is in response to a case between the German Federal Competition Authority and Meta.
The European Data Protection Board adopted an opinion against the European Privacy Seal application of a German data processor. The German entity submitted its EuroPriSe certification criteria to the North Rhine-Westphalia data protection authority, the Landesbeauftragte für Datenschutz und Informationsfreiheit.
The European Union emphasized the importance of artificial intelligence in the EU's digital strategy. Machine learning, a subset of AI, relies heavily on accurate datasets.
Security experts are sounding warnings of multifactor authentication “fatigue” from employees following the social engineering hack of Uber, TechCrunch reports. Uber is not the only major technology company to suffer a hack through its MFA system, however.
American Airlines notified customers the company experienced a data breach over the summer, Bleeping Computer reports. American Airlines discovered the breach July 5 and secured the “limited number" of employee email accounts that were compromised. The company determined employees’ and customers’ personally identifiable information could have been exposed. In response, American Airlines will offer impacted customers two years of free credit monitoring.
The patchwork of U.S. comprehensive state privacy laws hasn't come into force just yet, but it is on its way. The five state laws passed to this point will all be effective and enforced by 2024 with additional obligations or sunsetting provisions for select laws set for 2025. The IAPP created a timeline of key dates for state privacy laws that can help professionals stay on top of compliance deadlines.
Clearview AI has begun allowing public defenders to access its facial recognition database of more than 20 billion facial images, The New York Times reports. The access helped a Florida man prove his innocence against accusations of vehicular homicide.