Oliver Yaros

❌Levying big fines on big tech companies is not an effective way of keeping them in line, the UK’s privacy chief has said, in comments that have prompted a backlash from data privacy experts and transparency campaigners. 🚫John Edwards, the information commissioner, said that issuing penalties in the hundreds of millions of pounds, as his counterparts in Europe do, would only tie up his office in litigation. 💸In contrast, the Irish regulator, which leads enforcement against big tech for Europe, has issued €3.2 billion of fines since 2018 at an average of €112 million each, according to enforcementtracker.com ( 🔗 https://lnkd.in/e9eKAVdc). The ICO has levied fines totalling €75,541,500, an average of €504,000 per fine. 🧒🏼 Edwards said he preferred engaging with industry to ensure compliance with laws such as the Children’s Code (https://lnkd.in/eYF4n7Vs), which regulates how companies handle the data of young people. 🚸He said there were a dozen examples of how the online world was safer because of the way the Information Commissioner’s Office has enforced the code. ⬇️See more here ⬇️

7

1 Comment

This week in our series, Decoding the Digital Competition Bill, 2024, we will discuss the 𝐂𝐨𝐫𝐞 𝐃𝐢𝐠𝐢𝐭𝐚𝐥 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬 (𝐂𝐃𝐒) which is sought to be regulated by the Digital Competition Bill, 2024 (DCB). The compliance obligations will apply only to ‘Systemically Significant Digital Enterprises’ (SSDEs) offering a CDS. Having a pre-defined list of CDS removes the relevant market definition step in abuse of dominance cases – by identifying those digital markets or services (having multi-sidedness, cross and same-side network effects, zero-price services, and access to data) which are prone to tip. Presently, the DCB’s scope of CDS encompasses a wide spectrum, from operating systems to cloud services, including a catch-all of online intermediation services (refer to the table below for the existing list). The Competition Commission Of India (CCI) is empowered to modify existing CDS and add to the list as necessary. The CCI is poised to draft specific conduct requirements uniquely tailored to that CDS. This approach recognizes the need to adjust the ex-ante framework suited for different business models within various CDS in a nuanced manner. #DigitalCompetitionBill2024 #BusinessRegulation #WeeklySeries #StayInformed #DigitalCompetitionLaw #IndianDigitalMarkets #ExAnteRegulation #IndianCompetitionLaw #DigitalPlatformsIndia #tt

94

LIVE WEBINAR: How to Adopt AI in Compliance with the GDPR 4th June | 3pm Join our consultant Mark James for: • How existing data protection laws such as the GDPR regulate AI use; • Assessing risk and mitigation strategies through DPIAs (data protection impact assessments); • Key data protection pitfalls to look out for when assessing AI tools; • Privacy by design as a concept for organisations striving for innovation; and • Our recommendations for AI success. Sign up here: https://lnkd.in/dmn-dnTW (Even if you can't attend, you'll still receive a copy of the slides and recording) #GDPR #dataprotection #AI

12

You do not want to miss this strategic new paper from CIPL and Richard Thomas on how should DPAs deliver effective and outcome-driven data privacy oversight, supervision and enforcement by focusing on outcomes, risk-based behaviours, strategic goals, transparency and constructive ex -ante engagement. Just like the companies and public sector need to step up their own digital accountability, regulators need to consider how to effectively deliver their role and the objectives of the digital regulation. New times call for new behaviours, new tool, new collaborations and laser-focused prioritisation to achieve the outcomes intended by legislators. DPAs and other digital regulators must be truly empowered economic regulators too, focusing on both harms and risks, but also benefits of responsible data use and responsible development of technology. It is not about stopping data use, nor AI or other technologies, but ensuring it happens responsibly, with benefits for people, society and economic growth and with trust. We are all in the same boat and have to work together towards this! Join us on this shared journey. And this is a perfect setting for the upcoming Global Provacy Assembly in Jersey next week and CIPL’s dinner and conversation with Richard Thinas and Prof. Christopher Hodges on this topic. #CIPL #Smartregulation #accountability #digitalregulation

43

It's the one we've been waiting for (some of us, at least): the publication of the UK's proposed new data protection law, now renamed as the Data (Use and Access) Bill. Thank you to TechCrunch for featuring some of my initial thoughts on the Bill, which is of course subject to Parliamentary debate and will likely change in places. Is it going to jeopardise the EU's upcoming #adequacy renewal finding? I think not. Unlike the previous government's broad revision of the UK's data protection regime, these are targeted reforms — although there are certain provisions, particularly around automated decision-making, that may cause concern in Brussels. There is plenty to get stuck into in the coming days and weeks, including provisions around: (1) putting certain #DSAR-related guidance on a statutory footing; (2) increasing #PECR fines; and (3) data sharing, smart data and digital ID verification, among others. Happy reading! The Bill: https://lnkd.in/e9GKFc9y The Explanatory Notes: https://lnkd.in/e2fSymGt https://lnkd.in/edWqgP5W

30

The ICO are cracking down on cookie compliance! Is your website taking the biscuit? 🍪 We’ve been talking to Tom Gell, data protection expert at Trust Keith • The DPO-aaS for Scale-Ups and ISO Serious, about cookies. You might think that you have this covered, but it’s a fast-moving area and many organisations don’t realise they are out-of-date and failing to comply with the law. Tom shares his list of the top 7 things you need to know below to help ensure you measure up... 1️⃣ There are two types of cookies 2️⃣ Analytical cookies  3️⃣ Other tracking technology 4️⃣ Changing law 5️⃣ 3rd party providers 6️⃣ "Reject all"  7️⃣ Countries If you want to discuss any of the above or if would like us to check your cookie policy for compliance please get in touch on [email protected]. You may also want to check out our previous blog on why do I need a cookie notice (linked below). #Cookies #Compliance #CookiePolicy #DataProtection Mitchell Omer

10

5 Comments

Clearly documenting and regularly reviewing data protection policies and procedures is paramount to demonstrating compliance with the UK GDPR. It is essential that such policies are communicated within an entity and staff are regularly trained on these. Read our privacy documentation FAQs to ensure you are up to date. https://ow.ly/YRHe50U99Lx #privacydocumentation #dataprotection

5

NIS2 and DORA are familiar acronyms to cyber or privacy professionals these days, none more so than our EU colleagues, grappling with the challenges of interpretation and imminent implementation, with the potential spectre of increased fines and personal liability. In the UK, we await sight of the Government's Cybersecurity and Resilience Bill, with early signals suggesting alignment with most of the key Continental developments. Together with my colleagues, Nicholas de Lacy-Brown and Henry Kilding, we have considered some of the key changes and the importance of audit / review of existing operations and resiliency to ensure future compliance - read all about it below! #NIS2 #DORA #cyber #cybersecurity #dataprotection #cyberresilience #cyberassurance #OpRes

33

The UK privacy regulator has launched an investigation against 23andMe, shedding light on the enforcement approach and trends for tech and data companies. Here are my thoughts: 👉 This is the first meaningful action for some time (related to a data breach). 👉 The lack of formal action post-GDPR signifies a more business friendly enforcement approach which is even more obvious given the 2970 security incidents reported in Q1 2024 alone, averaging 12,000 annually. Relative to the number of incidents being reported, there is not an increase in formal action. 👉 This investigation does though highlight that regulators are continuing to focus on Big Tech (23andMe has circa 14M users) which is a stated enforcement priority. 👉 A key highlight is the collaboration between the UK ICO and the Canadian regulator, demonstrating effective cross-border cooperation in tackling global tech giants. 👉 The emphasis on sensitive data, particularly health data, underscores the increased regulatory scrutiny and risks for Healthtech sector. The investigation's scope includes assessing potential harm, the effectiveness of existing safeguards, and compliance with notification requirements. This development underscores the evolving landscape of data protection and enforcement, urging organizations to prioritize robust data security measures. More to come! #data #GDPR #databreach #tech

11

Aᴘʀɪʟ'ꜱ Dᴀᴛᴀ Pʀᴏᴛᴇᴄᴛɪᴏɴ Dɪɢᴇꜱᴛ Including: 🤖 Spotlight on AI: CNIL's recommendations, UK-US collaboration on AI safety, California's move to watermark AI-generated content. 🔐 Cybersecurity: UK's PSTIA regulations in effect, aiming to tighten product security. 🔒 EDPB and ICO on "consent or pay" models. #DataProtection #Cybersecurity #AI #PrivacyLaw https://lnkd.in/g6xTDrcV

37

Full room this morning at #IAPP #DPC24 for a panel discussing “Implications and Expectations for Digital Policy of the new US Administration”, with US digital policy heavyweights - Cameron Kerry (The Brookings Institution), Jules Polonetsky (Future of Privacy Forum) and Caitlin Fennessy (IAPP). One of the key takeaways: activity at State level, from state legislators to Attorneys General, will continue to be hyperactive, perhaps even more than in the past years, not only on data protection, but increasingly more on AI. Another key takeaway: On what to expect in China - US relations, the president-elect is always about “wins, wins, wins”, and transactional, so it is not a given the current “decoupling”/“derisking” policy will stay course. Another key takeaway: Content moderation might in fact be the biggest digital policy issue in the next four years. Another key takeaway: The original sin remains the absence of a comprehensive federal privacy law in the US.

91

2 Comments

The October edition of our Data, Privacy & Cyber bulletin is out now. This month we explore the DPIA, and ransomware ICO enforcement trends, plus our usual round-up of the latest news. https://lnkd.in/eAvHggD2

6

Microsoft To Be Sued For 'Inflating' Price Of Software License Microsoft is set to face a multibillion-pound #ClassAction case brought by a former U.K. prosecutor over allegations that the tech giant illegally inflated the prices of software licenses, lawyers who plan to represent consumers said on Monday. Alexander Wolfson, a former Crown Prosecution Service barrister, intends to file collective proceedings in the Competition Appeal Tribunal on behalf of thousands of public and private organizations in the U.K. that purchased software licenses. The software licenses include those for Office and Windows, according to his legal team. Kate Pollock of Stewarts Law LLP, which is representing Wolfson, said that the case "could have a great impact on the fairness of the U.K.'s growing digital economy. Almost all organizations in the U.K. rely on the use of computer software, and it would be impossible for those affected by this harm to take individual action over the inflated prices we believe they were forced to pay by Microsoft." To learn more about Law360 UK and MLex reporting on #ClassAction cases please connect with me for an initial consultation. #Competition #Antitrust #ClassAction #InflatedPricing

3

Ofcom, the UK's communications regulator has set out its regulatory strategy for AI. Ofcom's responsibilities include TV, radio, streaming services, online safety, media literacy and media plurality. Ofcom recognises the advantages of AI (such as optimising communications, improving safety technologies and creating compelling visuals) and the pitfalls (especially illegal or harmful content, such as deepfakes). It intends to "harness the benefits while mitigating risks in line with the Government’s pro-innovation approach to AI", through the "lens" of the UK Government's AI principles: "safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress", while working with industry stakeholders. Ofcom has set out four key areas: ▶ Regulation of services that use AI technologies. Examples include: the Online Safety Act (https://lnkd.in/g8uvA9cZ), which requires service providers to mitigate the risks of users encountering illegal or harmful content; conditions set under the Communications Act (https://lnkd.in/gug_YrS3) against scams; security requirements for telecommunications under the Telecommunications (Security) Act 2021 (https://lnkd.in/gYw_Tyf7); and competition and consumer powers that may be used against, e.g., personalised pricing. ▶ Work to date to understand and tackle AI risks. Ofcom is studying three key cross-cutting risks: synthetic media; personalisation; and security and resilience. Priorities on synthetic media includes accountability (for broadcasters and online services), research into detection and transparency, and engaging with telecoms providers over preventing scams. ▶ Capability to address AI risks. Ofcom has around 60 AI experts, is building partnerships with academic institutions and is pursuing a data literacy programme. ▶ Cooperating with others on AI issues. Ofcom is working with other regulators via the Digital Regulation Cooperation Forum. This will include an "AI and Digital Hub" to enable innovators to raise cross-regulatory questions. Ofcom is also engaging internationally on online safety (via GOSRN - https://lnkd.in/gyHZQN8H) and broadcasting regulators (via EPRA - https://www.epra.org). ▶ Planned AI work. Ofcom has provided an annex of planned work. At this stage, the plans are almost entirely guidance relating to online safety, research, monitoring and consulting. Ofcom's AI strategy in full: https://lnkd.in/dS9k6gpX Fourteen UK regulators have set out their plans for regulating AI. I've collated links to their responses here: https://lnkd.in/gBvR_exG #AI #regulation #UK

39

3 Comments

In the latest Consumer Protection Dispatch, Steven Farmer, Mark Booth and Scott Morton of Pillsbury Winthrop Shaw Pittman LLP's London office report on how recent fines totaling €400,000 against two companies underscore the importance of #GDPR compliance, especially for businesses handling sensitive personal data. The French data protection authority (CNIL - Commission Nationale de l'Informatique et des Libertés) flagged critical issues around: - Data retention practices - Explicit consent for sensitive data - Marketing compliance These cases serve as a reminder to consumer-facing businesses to reassess their policies, particularly around data retention. CNIL suggests a maximum of three years after the end of a customer relationship, but other authorities may set different periods, so it's important to stay informed of varying guidance across European jurisdictions. Read more about the implications and next steps for businesses in the EU and UK: https://lnkd.in/e_RGEUjs #CNIL #GDPR

4

Continuing our series of Digital Personal Data Protection Act, in the Part VI we will be delving into the Rights of the Data Principals. Most of the us are Data Principals and it becomes an absolute necessary for us to know the rights available to the Data Principals. OZA PATEL & DOSHI #digitaldataprotection #digitaldataact #digitaldatabreach #dataprotectionact

9