Jennifer White

'Covered data' under the proposed American Privacy Rights Act: A cursory search of the American Privacy Rights Act discussion draft does not yield the term "personal data." IAPP Westin Research Fellows Andrew Folks, CIPP/E, CIPP/US, CIPM, and Luke Fischer explain how drafters "eschewed attaching the modifier 'personal' to the elemental definition of the data it covers," instead using a "covered data" terminology that "draws heavily from privacy and data protection regimes in the states and abroad." Full story #dataprotection #dataprivacy #privacy

2

Minnesota's state privacy legislation has been sent to Governor Tim Walz's desk to be signed into law. The Minnesota Consumer Data Privacy Act, once enacted, will add to the growing list of state privacy laws in the US. This year alone, five state laws have been enacted, bringing the total to 18.   Use our US State Privacy Law tracker as a reliable and easy resource while planning your compliance strategies. https://lnkd.in/dFHU2yhk #Privacy #DataPrivacy #PrivacyRisk #Compliance #InformationGovernance #InfoGov #InfoSec #LegalTech #PrivacyRegulation #DataProtection #RecordsManagement #PrivacyTech #Automation #PrivacyByDesign #ThirdPartyRisk #ThirdPartyRiskManagement #RiskManagement #MODPA #NJDPA #CCPA #CPRA #VCDPA #CPA #CTDPA #UCPA #TDPSA #OCPA #FDBR #MCDPA #DPDPA #ICDPA #SB255 #NDPA #NJDPA #TIPA #KCDPA #INCDPA #GDPR 

2

At Alliance Pro we assure you that the transition to the updated ISO 27001:2022 standard can be a smooth and manageable process. Here are 8 key points that our experts have for consideration: - Focus on Improvements, Not Overhaul: The core information security management system (ISMS) framework remains unchanged. You'll leverage your existing ISMS foundation. - Streamlined Controls: The new Annex A with updated controls offers a clearer and more focused approach to #risk management. - Enhanced Clarity: Minor wording and structural changes improve the readability and understanding of the standard's requirements. - Modernized Approach: New controls address evolving cyber threats and security challenges, ensuring your ISMS stays relevant. - Flexibility and Customization: The standard allows for tailoring controls to your specific needs and industry context. - Potential Cost Savings: Streamlined controls and a focus on existing #ISMS can lead to efficient implementation and reduced costs. - Competitive Advantage: Demonstrating compliance with the latest #ISO27001 standard enhances your organization's reputation for security. - Expert Guidance Available: Alliance Pro can partner with you throughout the #transition, providing expert guidance and support. Ready to take the next step? At Alliance Pro, we understand the complexities of information security management. Our team of experienced ISO 27001 auditors can help you navigate the transition to the 2022 standard with ease. Contact us today for a free consultation and discuss how we can streamline your journey to achieving robust information security. We are confident that together, we can ensure your organization's continued success and #compliance in the ever-evolving cybersecurity landscape. Subhash Kushal Cheruvu Bharath Hemanth Sairam Subha RAVI Shivaraj Bhagyalaxmi Rohini Nisha S Naresh

27

1 Comment

Last week, IAPP - International Association of Privacy Professionals released its Organizational Digital Governance Report and it’s clear from the findings that privacy and data roles are intersecting. As J. Trevor Hughes mentioned, "We discovered a lot of ampersands! Many, many, many privacy pros are seeing their roles stretch to encompass related and challenging fields." In response to this increasing complexity, Integral has developed automated compliance solutions, maximizing the value of regulated data and compliance in real-time. Our mission is to enable companies to safely leverage regulated data while enabling the shift of viewing as a catalyst rather than a blocker. We eliminate the burden on data and privacy teams in a number of ways: 1. Automating the compliance certification processes 2. Executing necessary data transformations 3. Delivering compliant data quickly 4. Facilitating data collaboration across industries 5. Detecting weaknesses in datasets and crafting enhancements As roles in privacy and data management continue to evolve, Integral offers a comprehensive regulated data solution for companies looking to explore insights from regulated consumer data. We streamline data movement, enable compliance, and access valuable insights, accelerating the pace of innovation with regulated data. Has your privacy role or title changed in the past few years? The full report here: https://lnkd.in/gu75NXxn J. Trevor Hughes, Saz Kanthasamy, Joe Jones, Lynsey Burke, IAPP - International Association of Privacy Professionals #privacy #datagovernance #compliance

24

2 Comments

The Oregon Consumer Privacy Act (OCPA) was signed into law on July 18, 2023, and is set to take effect on July 1, 2024, aligning with the new Texas privacy law. However, for non-profit organizations, compliance is required starting July 1, 2025. https://lnkd.in/eNyybXu9 Is your organization prepared for these changes? Stay ahead of the curve with our comprehensive guides! Request your copy Clarip's Oregon Consumer Privacy Act white paper today to ensure you're ready for compliance. 📄 Get your copy now: https://lnkd.in/eNygKN8x #OCPA #PrivacyLaw #DataGovernance #DataRights #Compliance #OregonLaw #NonProfit #Clarip

11

The Vermont Legislature has passed the Vermont Data Privacy Act, which EPIC supported and which represents a significant step forward for state privacy laws. The bill goes further than many existing state privacy laws by including: -data minimization requirements that set meaningful limits on the amount of personal data companies can collect and use; -a prohibition on the sale of sensitive data; -strong civil rights protections to prohibit digital discrimination; -a limited private right of action that will allow consumers to hold businesses accountable for violations of the sensitive data rules. In a speech last night on the floor of the House of Representatives, sponsor Representative Monique Priestley said: "At a time when everything we do and everything we are is monetized in a surveillance economy, the urgency of this moment cannot be overstated. Without incredibly thoughtful and comprehensive measures, we leave gaps that can be exploited, undermining the very protections we seek to establish." The passage of Vermont's bill comes the same week as the Maryland Governor signed the Maryland Online Data Privacy Act, which contains similarly strong provisions. "State lawmakers are sick of companies collecting massive amounts of data about us and using it whatever way they please, and they are doing something about it," said Caitriona Fitzgerald, Deputy Director, Electronic Privacy Information Center (EPIC). "The Vermont Data Privacy Act will force meaningful changes to harmful business practices such as the sale of geolocation data. We commend Representative Priestley and her colleagues for their incredible work on this legislation." Last year, EPIC crafted the State Data Privacy and Protection Act, modeled on American Data Privacy and Protection Act (“ADPPA”), to give state legislators the opportunity to use the bipartisan consensus language from ADPPA to strengthen state bills. The Vermont Data Privacy Act pulls many of its strong provisions from that model. The Act’s data minimization requirements include limiting the collection of personal data to what is reasonably necessary for the product or service requested by a consumer and prohibits the processing of personal data in ways that discriminate.  EPIC recently released The State of Privacy: How State “Privacy” Laws Fail to Protect Privacy and What They Can Do Better, which found that nearly half of the 14 states that have passed so-called comprehensive privacy laws at the time received a failing grade, and none received an A. State lawmakers from across the country recently testified to Vermont’s House Committee on Commerce and Economic Development about how industry lobbying affected their experiences championing privacy bills in their states. The bill heads to Governor Phil Scott's desk for signature. https://lnkd.in/e2UcVhS8

7

Check out these insights! Thanks, James E. Lee, for your suggestion.

3

The California Privacy Protection Agency published its second Enforcement Advisory warning about the use of “dark patterns” – those interfaces that impair a website user’s ability to make a choice regarding the collection, use, or disclosure of their personal information. Usama Kahf (CIPP/US) and Kate Dedenbach share four steps you should take to ensure you comply with this latest warning: https://bit.ly/3MHmSlJ. #privacy #cyber #consumerprivacy #CCPA #workplacelaw

6

(JDSUPRA) On May 24, 2024, Minnesota’s governor signed an omnibus bill, HF4757 which included the new Consumer Data Privacy Act. The state joins Kentucky, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island in passing consumer data privacy laws this year. 🔹 Minnesota’s law takes effect July 31, 2025, except that postsecondary institutions and nonprofit corporations governed by Minnesota Statutes, chapter 317A, are not required to comply until July 31, 2029. #state #data #dataprivacy #law #consumerprivacy #regulations #regulatorycompliance #Minnesota #statutes https://lnkd.in/eiqMyj_E

2

Here's the latest from the Sourcepoint A Little Privacy, Please blog. The Minnesota Consumer Data Privacy Act was signed by the Governor making it the 19th state to enact a data privacy law. Plus, The CPPA released an invitation for public comment under the Delete Act. Read the latest on data privacy and consent: https://lnkd.in/eW_x_sdh

7

In this long-form analysis, elevenM’s Tom Kench takes a deep dive into the detail in the Privacy and Other Legislation Amendment Bill 2024. He unpacks the history behind some of the changes, looks at international comparisons, assesses the impact in-practice and gives some key takeaways for organisations in Australia. Grab a cup of tea, and start reading... #privacy #privacyact #lawreform

26

In a new Future of Privacy Forum blog post, Jameson Spivack explores the emerging legislative frameworks for governing synthetic content, the relevant policy questions animating discussions about these governance approaches, and how these discussions might evolve over the next year. Give it a read and let us know what you think! Report on synthetic content: https://lnkd.in/gSNAJ8Zi Blog post: https://lnkd.in/gHJr7iyN

12

2 Comments

Because there’s no comprehensive federal privacy law, businesses must grapple with a diverse and often confusing landscape of state privacy laws, each of which differs in key respects. Fisher Phillips’ U.S. Privacy Hub surveys current state privacy laws, highlights important similarities and differences, and explores their implications. This resource will help businesses navigate the increasingly complex environment, aid in compliance efforts, and anticipate future developments in this rapidly evolving area of law. Check out our resources and get in touch with a member of our team. We’re ready to help you with all your U.S. privacy issues: https://bit.ly/4fdCwRI. #privacylaw #dataprotection #workplacelaw

20

🚨 New federal data privacy initiative! The American Privacy Rights Act aims to unify privacy laws across the US. Key aspects include comprehensive coverage, enhanced enforcement powers and strict compliance obligations for data and biometric processing. Will this be the breakthrough we need? #DataPrivacy #APRA #TechLaw #FosterGarvey

3

The IAPP - International Association of Privacy Professionals launched its Organizational Digital Governance Report (https://lnkd.in/eNBbD7is) today and it really hits hard on how the role of the traditional “privacy officer” has evolved over the years, from regulatory proliferation to the growing digital responsibilities being vested into C-suite leaders. Privacy officials are finding new areas of responsibility being tacked onto their title every day, partially out of necessity but also because the privacy officer/counsel often times is best positioned to tackle emerging data-related responsibilities at a company—as page 22 in the report illustrates. While the report focuses on the private sector, US federal, state, and local government privacy officials should take heed and observe closely to this as a potential bellwether for how government privacy officers may be finding the needs of their role and agency rapidly changing—if it hasn’t already. Even here at the Cybersecurity and Infrastructure Security Agency, the office that houses the privacy officer has expanded well beyond its original privacy oversight and compliance mandate—evolving into the Office of Privacy, Access, Civil Liberties, and Transparency. Thanks to the great tutelage of former and current career DHS oversight leaders like Jamie Danker Jonathan Cantor and Peter M., CISA’s office was prepared to evolve and take on the expanded scope. It’s probably not the greatest model to replicate as it was purpose built just for CISA, but from executive orders like the AI EO to data collections becoming more expansive and complicated to quantum computing destroying modern concepts of data protection—privacy offices and officers will need to evolve to meet public and agency expectations. WSJ has good coverage of the report (https://lnkd.in/ed33J-jb) if you need a shorter read, but I would definitely encourage you to read the entire report.

31

1 Comment

Thank you IAPP - International Association of Privacy Professionals for this important update on the new Colorado Privacy Act draft rules: "Colorado's attorney general released new draft rules under the Colorado Privacy Act. Among the proposed regulations are the establishment of a process for attorney general opinion letters and interpretive guidance as well as clarifications around children's and biometric privacy provisions following 2024 legislative action. There will be a public consultation beginning 25 Sept. that culminates with a formal rulemaking hearing 7 Nov." (link below) #DataPrivacy #Regulations #ColoradoPrivacyAct #CPA #PrivacyLaw

4

1 Comment

From Shook, Hardy & Bacon L.L.P.: The California Privacy Protection Agency (CPPA) is starting formal rulemaking (again) as they move beyond the pre-rulemaking drafts that were debated for a little over a year. During their November 8, 2024, board meeting, the CPPA voted to officially start the clock on (1) revising existing rules and (2) adding new rules on risk assessments, #cybersecurity audits, and automated decisionmaking. #california #dataprivacy #cppa #consumerprivacy

1

🚨 The American Privacy Rights Act (APRA) is on the table for U.S. privacy legislation. What does this proposed act entail? ✔️ Prioritizes consumer control by emphasizing things like limited, necessary data usage by companies (aka data minimization) and private right of action (PRA) ✔️ Seeks to unify the fragmented landscape of state privacy laws under a single federal standard At Ketch, we're cautiously optimistic: the bill's focus on consumer data protection aligns with our vision, to provide data dignity for all, beginning with tools to support business ability to honor consumer data choices across the data ecosystem. Watch Jonathan Joseph and Alysa Hutnik break down immediate APRA reactions in the privacy community ▶️ https://lnkd.in/eU2Xnu7R #PrivacyAware #DataPrivacy #

9

As an OG in the privacy field, I have participated in the movement towards regulatory excellence over recent decades and experienced how regulatory frameworks have dynamically evolved to keep pace with rapid industrial advancements (think about the automobile 🚗). With the expansion of existing regulatory rule books and the emergence of new ones, we have unprecedented opportunities to deepen our global engagement - striving for regulation that is effective, efficient, equitable, and just. The launch of the International Association on Regulation and Governance is another great example of how the field of interdisciplinary regulatory governance is expanding and fostering international cooperation in regulation and compliance. I look forward to the continued growth, cross-border and cross domain collaboration, and excellence in this field. https://lnkd.in/d7H3KJBT

64

7 Comments