PRIVACY + SECURITY BLOG

News, Developments, and Insights

high-tech technology background with eyes on computer display

Cartoon: Data Use and Transparency

Cartoon Data Use and Transparency - TeachPrivacy Privacy Training 02 small

Wouldn’t it be nice if companies were completely transparent in their privacy notices?  Typically, privacy notices are filled with long clunky prose that manages to say hardly anything meaningful to consumers.  These notices are written by lawyers who carefully craft every sentence so that they won’t pin down a company.  The drafters of privacy notices do this because it is difficult to anticipate all the uses of personal data that might be fruitful in the future.  Companies want to avoid making promises that are too limiting of how they might use personal data.  This could tie their hands in the future, making them less nimble in the dynamic and fast-paced world of business in the digital age.

From a business standpoint, having greater room to use personal data in different ways is a great benefit.  From a consumer standpoint, consumers are not adequately informed about how their data is being used.

Additionally, companies often have many different things going on with personal data, and there frequently isn’t a strong enough central command structure to oversee everything that’s happening.  Companies aren’t evil in all of this, but the interests of companies and those of consumers are often not fully aligned.

Continue Reading

Cartoon: Algorithmic Transparency

Cartoon Algorithmic Transparency - TeachPrivacy Privacy Training 02

This cartoon is about algorithmic transparency. Today, more and more decisions are being made by algorithms.  The logic and functioning of these algorithms is increasingly complex and opaque to people. Today, the new buzzwords are “artificial intelligence” and “machine learning.”  AI and machine learning represent a number of different but related things, but what they generally share in common are algorithms.  As algorithms become more complex and rely on being fed massive quantities of data, it becomes harder and harder to explain their reasoning.  This is a big problem because algorithms play a significant role in our lives by making some very important decisions.

Continue Reading

Cartoon: Multi-Jurisdictional Privacy Law Compliance

Cartoon Multi-Jurisdictional Privacy Law Compliance Poodle - TeachPrivacy CCPA Training 02 small

This cartoon depicts the challenges of multi-jurisdictional privacy law compliance. In 2018, organizations scrambled to comply with the GDPR.  In 2019, businesses are scrambling to comply with the California Consumer Privacy Act (CCPA).  And, there will be a new referendum on privacy law in California next year — CCPA 2.0.  There’s a flurry of legislative activity in the states on privacy — IAPP has a great chart tracking what is going on.  And, each year, more and more countries are passing new comprehensive privacy laws.

We are witnessing the growing pains of privacy law.  Privacy wasn’t adequately regulated for too long, and now the concerns are festering, sparking a rush to action. In the US, state legislation on privacy will continue until the concerns are allayed.  A thoughtful and powerful federal law could weaken the enthusiasm for states to jump into the fray, but this is a challenge with Congress as polarized as it is.

For more on the issue, I recently interviewed K Royal on this topic – see here for the interview.

Continue Reading

Cartoon: Cookies and the GDPR

Cartoon Cookies and the GDPR

This cartoon depicts how, after the GDPR, countless websites have cookie notices and require agreeing to accept cookies.  I find these cookie notices to be form over substance.  These notices are virtually meaningless and don’t help consumers. They are a nuisance.  They give privacy a bad name because people start to think that privacy is just about a bunch of silly notices and needless extra clicks.

Because cookies are so ubiquitous and commonly-known, being notified about them isn’t very informative. At this point, a notice that says “this site uses cookies” is akin to a notice that says “this computer uses electricity.” What matters is how personal information is being used, not whether there are cookies. Additionally, there are no meaningful choices for consumers. Often, there’s no choice but to accept the cookies. Even when there is a choice, consumers aren’t informed enough about the benefits and costs to make a meaningful decision.

Formalistic “protections” of privacy such as these cookie notices are a big fail.  These cookie notices create the illusion of doing something about privacy, but nothing really meaningful is happening here.

Continue Reading

HIPAA Cartoon: HIPAA as an Excuse

Cartoon HIPAA as an Excuse

This cartoon depicts something that happens far too often with HIPAA — HIPAA is used as an excuse not to do something (such as make disclosures or provide access to records in ways that patients request) even though HIPAA doesn’t have such a restriction.  This is often done out of a lack of knowledge about HIPAA.  Healthcare providers frequently have mistaken notions of HIPAA being far more restrictive than it actually is.  For example, last year, I wrote a post about how numerous healthcare providers wrongly use HIPAA as an excuse to refuse to email medical records to patients. Ironically, instead of forbidding it, HIPAA actually requires that medical records be emailed to patients if patients so request.

Continue Reading