All posts tagged Privacy

Cartoon: Data Localization

Daniel Solove
Founder of TeachPrivacy

Cartoon Data Localization - TeachPrivacy Privacy Awareness Training 02 medium

This cartoon is based on a fairly recent trend – countries that are requiring data localization.  Data localization involves requirements that personal data collected in a certain country reside on servers within that country’s borders.

Here are some articles on data localization worth looking at:

• Bret Cohen, Britanie Hall, and Charlie Wood, Data Localization Laws and their Impact on Privacy, Data Security, and the Global Economy (ABA Antitrust)

• Manuel Maisog, Making the Case Against Data Localization in China (IAPP)

• Jyoti Panday, Rising Demands for Data Localization a Response to Weak Data Protection Mechanisms (EFF)

Continue Reading

Did the LabMD Case Weaken the FTC’s Approach to Data Security?

Daniel Solove
Founder of TeachPrivacy

Federal Trade Commission - Washington, DC

Co-Authored by Prof. Woodrow Hartzog

On Wednesday, the U.S. Court of Appeals for the 11th Circuit issued its long-awaited decision in LabMD’s challenge to an FTC enforcement action: LabMD, Inc. v. Federal Trade Commission (11th Cir. June 6, 2018). While there is some concern that the opinion will undermine the FTC’s power to enforce Section 5 for privacy and security issues, the opinion actually is quite narrow and is far from crippling.

While the LabMD opinion likely does have important implications for how the FTC will go about enforcing reasonable data security requirements, we think the opinion still allows the FTC to continue to build upon a coherent body of privacy and security complaints in an incremental way similar to how the common law develops. See Solove and Hartzog, The FTC and the New Common Law of Privacy, 114 Columbia Law Review 584 (2014).

Continue Reading

Cartoon: GDPR Superhero

Daniel Solove
Founder of TeachPrivacy

Cartoon GDPR Superhero - TeachPrivacy GDPR Training 02 medium

For global organizations as well as organizations in the EU, the GDPR has brought significant attention and resources to privacy.  Finally, many executives are beginning to take privacy seriously.  As I recently wrote in my article, Prime Time for Privacy, at Bloomberg Law:

The GDPR has taken privacy to the next level. Before the GDPR, nothing had fully gelled around what protecting privacy actually entailed. The consequences of poor privacy were also rather vague in many cases. There was no clear blueprint for protecting privacy. Organizations would do just one or two things, such as provide a notice of privacy practices and keep data secure, and then claim they were protecting privacy. But they were only doing a fraction of what was truly needed to protect privacy.

The GDPR has changed all that. It provides a blueprint for protecting data that is more thorough and complete than nearly any other privacy law. The GDPR contains provisions that require governance measures, data mapping, assessment, data protection by design, and vendor management, among other things. It provides for individual rights such as the right to access one’s data, the right to request restrictions on data use, the right to be forgotten, and the right to data portability. The GDPR has a broad definition of personal data, and it applies across different industries, so it provides a comprehensive baseline of privacy protection.

Now, privacy professionals can point to a definitive source of the various norms, best practices, standards, and rules that have long existed in fragmentary form. The GDPR has penalties that will keep the CEO awake at night. Privacy professionals can point to it and say, “This is what we need to do, and this is why.”

Continue Reading

Cartoon: GDPR Change in Privacy Notices

Daniel Solove
Founder of TeachPrivacy

Cartoon GDPR Privacy Notice Change - TeachPrivacy GDPR Training 02 medium

In the past few weeks, with enforcement of the General Data Protection Regulation (GDPR) beginning on May 25, countless organizations launched emails and pop up notices about changes in their privacy notices in light of GDPR.  This cartoon pokes a little fun at the blizzard of changed privacy notice notices.

Continue Reading

Cartoon: The Post-GDPR World

Daniel Solove
Founder of TeachPrivacy

Cartoon Post-GDPR World - TeachPrivacy GDPR Training 02 meidum

This is a momentous week.  On Friday, May 25, 2018, the General Data Protection Regulation (GDPR) will begin being enforced. Organizations are racing against the clock to be prepared.  What will the day look like when the sun rises on May 25?

Continue Reading

GDPR Humor: A Collection of GDPR Cartoons and More

Daniel Solove
Founder of TeachPrivacy

GDPR Humor - TeachPrivacy GDPR Training 02

Feeling stressed out about GDPR?  I can help!  Here are all of my GDPR cartoons and attempts at GDPR humor in one post.  It’s much better to laugh than to cry . . .

Continue Reading

Cartoon: The Four Phases of Developing a GDPR Program

Daniel Solove
Founder of TeachPrivacy

Cartoon Four Phases of GDPR Program - TeachPrivacy GDPR Training

The General Data Protection Regulation (GDPR) has actually been with us for quite a long time (in various forms), but this month is the moment of truth.  On May 25, the GDPR will start being enforced.

Here’s a quick timeline of the evolution of the GDPR:

October 1995:  Data Protection Directive (95/46/EC) is adopted.  The majority of the rules of the GDPR are the same or similar to those of the Data Protection Directive. Thus, much of the GDPR has been with us for more than 20 years.

January 2012: First Draft of GDPR is released.

March 2014: European Parliament votes to support the GDPR.

December 2015: The Trilogue (EU Commission, European Parliament, and EU Council of Ministers) reaches an agreement about the GDPR.

April 2016: European Parliament and Council of the EU formally adopt the GDPR.  There will be a 2-year grace period until the GDPR is enforced.

May 2018: GDPR enforcement begins on May 25.

Continue Reading

Prime Time for Privacy

Daniel Solove
Founder of TeachPrivacy

Prime Time for Privacy 01

Over at Bloomberg Law, I have a short essay entitled Prime Time for Privacy.  From the essay:

The GDPR is a tremendous step forward for the privacy profession, but the maturity of the profession is what makes GDPR compliance possible.

The privacy profession serves a profound societal role. This is the profession that will help shape the future of privacy and guide the development of technology in ethical ways. With the rapid growth of technology, the privacy profession is more essential than ever. This is the profession that thinks about the human consequences of technology and how to bring the dizzying uses of data under control. Privacy professionals are on the front lines of shaping the data-drenched world we’re racing to construct. This profession will affect our lives and our society in profound ways in the years to come.

Read the full essay over at Bloomberg Law.

Continue Reading

Why I Love the GDPR: 10 Reasons

Daniel Solove
Founder of TeachPrivacy

GDPR Love 01

I have a confession to make, one that is difficult to fess up to on the US side of the pond: I love the GDPR.

There, I said it. . .

In the United States, a common refrain about GDPR is that it is unreasonable, unworkable, an insane piece of legislation that doesn’t understand how the Internet works, and a dinosaur romping around in the Digital Age.

But the GDPR isn’t designed to be followed as precisely as one would build a rocket ship. It’s an aspirational law.  Although perfect compliance isn’t likely, the practical goal of the GDPR is for organizations to try hard, to get as much of the way there as possible.

The GDPR is the most profound privacy law of our generation.  Of course, it’s not perfect, but it has more packed into it than any other privacy law I’ve seen. The GDPR is quite majestic in its scope and ambition.  Rather than shy away from tough issues, rather than tiptoe cautiously, the GDPR tackles nearly everything.

Here are 10 reasons why I love the GDPR:

(1) Omnibus and Comprehensive

EU GDPRUnlike the law in the US, which is sectoral (each law focuses on specific economic sectors), the GDPR is omnibus – it sets a baseline of privacy protections for all personal data.

This baseline is important.  In the US, protection depends upon not just the type of data but the entities that hold it.  For example, HIPAA doesn’t protect all health data, only health data created or maintained by specific types of entities.  Health data people share with a health app, for example, might not be protected at all by HIPAA.  This is quite confusing to individuals.  In the EU, the baseline protections ensure that nothing falls through the cracks.

Continue Reading

Will the FTC Remain a Leader on Privacy and Security?

Daniel Solove
Founder of TeachPrivacy

FTC and Privacy and Security

In an unprecedented transition, the FTC just got a full slate of 5 new commissioners, three Republicans and two Democrats:

Joe Simons (Chairman) – R
Noah Phillips – R
Christine Wilson – R
Rohit Chopra – D
Rebecca Slaughter – D

FTC LogoIt is difficult to predict how the FTC will approach privacy.  The new commissioners will be inheriting some high-profile investigations (Equifax and Facebook), and they will also be inheriting the legacy of the FTC as serving as the leading privacy regulator in the United States.  There are some, such as Berin Szóka, who argue that the FTC’s power needs to be reigned in.   In contrast, I posit that just the opposite is in order: the FTC must pursue a bold enforcement agenda.

The reason is that we don’t live in an isolated world. The European Union (EU) has seized the scepter of leading regulator of multinational companies. Nearly every chief privacy officer at a large multinational company tells me that their focus is 90% or more on the General Data Protection Regulation (GDPR) — the massive and rigorous privacy regulation in the EU that will start being enforced on May 25 of this year.  Effectively, for many companies, the regulators they are paying attention to are across the pond.

The US shouldn’t let itself fade into irrelevance. For years, the FTC has been working to convince the EU that there really is meaningful privacy regulation in the US — and I believe that this effort made a difference.  Perhaps it didn’t convince all EU policymakers, but it definitely had an effect on some policymakers.  This was how the US was able to establish the Privacy Shield Framework, built in the smoldering ashes of the Safe Harbor Arrangement that the European Court of Justice demolished in one swift stroke.

Continue Reading