Welcome to this week's Privacy XFN, curating the best reads at the intersection of data privacy and tech. This week we’re covering The U.K. Supreme Court's dismissal of a data privacy suit against Google, Québec updating its privacy law to align with GDPR, privacy concerns about Facebook's metaverse plans, and much more.
Mark your calendar: Don't miss our end of year (virtual) breakfast on Friday December 10, where Uber 's Nishant Bhajaria and Asana's Whitney Merrill will reflect on key wins and better ways of working between privacy engineering and legal teams. Register now.
—The Transcend team
|
|
The U.K. Supreme Court has dismissed a $4B data privacy lawsuit against Google. The tech giant was accused of bypassing privacy settings to track the Safari browsing history of over four million iPhones between 2011-2012.
More:
- In the U.S., Australia, and Canada, a single individual can seek compensation for privacy harms done to a large group of people.
- However, the U.K. Supreme Court said proof of harm must be provided on an individual basis.
- Google paid a $22.5M fine in 2012 as part of a settlement with the FTC after it faced similar allegations in the U.S.
TechCrunch 
|
|
The Canadian province of Québec updated its privacy law to align it with GDPR. The new requirements mandate that firms must have privacy officers. They must conduct and document a privacy impact assessment if they're sending data outside the province, which experts note can be a complicated process. Québec's privacy regulator and individuals affected by a breach must be notified if there's a possibility of "serious prejudice."
More:
- Companies can be fined up to $19.9M or 4% of their annual revenue for penal offenses.
- Administrative violations can result in a fine worth up to $8M or 2% of their yearly revenue.
- The law applies to all companies regardless of their size or annual revenue.
- The law's provisions will come into effect over the next three years.
Bloomberg Law
|
|
As Facebook rebrands as Meta and shifts its focus to the metaverse, privacy concerns have emerged. The metaverse is a virtual environment that users can enter via wearable headsets and interact with others.
More:
- Virtual headsets and AR glasses can be hacked and used for surveillance, according to Scott Ikeda of CPO Magazine.
- They can be synced with other devices to aggregate data that could be used for individual identification and tracking.
- CEO Mark Zuckerberg has said Facebook is working with external contractors to address privacy concerns, and parents will be given privacy controls.
- More privacy questions for Facebook: Zuckerberg and COO Sheryl Sandberg have been accused of failing to protect user data ahead of the Cambridge Analytica scandal in a new lawsuit.
CPO Magazine
Meet with Transcend, get an Amazon gift card: Interested in seeing how Transcend can help transform your data privacy operations? Take a quick call with one of our team, and we'll send you a $100 Amazon gift card for your time.
|
|
|
|
The FTC updated its dark patterns enforcement policy, indicating its looking to crack down on negative option marketing programs. Negative option programs are covered under state laws and the Restore Online Shoppers Confidence Act (ROSCA).
More:
- Companies must be transparent about the terms of the program.
- Relevant disclosures must be "immediately adjacent to the means of recording the consumers' consent" and appear before the consumer makes a purchase.
- Consent must be obtained in a manner that's "express" and "informed."
- The FTC says a pre-checked box is insufficient, and consent must be obtained via a simple process that's devoid of unnecessary language.
National Law Review
|
|
Twitter has announced plans to create a data governance committee. The internal committee's primary objectives will be to ensure that Twitter complies with its privacy and security policies and takes actions to protect user data.
More:
- The committee will decide what's an acceptable use of user data.
- The panel will approve any amendments to Twitter's privacy policy.
- In July, the company announced a series of new features, including a privacy check-in to help users determine how public or private they want their accounts to become.
Adweek
|
|
Despite pushback from impacted brands, Apple CEO Tim Cook says the company's anti-tracking privacy update was necessary to give users greater control of their data. As of October, 62% of iPhone users have opted out of being tracked, according to AppsFlyer.
More:
- Cook says he only opts in if he trusts the developer but didn't specify which companies he trusts.
- Tech firms hurt by Apple's privacy push: The move is expected to cost Facebook, YouTube, Twitter, and Snap a combined $10B in revenue during the second half of 2021, according to the Financial Times.
- Snap has been accused of downplaying the threat posed to Apple's privacy change to its revenue in a new lawsuit filed in California.
The Hill
|
|
The definition of data has continuted to evolve in the 3.5 years since GDPR went into effect. 850 professional soccer players could take legal action against 17 data firms over GDPR violations related to the tracking of their performance. GDPR defines personal data as any information that can be used to identify an individual. In addition, GDPR is also applicable if multiple data items are used to identify an individual.
More:
- While data firms profit from this information, a player's earnings or reputation can be diminished if their stats and injury record are published without context.
- When consent can't be obtained, GDPR rules state that firms must notify individuals their data is being collected and outline how it will be used.
- While it's unlikely firms will be forbidden from collecting data about professional athletes, they could be required to obtain consent before publishing it.
CPO Magazine
|
|
In other privacy news:
- The D.C. government obtained billions of phone location records from data broker Veraset to monitor the movement of citizens during the COVID-19 pandemic in 2020.
- Privacy concerns could delay the development of central bank digital currencies, according to experts.
- LGBTQ dating app Grindr has been accused of violating GDPR.
- Gov. Larry Hogan announced Laura Gomez-Martin will become Maryland's first chief privacy officer and Patrick McLoughlin will become the first chief data officer.
- The Australian state of New South Wales's government has introduced a bill limiting law enforcement's ability to access COVID-19 data.
A conversation on privacy that delights: Transcend's Ben Brook sat down with the Experience by Design podcast to discuss all things privacy, security, how Transcend helps companies, and approaching user data control as a moment for brand building and trust.
|
|
|
|
Privacy XFN is delivered to your inbox every Thursday morning and is sent by Transcend. We're an engineering company that makes it simple for companies to give their users control over their personal data. Learn more.
|
|
