CHICAGO -- Keeping up with compliance is critical as the field of privacy evolves, in-house lawyers at two companies told the Association of National Advertisers ad law conference this week.
Data Minimization
Data minimization is a core privacy principle requiring organizations to limit the personal data they collect, process and retain to only what is necessary for a specific purpose. Maryland’s data privacy law sets one of the nation’s strictest standards mandating that companies collect only the minimum data needed and prohibiting use beyond that stated purpose. The approach has drawn attention from other states with several exploring similar provisions to curb overcollection and reduce the risks of misuse, breaches and noncompliance.
Data breaches can “haunt businesses for years,” they're "rarely one-and-done,” said Bricker Graydon lawyer Nancy Magoteaux in a blog post Thursday.
CHICAGO -- States’ comprehensive privacy laws are not “dead letters” or “paper tigers,” Perkins Coie privacy attorney Meredith Halama said during a panel at the Association of National Advertisers ad law conference. “We see real, active enforcement, particularly in California.”
The Consumer Financial Protection Bureau should retain consumer privacy protections in Section 1033 of the Dodd-Frank Act and continue guarding against third-party financial data abuse, consumer groups told the CFPB in comments due Tuesday (see 2508210038).
Florida’s privacy lawsuit last week against Roku surprised some data-protection experts, since the state’s Digital Bill of Rights frequently carries an asterisk in lists of the 20 state comprehensive privacy laws -- if it’s included at all. In the aftermath, however, some privacy experts told Privacy Daily that they’re still not ready to add Florida to the list.
Recent innovations in AI have greatly expanded the capabilities of age estimation, said panelists during a webinar hosted by BBB National Programs Thursday. They added that while there are risks associated with the tech, new regulations offer more protections for children’s privacy and data.
Whether age-gating measures truly protect children online or just raise other legal concerns is unclear, speakers said during Hogan Lovells' The Data Chronicles podcast Thursday, which focused on age assurance in the U.S. and U.K.
Video-streaming box maker Roku “collected, sold and enabled reidentification of sensitive personal data” without receiving authorization or providing meaningful notice, the Florida attorney general’s office said Tuesday. AG James Uthmeier filed a complaint under Florida’s comprehensive privacy law and the Florida Deceptive and Unfair Trade Practices Act in the state’s 20th Judicial Circuit Court.
Privacy is an ever-evolving landscape, meaning that company privacy policies, technologies and teams must be constantly updated, panelists said Wednesday during a webinar hosted by Didomi, a consent-management software vendor. With enforcement actions by regulators increasing and legislators continuing to implement new laws, companies must stay on top of the latest developments, they added.
A comprehensive privacy bill passed the Pennsylvania House with "noteworthy" applicability thresholds and categories of sensitive data, a Philadelphia-based privacy attorney said Thursday. The state House also passed a bill Wednesday that would add a private right of action to the state’s data breach notification law.