Data\u00a0Privacy\u00a0Day (or Data Protection\u00a0Day in\u00a0Europe)\u00a0is the perfect occasion to\u00a0release the latest update of the\u00a0Data Privacy Periodic Table.\u00a0<\/p>\n\n\n\n
This is the fifth version of the open project, continuously receiving input and recommendations from industry experts all around the globe. <\/p>\n\n\n\n
So, what does this update include? <\/p>\n\n\n\n
Firstly, let\u2019s discuss what does it not include: <\/p>\n\n\n\n
While a great deal of the recent privacy conversation has revolved around its symbiotic relationship with AI, it has not impacted the arrangement of the Periodic Table. AI was included as a \u201cFuture development\u201d in the very first rendition. However, on this topic, see our blog, also published today as part of our special Data Protection Day resources. <\/p>\n\n\n\n
Similarly, the ongoing debate around whether the UK will be able to secure EU adequacy by the Brexit deadline of the end of 2020 has been a topic of keen discussion for many of our North American and European clients. But the urgency of the conversation does not change its position in the Table. A more in-depth discussion of this topic is available here. <\/p>\n\n\n\n
Instead, we have made identified three key privacy topics that demand changes to the Periodic Table, focused on major legislation arriving or being debated, plus, speaking of debates, \u201cSchrems II\u201d. <\/p>\n\n\n\n
The Updates:<\/strong> The most obvious necessary change was to move the CCPA from Future Developments to Core Legislation. To accommodate it, we combined the two Canadian privacy laws of CASL and PIPEDA into \u201cCanadian Data Privacy Laws (CaDP)\u201d. <\/p>\n\n\n\n On the 1st of January, the CCPA \u2013 \u201cthe nation\u2019s most far-reaching online privacy law and a potential model for other states\u201d according to the Washington Post \u2013 came into force. Of course, its Proposed Regulations are still being debated throughout the industry, as much of this guidance for business\u2019 execution of the CCPA actually exceeds the scope of the underlying law, or creates additional burdens. However, those discussions to one side, it is still a huge moment for US privacy law<\/p>\n\n\n\n Although, 2019 was a big year for US privacy legislation for other reasons. Two federal online privacy bills were proposed in 2019, one from US Democratic Senators, dubbed the COPRA \u2013 the Consumer Online Privacy Rights Bill \u2013 while Republicans proposed the US Consumer Data Privacy Act (CDPA). There are many similarities, especially around the now commonplace privacy provisions of data security, consent, and transparency. The main differences are in its implementation \u2013 COPRA aims to work in tandem with state laws while CDPA aims to supersede them. And let\u2019s not forget that there were five other notable federal privacy proposals introduced in 2019: <\/p>\n\n\n\n Online Privacy Act\u00a0\u00a0<\/strong> All of these are in such early stages that none of them warrants inclusion on the Periodic Table just yet \u2013 especially when element 114 in Future Developments includes \u201cUS States\u201d. However, it would be a safe bet that there will be a change in this area in 2020. <\/p>\n\n\n\n Children Online Privacy Protection Act (COPPA)<\/p>\n\n\n\n This has been introduced into the Future Developments section, taking the space left by CCPA\u2019s move into Core Legislation.<\/p>\n\n\n\n COPPA is a US federal law, in force since April 2000. Much like the thinking behind GDPR, its scope reaches any online service targeting US users or that intentionally collects information from children in the US, regardless of its country of origin.<\/p>\n\n\n\n The reason it has been added is the introduction of a new bill, the Preventing Real Online Threats Endangering Children Today Act \u2013 known as the\u202fPROTECT Kids Act.<\/p>\n\n\n\n This bill borrows most of its content from COPPA, but adds a Right to be Forgotten, and, most remarkably, raises the age limit from 13 to 16. This effectively creates the right for parents to demand the removal of their children\u2019s online profiles up to the age of 16. A remarkable indictment of the suspicion of how personal data may be used in the future.<\/p>\n\n\n\n The protection of children\u2019s privacy is an issue that the US takes seriously. In September 2019, YouTube (and by extension, Google) was handed a $170 million fine under COPPA after it was found to be gathering children\u2019s personal data without parental consent and monetizing it. Although, a few days before the PROTECT Kids Act was proposed, YouTube passed all the burden of confirming audience age to content creators and removed most monetization mechanisms from any content marked as \u201csuitable for children\u201d \u2013 all to widespread indignation amongst the YouTube content community, many of whom relied on income streams from child-suitable content.<\/p>\n\n\n\n Despite being an enforceable law, COPPA will remain in the Future Developments section while the PROTECT Kids Act and other amends are in discussion.<\/p>\n\n\n\n Schrems II<\/p>\n\n\n\n Do Standard Contractual Clauses (SCCs), adequately meet Europe\u2019s\u202fdata protection\u202flaws? This is the heart of this long-running debate, brought about by the infamous Max Schrems asking whether his Facebook data could be adequately safeguarded in the US.<\/p>\n\n\n\n Schrems asserted that Facebook\u2019s data transfer agreement was not consistent with the EU\u2019s SCCs, and\u202fthat even if they had been used, those SCCs could not justify the transfer of his personal data to the United States.<\/p>\n\n\n\n In December 2019, The Attorney General of the Court of Justice of the European Union\u202fseemed to agree by recommending that the European Court of Justice should \u201ccontinue to consider\u201d whether SCCs are lawful. Though did caveat by saying they were not to be considered unlawful \u2013 currently.<\/p>\n\n\n\n The problem is mainly that SCCs are made between two organizations alone, and do not put any requirement on the respective governments to safeguard that data\u2019s privacy. Meaning in practical terms that data passed from the EU to the US under SCCs is still vulnerable to legal US surveillance measures. And, as the AG of the CJEU asserts, Privacy Shield does not solve this problem.<\/p>\n\n\n\n The result being that SCCs are now very much in question. They currently remain a suitable measure, but their practical effect \u2013 and therefore ongoing suitability \u2013 is very much under scrutiny.<\/p>\n\n\n\n We have therefore removed \u201cEUx\u201d from Future Developments as further exits from the EU seem less likely \u2013 or at least less immediate than this discussion over SCCs, which now takes its place. You can read more about the outcome of Schrems II here.<\/p>\n\n\n\n As always,\u202flet us know of any suggestions, disagreements or recommendations. This is an open and live project that actively seeks input and is regularly updated as things change.<\/p>\n","protected":false},"excerpt":{"rendered":" We’ve updated our popular Data Privacy Periodic Table in time for Data Privacy Day. Read the blog to discover what the changes are and why.<\/p>\n","protected":false},"author":33,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"post_format_type":[40],"class_list":["post-1795","post","type-post","status-publish","format-standard","hentry","category-blog"],"acf":[],"yoast_head":"\n
California Consumer Privacy Act (CCPA) \u2013 and its national ramifications<\/p>\n\n\n\n
Designing Accounting Safeguards to Help Broaden Oversight and Regulations on Data (DASHBOARD) Act\u00a0
American Data Dissemination Act (ADD Act)\u00a0\u00a0
Social Media Privacy Protection and Consumer Rights Act\u00a0\u00a0\u00a0\u00a0
Privacy Bill of Rights Act\u00a0<\/p>\n\n\n\n