Privacy, Data Protection & Information Management

UK’s top Websites Receive Cookie Warnings from the Information Commissioner

Dec 07 2023

By Claude-Étienne Armingaud and Sophie Verstraeten

The UK’s Information Commissioner (the “ICO”) has recently sent warnings to the UK’s most visited websites to inform them that they may face enforcement action if they do not make changes to their cookie banner to ensure compliance with UK data protection law. For example, some websites warned by the ICO do not provide their user with a fair choice on tracking for personalised advertising. This position aligns with the EU’s stance, noting France (see prior Alert here).

California Privacy Protection Agency Proposes Draft Rules for Automated Decision Making, Including Artificial Intelligence

Dec 07 2023

By Eric Vicente Flores and Michael Stortz

Executive Summary: The California Privacy Protection Agency has proposed a new set of draft regulations that aim to regulate the use of artificial intelligence and automated decision making technology. These regulations will be discussed alongside other draft regulations the agency has previously proposed regarding risk assessments and cybersecurity assessments. The three sets of draft regulations will be discussed at the agency’s meeting on 8 December.

Australia’s Privacy Framework set to be Revamped Following the Government’s Response to the Privacy Act Review Report

Oct 13 2023

By: Cameron Abbott, Rob Pulham, Stephanie Mayhew,and Maddy Bassal

Last week the federal Government released its response (the Response) to the recommendations proposed by the AGD’s Privacy Act Review Report released in February 2023 (the Report).

California Proposes Cybersecurity Requirements for Businesses

Oct 11 2023

By: Eric Vicente Flores, Avril Love, and Whitney McCollum

In recognition of Cybersecurity Awareness Month in the US, we will be bringing awareness to relevant 2023 cybersecurity updates each week.

On 28 August, the California Privacy Protection Agency (CPPA) published draft regulations regarding risk assessments and cybersecurity audits for consideration at the Board’s September meeting. The draft regulations precede the formal rulemaking process, but provide insight into CPPA’s current priorities.

Jul 10 2023

By Amigo L. Xie, Lingjun Zhang, and Dan Wu

About four months after the Cyberspace Administration of China (CAC) released the Measures for the Standard Contract for the Export of Personal Data from China (China SCC Measures), and 15 working days after the China SCC Measures became effective, Beijing CAC published a notice announcing that a Beijing-based company passed the first-ever China SCC filing on 25 June 2023 (Notice).

Based on the Notice, the first China SCC filing relates to a cross-border personal data transfer from a Beijing-based data exporter, an online data service provider, to a Hong Kong-based data recipient. The type of data exported by the Beijing-based data exporter is personal data related to credit references as disclosed by the Notice.

The completion of the first-ever China SCC filing conveyed some positive messages to the market:

Jun 22 2023

By Cameron Abbott, Daniel Knight, Rob Pulham, Stephanie Mayhew, and Dadar Ahmadi-Pirshahid

Amid the rapid acceleration of tools like ChatGPT and global calls for tailored regulation of artificial intelligence tools, the Australia Federal Government has released a discussion paper on the safe and responsible use of AI. The Government is consulting on what safeguards are needed to ensure Australia has an appropriate regulatory and governance framework to manage the potential risks, while continuing to encourage uptake of innovative technologies.

May 24 2023

By Noirin M. McFadden and Claude-Étienne Armingaud

Today, the UK data protection regulator, the ICO, has published guidance to assist employers in responding to data subject access requests (DSARs) from current and former employees. DSARs have become the primary tool for employees attempting to gain leverage against employers during a dispute or grievance process: they can be extremely time-consuming and resource intensive for employers to deal with, and it is a difficult balance to strike between upholding employees’ right of access under the UK GDPR and applying exemptions from disclosure in an appropriate way.

The new guidance covers issues that often occur when employers try to strike this balance, and notably:

May 05 2023

By Cameron Abbott, Rob Pulham, Stephanie Mayhew and Dadar Ahmadi-Pirshahid

You’ve reached the end of a long week, riddled with proselytising about the importance of being privacy aware and privacy prepared. You get it! You lay your head to a well-earned rest…and like Kate McCallister wake screaming “Privacy Policy”! In true “back-to-basics” fashion, the privacy policy is getting a reboot!

May 04 2023

By Cameron Abbott, Rob Pulham and Stephanie Mayhew

Given the current privacy reform and cyber threat environment, the question we get asked a lot is – what are the privacy risks that should be assessed in our organisation and how do we prioritise these? Unfortunately this isn’t always a ‘one size fits all’ answer but there are some basic matters you can check as to whether your organisation is considering privacy risks proactively.

May 03 2023

By Cameron Abbott, Rob Pulham, Stephanie Mayhew and Dadar Ahmadi-Pirshahid

The APPs require organisations to “take reasonable steps to implement practices, procedures and systems that ensure compliance with the APPs”. Putting your mind to privacy after a data breach or complaint is very much shutting the stable door after Phar Lap has bolted (good luck getting him back!)

Good privacy management starts with a good privacy culture in your organisation. Recommended steps to develop this include:

Catagory:Privacy, Data Protection & Information Management

California Privacy Protection Agency Proposes Draft Rules for Automated Decision Making, Including Artificial Intelligence

Australia’s Privacy Framework set to be Revamped Following the Government’s Response to the Privacy Act Review Report

California Proposes Cybersecurity Requirements for Businesses

Beijing CAC Approved the First China SCC Filing

Australian Government contemplates Asimov’s Omnibus

Privacy Awareness Week Part V – Return of the Privacy Policy

Privacy Awareness Week Part IV – Privacy Priorities

Privacy Awareness Week Part III- The importance of being privacy prepared