CDP Institute

IAB published the results of a massive project in which 150 lawyers from across the globe compared privacy laws of Australia, Brazil, Canada, China, India, Israel, Japan, Mexico, Nigeria, Singapore, and South Korea to show what digital ad companies must know to comply. The Cross-Jurisdiction Privacy Project (CJPP) compendium also includes the CJPP Legal Specifications chart, for ease of use on what ad companies need to demonstrate for compliance.

Austria has accepted Max Schrems’ objections to the grounds on which Facebook collects user data and has awarded Schrems symbolic damages. They have also referred a set of questions to the EU court, including whether Facebook’s statement of intent to process user data undermines higher protections of GDPR.

Singapore’s Personal Data Protection Commission (PDPC) has added stricter privacy controls to its Personal Data Protection Act 2012 (PDPA), including making breach notification mandatory, and elevating data mishandling to a criminal offense. Financial penalties of up to $1M Singapore or 10% of a company’s annual gross income are under consideration for 2022.

In a Pathwire survey of 1,000 companies throughout EMEA and North America, 62.4% reported not being completely compliant with data regulations and 24.4% of respondents didn’t know which regulations applied to them. And, while cost of non-compliance can be substantial, only 11.6% reported spending more than $5,000/yr. on new technology in this area.

A high-ranking Catholic priest in the U.S. has resigned following publication of a story outing him using location data from hookup app, Grindr. This raises ethics questions both about the easy availability of cellphone data that tracks daily movement and about publicly using information that is obtained to impose moral judgement.

The non-profit organization for self-regulatory advertising, the Network Advertising Initiative (NAI), has launched the beta of its consumer choice mechanism for email-based Tailored Advertising, designed to expand the scope of their 2020 Code of Conduct. This will enable member companies to create encrypted versions of consumer email addresses that can be used for opt-outs from email-based IDs. A Digiday article published in response to the announcement has questions on the approach. Read More Read More – Digiday

The Dutch Data Protection Authority has found TikTok in violation of children’s privacy for not providing Dutch translation of their privacy statement for Dutch users. There are an estimated 3.5M TikTok users in the Netherlands, most of whom are young children. By not providing the consent information in their own language, the company was deemed to not have provided clear description of what would be done with the data it collects, so was seen as not adequately protecting children as required under GDPR.