CDP Institute

White Castle and a dozen business groups are trying to hold back against a ruling from Illinois’ Supreme Court that claims the company should pay $17 billion+ as a penalty for repeatedly collecting employee biometric data without consent. “Repeatedly” is key here, since the court wants to charge White Castle for each time they scanned the 9,500 employees, while company lawyers argue it should only be charged for the initial scan.

TikTok, which has been running afoul of EU regulators and recently received warning tougher rules are planned this year, has announced plans for two new EU data centers. The intent is to migrate the company’s EU user data there to be stored and managed locally.

New regulations and changes to existing laws are expected this year and soon after in Asia. India and Vietnam have legislation in process; and Australia, Japan, Korea, New Zealand and Singapore are looking to more closely align with the EU’s GDPR. Morrison & Foerster’s overview looks at changes evolving with regard to scope, cross-border transfers, breach notification rules and enforcement.

A true/false test taken by 2,000+ US consumers found 77% still don’t understand how they’re being tracked by companies. Not surprising, since privacy policies have so often been written in ways to obscure the information. According to this test conducted by the University of Pennsylvania Annenberg School, it would be good for the Federal Trade Commission to set more stringent limits (as it seems to plan to do) on data collection by companies, rather than to rely on individuals to opt in or out of having data collected on them.

Ever click from social to a brand site to make a purchase, or go back to the company site to buy later? According to a Simplicitydx survey of more than 3,000 US consumers’ social shopping behavior, only 23% reported clicking over, directly as opposed to 48% who said they would return to the brand website later to buy. That’s because trust levels in social are still low. It also makes for massive underreporting – as much as 245%, according to Simplicitydx – of the conversion rate.

The UK Information Commissioner’s Office (ICO) has released new guidelines for video games to ensure they comply with the UK Children’s Code. Requirements include that companies must: 1) identify that if players are under 18, the game is not detrimental to them; 2) work to discourage false declarations of age; and 3) demonstrate that behavioral profiling for marketing purposes is switched off by default.

The suit, filed on behalf of a group of Illinois residents, says a person’s facial features are unique, so collecting and using them without consent is in violation of BIPA rules.