CDP Institute

Keep an eye on CA’s Prop 24 The California Privacy Rights and Enforcement Act of 2020 (CPREA), also known as Prop 24, looks good for passage in November. If so, impact will extend far beyond the state. Key objectives are increasing protection of sensitive data and geolocation data – and also tripling fines on abuse of youth data.

The Irish Data Protection Commission plans to begin enforcement this month of their guidelines on cookies compliance and consent. Key for companies to know is that they cannot rely on express consent.

A survey of 1500 employees taken in March and June 2020 showed users, especially younger users, acting more dangerously online, visiting and returning to sites where their information was stolen or at risk. -29% said they’d continue visiting a website after receiving a browser warning that it was insecure -36% said they’d revisit a website after a hack -37% said their organization does not enforce restrictions on their corporate devices

Clothing retailer, H&M is accused of collecting data on the private lives of employees in Germany according to Hamburg’s data protection commissioner. The personal data, which included information on family issues and religious beliefs, was recorded on a call center’s network drive accessible to up to 50 managers, and reportedly used to obtain a detailed profile of the employees for potential decisions related to employment.

How confident are consumers that information they share will be protected? Not very, but a new survey from insights platform vendor, DISQO, indicates trust levels are up since January. Social media is least trusted with 41% and financial institutions are most at 73%.

NIST issues challenge with cash prizes to protect public safety PII  The National Institute of Standards and Technology (NIST) has launched the Differential Privacy Temporal Map Challenge drawing on crowd sourcing to find new ways to protect data from public safety datasets (gathered to issue weather warnings, food recalls, or manage other emergency health needs).

“Pay close attention to data collection, transmission and storage practices of app partners.”

Claiming to be the “first of its kind” in Europe for bringing suit against a tech firm on behalf of children, this alleges YouTube’s methods of targeting children constitutes “major breaches” of UK and EU privacy and data rules. Specifically, YouTube is accused of harvesting kids’ data without parental consent. The suit has been filed on behalf of more than 5 million British children and their parents.

The UK has a new code of practice to protect children’s data, including for apps, toys, educational material and those that use children’s data [See our article]. Intent is to have high levels of privacy built in by default. Firms have 12 months to comply or risk huge fines from the Information Commissioner’s Office.

IAB Tech Lab’s Board this month committed to collaborate to achieve privacy-centric solutions to preserve addressable advertising as part of their Project Rearc initiative. Key principles include having device agnostic solutions that put consumers first; offering consumers predictable privacy; providing user-friendly, transparent privacy controls; and ensuring ongoing adherence to consumer privacy choices.

In a survey conducted by Transcend, 98% of 1,000 consumers agreed data privacy is important to them and will be even more critical in the next five years. The Luxury Institute views the management of privacy as a missed opportunity for companies – viewed more as a legal task than a marketing opportunity. They say companies must reverse that and play to win by creating “personal data pods,” so consumers can actively manage their data assets.

The UK has a new code of practice to protect children’s data, including for apps, toys, educational material and those that use children’s data [See our article]. Intent is to have high levels of privacy built in by default. Firms have 12 months to comply or risk huge fines from the Information Commissioner’s Office.