Guest Author: Jodi Daniels, Founder and CEO of Red Clover Advisors

Data privacy is one of the most complicated and important issues facing modern businesses. With laws varying from state to state, even country to country, and best practices frequently changing, it may be more efficient for companies to outsource their privacy program to an expert who specializes in consumer data privacy.

Fractional privacy officers (FPOs) provide high-level privacy consulting and strategy on a part-time, contract basis. They deliver invaluable assistance in translating and applying the requirements of new and established data privacy legislation to existing business practices and are fully qualified to develop new processes if needed for compliance.

There are four main areas where an FPO’s privacy prowess can be highly beneficial:
Continue Reading Outsource Your Privacy to an Expert

On August 24, 2021, the office of the California Attorney General (AG) Rob Bonta issued a press release notifying the public of healthcare data privacy guidance that AG Bonta sent to stakeholder organizations, including the California Hospital Association, the California Medical Association, and the California Dental Association, that day. According to the press release, the guidance was sent to stakeholders as a bulletin that, in part, reminded the entities of their obligation to notify the California Department of Justice (DOJ) when the health data of more than 500 California residents has been breached.

Continue Reading California AG Issues Press Release Urging “Full Compliance” with State Health Data Privacy Laws

There have been several notable developments this month at the California Attorney General’s office relating to the CCPA. First, California Attorney General (AG) Rob Bonta held a press conference and issued a press release regarding CCPA enforcement in the past year. AG Bonta signaled that under his leadership, as under prior California Attorneys General, such as now Vice President Kamala Harris and United States Department of Health and Human Services Secretary Xavier Becerra, the AG’s office will continue its focus on privacy. AG Bonta emphasized the importance of the CCPA at a time when so much of our lives has moved online due to the COVID-19 pandemic and that “there’s more work to be done.” He reported “great progress” in CCPA enforcement, noting that 75% of businesses that received a notice of violation came into compliance within the CCPA’s 30-day cure period, while the remaining 25% are within the cure period or currently under active investigation.
Continue Reading Recent Developments at the California Attorney General’s Office Concerning the CCPA and Enforcement

Last week a new privacy law limiting what businesses can do with biometric data (for example, facial recognition information and fingerprints) took effect in New York City. The new ordinance requires commercial establishments that collect biometric information to post notices to customers explaining how their data will be used. The law applies to a wide range of businesses, including stores, restaurants, and theaters. The ordinance defines “biometric identifier information” as any “physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.” The law does, however, permit the collection, use, and retention of biometric identifying data if a notice to customers in “plain, simple language” is clearly displayed. The NYC Commissioner of Consumer and Worker Protection is expected to issue further guidance detailing the exact requirements that businesses must follow to comply with the law.
Continue Reading Biometrics Privacy Law Takes Effect in NYC

On June 24, 2021, Google announced that it would extend the phase-out timeline for Chrome’s support of third-party cookies by nearly two years. Although Google originally planned to remove third-party cookie support by early 2022, the revised deadline for late 2023 represents Google’s intent to “move at a responsible pace” that will allow further discussion and engagement with the public and regulators, and to give publishers and the advertising industry at large more time to adjust their services.
Continue Reading Google Extends Phase-Out Timeline for Third-Party Cookies

With the release of iOS 14.5, Apple introduced new App Tracking Transparency (ATT) standards requiring iOS app developers to either cease engaging in user and device data tracking or request permission to continue doing so. According to Apple, “tracking” occurs when user or device data is either (1) linked with information that identifies such user or device collected on apps, websites and other locations owned by third parties for the purposes of targeted advertising or advertising measurement, or (2) shared with data brokers.
Continue Reading iOS Tracking Analysis

On April 26, 2021, the Cyberspace Administration of China, the Ministry of Industry and Information Technology, the Ministry of Public Security, and the State Administration for Market Regulation, jointly released the draft Interim Regulations on the Administration of Personal Information Protection for Mobile Internet Applications. The Draft Interim Regulations apply specifically to data collection via mobile applications and are intended to function alongside China’s currently proposed omnibus data protection legislation, the Personal Information Protection Law. The Draft Interim Regulations were open for public comment until May 26, 2021, and the US-China Business Council submitted comments from its members, including Perkins Coie.
Continue Reading China Proposes Draft Regulations for the Protection of Personal Information Collected Via Mobile Applications

On May 18, 2021, a consumer filed a putative class action lawsuit against a tech company in California federal court. The consumer alleges that the company violates users’ privacy by selling their personally identifiable information (PII) to third parties in connection with a real-time bidding system it uses for digital ad sales. In his complaint, the plaintiff alleges that the company represented in its privacy policy, terms of service, and elsewhere that a user’s PII would not be shared with third parties without the user’s consent. However, the complaint avers that the company purportedly sold users’ PII—including user location data, browsing history, and demographic and health information—to third parties that participate in the company’s ad bidding auction process, and that it did so without ever informing users that their data was being shared. The complaint alleges that this conduct violates the Electronic Communications Privacy Act (ECPA) as well as a range of consumer privacy and contract rights under California constitutional, statutory, and common law.
Continue Reading Class Action Lawsuit Alleges Improper Sale of PII for Ad Bidding Purposes