DOCSLIB.ORG

Findings of the Data Privacy and Security Advisory Committee September 2020

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Findings of the Data Privacy and Security Advisory Committee September 2020 Wisconsin Department of Agriculture, Trade and Consumer Protection Findings of the Data Privacy and Security Advisory Committee September 2020 Page | 0 WI DATCP Data Privacy and Security Report - September 2020 EXECUTIVE SUMMARY ....................................................................................................................... 2 INTRODUCTION ................................................................................................................................... 4 COMMITTEE OBJECTIVES AND STRUCTURE.................................................................................... 5 Table 1: Membership List .................................................................................................................................... 6 Table 2: Meeting Schedule .................................................................................................................................. 7 CURRENT LANDSCAPE OF DATA PRIVACY, SECURITY, AND BREACH REGULATION ............... 8 Data Privacy ............................................................................................................................................................. 8 Data Security ............................................................................................................................................................ 9 Data Breach ...........................................................................................................................................................11 Other Privacy and Security Related Laws and Legislation ..................................................................................12 Wisconsin 2019 Legislative Session ....................................................................................................................12 2019 Senate Bill 784 / 2019 Assembly Bill 819 ............................................................................................12 2019 Assembly Bills 870, 871, and 872 .........................................................................................................12 2019 Senate Bill 851 ........................................................................................................................................13 ADVISORY COMMITTEE MEETINGS ................................................................................................ 13 IDEAS FOR WISCONSIN ................................................................................................................... 18 Education................................................................................................................................................................18 New Ideas ...............................................................................................................................................................19 Harmonization ........................................................................................................................................................20 LOOKING AHEAD: INSIGHTS FOR CONSIDERATION AND EXPLORATION ................................ 21 Harmonize the Definition of Personally Identifiable Information (PII) ...................................................22 Consideration for Existing Regulations .................................................................................................................23 Consideration for the Size of Business and Nature of Risk ................................................................................23 Data Breach: Acquisition of Data or Unauthorized Access to Data? .....................................................24 Data Breach: Who to Report to? What to Report? ...............................................................................................24 Data Breach: Enforceability...................................................................................................................................25 Private Right of Action ...........................................................................................................................................25 Consumer Autonomy of Data: Opt-In vs Opt-Out ..................................................................................................25 Self-Regulation by Business ..................................................................................................................................26 Need for a Federal Approach ................................................................................................................................27 CONCLUSION ..................................................................................................................................... 28 APPENDIX A - Consumer Reports WI Survey................................................................................. 29 APPENDIX B - Public Comments ....................................................................................................47 APPENDIX C - Letter from Members of Insurance, Banking and Credit Union Industries......66 APPENDIX D - Letter from WSTA .................................................................................................. 76 APPENDIX E - Letter from WWBIC ................................................................................................. 77 In 2017, the United States experienced one of the largest data breaches in its history. Nearly 147 million people had their data exposed when the credit reporting bureau Equifax was hacked. The company, charged with collecting and storing the most sensitive consumer data, experienced a breach in which millions of people had their Social Security Numbers, birth dates, addresses, and other data compromised. The breach started in May and went on for three months before Equifax detected it. Once the company discovered the breach in July, it did not notify the public until after its postmortem analysis in September 2017. Equifax entered into a settlement with the Federal Trade Commission and 50 states that included up to $425 million for those impacted by the breach. The Equifax breach occurred on the heels of the harvest of 87 million Facebook user profiles by now- defunct political consulting firm Cambridge Analytica. Facebook allowed the firm access to users’ friend networks and other personal data. For some, this event highlighted an important distinction between a consumer’s data and a company’s data. Eventually, as a result of data breaches related to Cambridge Analytica, Facebook agreed to a $5 billion settlement with the Federal Trade Commission in July 2019. These two incidents exemplify the complex questions and challenges that arise in discussions about data privacy and security. What data should be protected or kept private? How should it be protected? When a breach occurs, when should companies notify their customers? These questions have no easy answers. Regulators across the country have attempted to provide answers and have approached the issue from a number of different vantage points. In Wisconsin, no legislation has been passed since 2010 that relates to consumer data security, privacy, or breach, despite these security threats as well as the numerous changes in technology and the rapid expansion of public and private databases that hold consumers’ personal information. In an effort to better understand the challenges facing consumers and businesses and identify the best ways to balance consumer protection with existing regulatory frameworks, the Wisconsin Department of Agriculture, Trade and Consumer Protection (DATCP) convened an advisory committee. The Data Privacy and Security Advisory Committee had four objectives: To identify and research possible changes to Wisconsin state law, To determine the efficacy of existing consumer data privacy initiatives, To consider how best to protect and secure information received by public and private entities in Wisconsin, and To determine the business community’s readiness to adopt potential regulatory enhancements. Over the course of nine months, the committee listened to presentations by a number of data privacy and security experts, took public comment, participated in large and small group activities and discussions, and conducted independent research and study. The committee explored a number of existing data security laws and proposals. The committee started with the European Union’s (EU) General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) – the first comprehensive privacy legislation in the United States. The committee then heard about laws and proposed legislation nationwide, addressing data privacy, data security and breach. For instance, the committee learned many states have expanded the definition of what data should be protected (personal identifying information or PII), adopted broad breach notification requirements, and required specific timeframes for when a breach notice should take place. Other states have passed Data Privacy and Security Report – September 2020 Page | 2 significant laws addressing data security. A couple states have passed licensing laws requiring companies whose sole or significant purpose is to buy, aggregate, store and sell data to register with the state. Still others have passed laws that permit defenses to breach liability for businesses that “reasonably conform to an industry recognized cybersecurity framework” such as the National Institute of Standards and Technology (NIST) and the International
Load more

Recommended publications
  • Privacy Online: a Report to Congress
    PRIVACY ONLINE: A REPORT TO CONGRESS FEDERAL TRADE COMMISSION JUNE 1998 FEDERAL TRADE COMMISSION Robert Pitofsky Chairman Mary L. Azcuenaga Commissioner Sheila F. Anthony Commissioner Mozelle W. Thompson Commissioner Orson Swindle Commissioner BUREAU OF CONSUMER PROTECTION Authors Martha K. Landesberg Division of Credit Practices Toby Milgrom Levin Division of Advertising Practices Caroline G. Curtin Division of Advertising Practices Ori Lev Division of Credit Practices Survey Advisors Manoj Hastak Division of Advertising Practices Louis Silversin Bureau of Economics Don M. Blumenthal Litigation and Customer Support Center Information and Technology Management Office George A. Pascoe Litigation and Customer Support Center Information and Technology Management Office TABLE OF CONTENTS Executive Summary .......................................................... i I. Introduction ........................................................... 1 II. History and Overview .................................................... 2 A. The Federal Trade Commission’s Approach to Online Privacy ................. 2 B. Consumer Privacy Online ............................................. 2 1. Growth of the Online Market ...................................... 2 2. Privacy Concerns ............................................... 3 C. Children’s Privacy Online ............................................. 4 1. Growth in the Number of Children Online ............................ 4 2. Safety and Privacy Concerns ...................................... 4 III. Fair
    [Show full text]
  • Principles of Internet Privacy
    Maurer School of Law: Indiana University Digital Repository @ Maurer Law Articles by Maurer Faculty Faculty Scholarship 2000 Principles of Internet Privacy Fred H. Cate Indiana University Maurer School of Law, [email protected] Follow this and additional works at: https://www.repository.law.indiana.edu/facpub Part of the Computer Law Commons, and the Law and Society Commons Recommended Citation Cate, Fred H., "Principles of Internet Privacy" (2000). Articles by Maurer Faculty. 243. https://www.repository.law.indiana.edu/facpub/243 This Article is brought to you for free and open access by the Faculty Scholarship at Digital Repository @ Maurer Law. It has been accepted for inclusion in Articles by Maurer Faculty by an authorized administrator of Digital Repository @ Maurer Law. For more information, please contact [email protected]. Principles of Internet Privacy FRED H. CATE* I. INTRODUCTION Paul Schwartz's InternetPrivacy and the State makes an important and original contribution to the privacy debate that is currently raging by be- ginning the process of framing a new and more useful understanding of what "privacy" is and why and how it should be protected.' The definition developed by Brandeis, Warren,2 and Prosser,3 and effectively codified by Alan Westin in 1967---"the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others"---worked well in a world in which most privacy concerns involved physical intrusions (usually by the government) or public disclosures (usually by the media), which, by their very nature, were comparatively rare and usually discovered.
    [Show full text]
  • The Right to Privacy in the Digital Age
    The Right to Privacy in the Digital Age April 9, 2018 Dr. Keith Goldstein, Dr. Ohad Shem Tov, and Mr. Dan Prazeres Presented on behalf of Pirate Parties International Headquarters, a UN ECOSOC Consultative Member, for the Report of the High Commissioner for Human Rights Our Dystopian Present Living in modern society, we are profiled. We accept the necessity to hand over intimate details about ourselves to proper authorities and presume they will keep this information secure- only to be used under the most egregious cases with legal justifications. Parents provide governments with information about their children to obtain necessary services, such as health care. We reciprocate the forfeiture of our intimate details by accepting the fine print on every form we sign- or button we press. In doing so, we enable second-hand trading of our personal information, exponentially increasing the likelihood that our data will be utilized for illegitimate purposes. Often without our awareness or consent, detection devices track our movements, our preferences, and any information they are capable of mining from our digital existence. This data is used to manipulate us, rob from us, and engage in prejudice against us- at times legally. We are stalked by algorithms that profile all of us. This is not a dystopian outlook on the future or paranoia. This is present day reality, whereby we live in a data-driven society with ubiquitous corruption that enables a small number of individuals to transgress a destitute mass of phone and internet media users. In this paper we present a few examples from around the world of both violations of privacy and accomplishments to protect privacy in online environments.
    [Show full text]
  • Internet Privacy and the State
    UC Berkeley UC Berkeley Previously Published Works Title Internet Privacy and the State Permalink https://escholarship.org/uc/item/37x3z12g Author Schwartz, Paul M Publication Date 2021-06-27 Peer reviewed eScholarship.org Powered by the California Digital Library University of California Berkeley Law Berkeley Law Scholarship Repository Faculty Scholarship 1-1-1999 Internet Privacy and the State Paul M. Schwartz Berkeley Law Follow this and additional works at: http://scholarship.law.berkeley.edu/facpubs Part of the Law Commons Recommended Citation Paul M. Schwartz, Internet Privacy and the State, 32 Conn. L. Rev. 815 (1999), Available at: http://scholarship.law.berkeley.edu/facpubs/766 This Article is brought to you for free and open access by Berkeley Law Scholarship Repository. It has been accepted for inclusion in Faculty Scholarship by an authorized administrator of Berkeley Law Scholarship Repository. For more information, please contact [email protected]. Interet Privacy and the State PAUL M. SCHWARTZ" INTRODUCTION "Of course you are right about Privacy and Public Opinion. All law is a dead letter without public opinion behind it. But law and public opinion in-1 teract-and they are both capable of being made." Millions of people now engage in daily activities on the Internet, and under current technical configurations, this behavior generates finely grained personal data. In the absence of effective limits, legal or other- wise, on the collection and use of personal information on the Internet, a new structure of power over individuals is emerging. This state of affairs has significant implications for democracy in the United States, and, not surprisingly, has stimulated renewed interest in information privacy? Yet, the ensuing debate about Internet privacy has employed a deeply flawed rhetoric.
    [Show full text]
  • Mr. Bruno Gencarelli Head of Unit for International Data Flows and Protection European Commission [email protected]
    Mr. Bruno Gencarelli Head of Unit for International Data Flows and Protection European Commission [email protected] 26 July 2019 Re: Access Now Responds to Privacy Shield Review Questionnaire - Third review Dear Mr. Gencarelli, Thank you for your invitation to provide information and observations on the European Commission’s third annual review of the EU-U.S. Privacy Shield arrangement, the mechanism to facilitate the transfer and processing of the personal data of individuals from the European Union to and within the United States. Access Now is an international organisation that defends and extends the digital rights of users at risk around the world.1 By combining innovative policy, user engagement, and direct technical support, we fight for open and secure communications for all. Access Now maintains a presence in 13 locations around the world, including in the policy centers of Washington, DC and Brussels.2 Access Now regularly analyzes data transfer arrangements under EU law, including the Safe Harbor arrangement that was invalidated by the Court of Justice of the European Union in 2015, and the Privacy Shield which replaced it.3 Users benefit from a free, open, and secure internet that is enabled by legal certainty for stakeholders to operate. Robust data transfer frameworks which ensure a high level of data protection in the free flow of data are key to deliver these benefits for all actors. The Privacy Shield continues to be inadequate to protect fundamental rights. Since negotiations began in 2016, Access Now has provided detailed analysis and recommendations to the EU Commission on how to improve the Privacy Shield.
    [Show full text]
  • Data Protection Directive 95/46/EC to the Internet, 25 J. Marshall J
    The John Marshall Journal of Information Technology & Privacy Law Volume 25 Issue 2 Journal of Computer & Information Law Article 2 - Spring 2008 Spring 2008 All or Nothing: This is the Question? The Application of Article 3(2) Data Protection Directive 95/46/EC to the Internet, 25 J. Marshall J. Computer & Info. L. 241 (2008) Rebecca Wong Joseph Savirimuthu Follow this and additional works at: https://repository.law.uic.edu/jitpl Part of the Computer Law Commons, Internet Law Commons, Privacy Law Commons, and the Science and Technology Law Commons Recommended Citation Rebecca Wong & Joseph Savirimuthu, All or Nothing: This is the Question? The Application of Article 3(2) Data Protection Directive 95/46/EC to the Internet, 25 J. Marshall J. Computer & Info. L. 241 (2008) https://repository.law.uic.edu/jitpl/vol25/iss2/2 This Article is brought to you for free and open access by UIC Law Open Access Repository. It has been accepted for inclusion in The John Marshall Journal of Information Technology & Privacy Law by an authorized administrator of UIC Law Open Access Repository. For more information, please contact [email protected]. ALL OR NOTHING: THIS IS THE QUESTION? THE APPLICATION OF ARTICLE 3(2) DATA PROTECTION DIRECTIVE 95/46/ EC TO THE INTERNET REBECCA WONGt AND JOSEPH SAVIRIMUTHUtt I. INTRODUCTION The exponential growth of social networking Web sites, online per- sonal journals and the use of multimedia by individuals, raises impor- tant questions about the compatibility of Article 3(2) of the Data Protection Derivative 95/46/EC ("DPD") as applied to the internet.
    [Show full text]
  • Trends in Privacy and Data Security
    TRENDS IN PRIVACY AND DATA SECURITY JEFFREY D. NEUBURGER PARTNER PROSKAUER ROSE LLP Jeff is co-head of the firm’s Technology, Media & Telecommunications Group, head of the firm’s Blockchain Group, and a member of the firm’s Privacy & Cybersecurity Group. His practice focuses on technology, media, and intellectual property-related transactions, counseling, and dispute resolution. 24 April/May 2019 | Practical Law © 2019 Thomson Reuters. All rights reserved. As large-scale data breaches and other cyber incidents continue to pose significant threats worldwide, privacy and cybersecurity remain top priorities for regulators and companies alike. To minimize risks and reduce potential liability, companies and their counsel should stay updated on privacy and data security-related enforcement activity, notable litigation, new regulations, and key emerging issues. the-lightwriter /iStock photo © 2019 Thomson Reuters. All rights reserved. The Journal | Litigation | April/May 2019 25 ompanies must keep up with the dynamic legal Children’s privacy practices. The FTC approved obligations governing privacy and data security, modifications to the Entertainment Software Rating Board’s understand how these obligations apply in practice, (ESRB’s) COPPA safe harbor program. The ESRB is a self- improve their cyber intelligence, and manage their regulatory organization for the video game industry. Ccompliance to minimize risks. This article reviews important Mobile device security. The FTC issued a report titled FTC privacy and data security developments over the past year and Recommends Steps to Improve Mobile Device Security highlights key issues for 2019. Specifically, it addresses recent: Update Practices (available at ftc.gov), which makes several Federal regulation and enforcement actions.
    [Show full text]
  • The Privacy, Data Protection and Cybersecurity Law Review
    The Privacy, Data Protection and Cybersecurity Law Review Editor Alan Charles Raul Law Business Research The Privacy, Data Protection and Cybersecurity Law Review The Privacy, Data Protection and Cybersecurity Law Review Reproduced with permission from Law Business Research Ltd. This article was first published in The Privacy, Data Protection and Cybersecurity Law Review - Edition 1 (published in November 2014 – editor Alan Charles Raul). For further information please email [email protected] The Privacy, Data Protection and Cybersecurity Law Review Editor Alan Charles Raul Law Business Research Ltd THE LAW REVIEWS THE MERGERS AND ACQUISITIONS REVIEW THE RESTRUCTURING REVIEW THE PRIVATE COMPETITION ENFORCEMENT REVIEW THE DISPUTE RESOLUTION REVIEW THE EMPLOYMENT LAW REVIEW THE PUBLIC COMPETITION ENFORCEMENT REVIEW THE BANKING REGULATION REVIEW THE INTERNATIONAL ARBITRATION REVIEW THE MERGER CONTROL REVIEW THE TECHNOLOGY, MEDIA AND TELECOMMUNICATIONS REVIEW THE INWARD INVESTMENT AND INTERNATIONAL TAXATION REVIEW THE CORPORATE GOVERNANCE REVIEW THE CORPORATE IMMIGRATION REVIEW THE INTERNATIONAL INVESTIGATIONS REVIEW THE PROJECTS AND CONSTRUCTION REVIEW THE INTERNATIONAL CAPITAL MARKETS REVIEW THE REAL ESTATE LAW REVIEW THE PRIVATE EQUITY REVIEW THE ENERGY REGULATION AND MARKETS REVIEW THE INTELLECTUAL PROPERTY REVIEW THE ASSET MANAGEMENT REVIEW THE PRIVATE WEALTH AND PRIVATE CLIENT REVIEW THE MINING LAW REVIEW THE EXECUTIVE REMUNERATION REVIEW THE ANTI-BRIBERY AND ANTI-CORRUPTION REVIEW THE CARTELS AND LENIENCY REVIEW THE TAX DISPUTES
    [Show full text]
  • 2015 International Compendium of Data Privacy Laws COUNTRY by REGION Australia Australia
    2015 International Compendium of Data Privacy Laws COUNTRY BY REGION Australia Australia................................................................................................................................. 6 Central Asia China (People’s Republic) .................................................................................................. 37 Hong Kong........................................................................................................................... 78 India..................................................................................................................................... 88 Japan................................................................................................................................. 106 South Korea....................................................................................................................... 149 Taiwan............................................................................................................................... 157 Central America Bahamas ............................................................................................................................. 16 Costa Rica........................................................................................................................... 43 Trinidad and Tobago.......................................................................................................... 160 Europe Austria ................................................................................................................................
    [Show full text]
  • The Pii Problem: Privacy and a New Concept of Personally Identifiable Information
    \\jciprod01\productn\N\NYU\86-6\NYU603.txt unknown Seq: 1 28-NOV-11 15:01 THE PII PROBLEM: PRIVACY AND A NEW CONCEPT OF PERSONALLY IDENTIFIABLE INFORMATION PAUL M. SCHWARTZ† & DANIEL J. SOLOVE‡ Personally identifiable information (PII) is one of the most central concepts in information privacy regulation. The scope of privacy laws typically turns on whether PII is involved. The basic assumption behind the applicable laws is that if PII is not involved, then there can be no privacy harm. At the same time, there is no uniform definition of PII in information privacy law. Moreover, computer science has shown that in many circumstances non-PII can be linked to individuals, and that de-identified data can be re-identified. PII and non-PII are thus not immutable categories, and there is a risk that information deemed non-PII at one time can be transformed into PII at a later juncture. Due to the malleable nature of what consti- tutes PII, some commentators have even suggested that PII be abandoned as the mechanism by which to define the boundaries of privacy law. In this Article, we argue that although the current approaches to PII are flawed, the concept of PII should not be abandoned. We develop a new approach called “PII 2.0,” which accounts for PII’s malleability. Based upon a standard rather than a rule, PII 2.0 utilizes a continuum of risk of identification. PII 2.0 regulates informa- tion that relates to either an “identified” or “identifiable” individual, and it estab- lishes different requirements for each category.
    [Show full text]
  • Privacy, Anonymity, and Perceived Risk in Open
    Privacy, Anonymity, and Perceived Risk in Open Collaboration: A Study of Tor Users and Wikipedians Andrea Forte, Nazanin Andalibi, Rachel Greenstadt College of Computing and Informatics, Drexel University Philadelphia, PA, USA {aforte, naz, rachel.a.greenstadt}@drexel.edu ABSTRACT not documented, but are thought to hinge on his This qualitative study examines privacy practices and activism and open collaboration projects. As of this concerns among contributors to open collaboration projects. writing, his location is unknown. [12] We collected interview data from people who use the anonymity network Tor who also contribute to online CSCW researchers have often investigated aspects of open projects and from Wikipedia editors who are concerned collaboration projects like open source software or about their privacy to better understand how privacy Wikipedia, but seldom frame participation in such projects concerns impact participation in open collaboration as a process of negotiating risk. The groundswell of open projects. We found that risks perceived by contributors to collaboration projects throughout the 1990s and 2000s open collaboration projects include threats of surveillance, became an unprecedented source of data for those interested violence, harassment, opportunity loss, reputation loss, and in understanding computer-mediated cooperative practices. fear for loved ones. We explain participants’ operational Yochai Benkler theorized commons-based peer production and technical strategies for mitigating these risks and how as a new economic and organizational model [5]. these strategies affect their contributions. Finally, we Researchers asked questions like, “How do contributors discuss chilling effects associated with privacy loss, the organize their efforts?” [13, 23] and “What do contributors need for open collaboration projects to go beyond attracting learn through participation?” [18].
    [Show full text]
  • Protecting Information Privacy
    Equality and Human Rights Commission Research report 69 Protecting information privacy Charles Raab and Benjamin Goold University of Edinburgh and University of British Columbia Equality and Human Rights Commission 2011 First published Summer 2011 ISBN 978 1 84206 347 7 Equality and Human Rights Commission Research Report series The Equality and Human Rights Commission Research Report Series publishes research carried out for the Commission by commissioned researchers. The views expressed in this report are those of the authors and do not necessarily represent the views of the Commission. The Commission is publishing the report as a contribution to discussion and debate. Please contact the Research Team for further information about other Commission research reports, or visit our website: Research Team Equality and Human Rights Commission Arndale House The Arndale Centre Manchester M4 3AQ Email: [email protected] Telephone: 0161 829 8500 Website: www.equalityhumanrights.com If you require this publication in an alternative format, please contact the Communications Team to discuss your needs at: [email protected] Contents Acknowledgements iii Executive summary v 1. Introduction 1 1.1 Background 1 1.2 The aim of the report 4 1.3 Structure of the report 6 2. The changing landscape of privacy 9 2.1 Introduction 9 2.2 Information privacy: challenges, concerns, and responses 10 2.3 Opportunities for reform 13 2.4 Summary 14 3. Why privacy matters 15 3.1 Introduction 15 3.2 Making a case for privacy 15 3.3 Privacy and the state 19 3.4 The future of privacy 22 3.5 Summary 24 4.
    [Show full text]