Data Privacy Basics – International Compliance

Total Page:16

File Type:pdf, Size:1020Kb

Data Privacy Basics – International Compliance Data privacy basics – international compliance By Carol Umhoefer One of the hallmarks of 21st century startups is that they go global early, or even from inception. But while some brilliant ideas hatched in the US have instant global appeal, others may run up against markets organized around laws that don’t even exist in the home country. Many a good idea starts with personal data, and particularly big data – its collection, organization, enhancement and monetization. The unfettered imagination puts data to work in innovative ways that open new markets and create new demand, thus generating revenues. Yet some of the simplest ideas will run afoul of market concerns stemming from laws foreign to us. How are privacy laws outside the US different from US laws? There are several fundamental differences between US privacy laws and data protection laws in other countries. First of all, and particularly in the countries of the EEA (European Economic Area, comprised of the 28 EU member states plus Iceland, Liechtenstein and Norway), data protection rights are considered fundamental rights of the individual, protecting an individual's right to privacy in respect of data relating to an identified or identifiable natural person. Privacy rights are not fundamental rights under US law. Second, countries with data protection laws have generally adopted comprehensive rules that apply to all personal data processing by all persons: natural, legal or governmental. In other words, the standard approach outside the US is not to legislate based on sectors or specific types of data (although of course, even with a comprehensive data protection law there may be specific laws requiring additional protections for, say, patient health data, or bank customer data). Third, in most countries there is a data protection authority dedicated to enforcing the law, issuing recommendations and preparing opinions on proposed legislation that may impact privacy rights in personal data. Is there data that is subject to regulation outside the US that may not be regulated in the US? One example is monitoring data, which alone or combined can provide rich insights into worker productivity and consumer proclivities. Under the laws of the European Union – the world's largest free trade area, with over 500 million consumers – the monitoring of human beings will likely entail the processing of personal data, whether an IP address, an image or the GPS coordinates of a daily commute. In the EU, monitoring persons by collecting their personal data will be subject to specific restrictions, such as express consent of the individual each time she is located, or the vote of workers' representatives. This can mean that an employee-monitoring service measuring productivity against other factors (day, time, weather, sick leave history) that is seen as implementing workplace progress in one jurisdiction will be perceived as risky, if not illegal, in another. A second example is big data that is used to inform decision making. The appeal of more efficient and more predictive decisions around, say, extending loans or detecting fraud seemingly should be universal, but here again the EU legal position www.dlapiperaccelerate.com on protecting individuals' rights may militate against any type of automatic decision making. In many cases, an individual must consent whenever a legal or significant decision about him or her is made automatically, and he or she will be entitled to obtain human intervention in the decision. In other cases, the product itself may need to win the approval of a data protection authority in order to be marketed without creating compliance risks for customers. What is the GDPR? The trend over the past ten years throughout Asia and Latin America has been to adopt data protection laws styled on the EU data protection regime. This trend of geographical expansion of EU data protection principles was compounded on May 25, 2018, with the entry into force of the EU’s General Data Protection Regulation. The GDPR specifically applies to companies outside the EU that offer products or services to, or monitor the behavior of, persons in the EU. One of the new obligations under the GDPR will be to adopt privacy by design and privacy by default principles, such that the protection of individuals' privacy by protecting their personal data can be ensured by the very design and default settings of new market offerings. More than ever, innovation needs to take account of privacy concerns to realize its full revenue potential. What do people mean when they refer to a ''Safe Harbor''? "Safe Harbor" was a program administered by the US Department of Commerce and approved by the European Commission to facilitate transfers of personal data from the EU or Switzerland to the US. In October 2015, the Court of Justice of the European Union invalidated the Safe Harbor. But to fully understand the importance of Safe Harbor, a little bit of history is in order. Safe Harbor was adopted in 2000 in response to the 1995 Data Protection Directive of the EU. Under the Directive, transfers of personal data outside the EU are prohibited unless, notably, the country of destination provides an adequate level of protection to personal data as in the EU. The US is not considered by the EU to provide adequate protection to personal data, meaning that other legal mechanisms for transferring personal data from the EU to the US must be applied (for example, a contract executed between the data exporter in the EU and the data importer in the US). The Safe Harbor allowed US entities to self-certify their compliance with data protection principles very similar to those in the Directive, and those entities were therefore considered to provide adequate protection to personal data, even absent a contract with the EU data exporter – a significant simplification of data transfers for some US companies. What is a privacy shield? Safe Harbor had been subject to criticisms in the EU, particularly after the Snowden revelations, and at the time of the invalidation of Safe Harbor in 2015, the US and EU had already been discussing for several years how to improve the protections under Safe Harbor. Those discussions took on new urgency after the invalidation and in February 2016 a political agreement was reached to replace Safe Harbor with a new program administered by the US Department of Commerce – the Privacy Shield. Similar to Safe Harbor in that it relies on self-certification, Privacy Shield provides substantially more rights of redress for EU individuals whose data is transferred to a Privacy Shield-certified entity in the US. Filing of Privacy Shield applications with the Department of Commerce began in August 2016. www.dlapiperaccelerate.com Do I have to comply with the privacy laws of every country? Privacy laws don't necessarily apply in the same way that other laws do. Data protection laws may apply based on where the data is collected or where the relevant individual resides. It is therefore prudent to check the data protection law of every country from where data originates to see if that law applies. As of May 25, 2018, the GDPR will apply to personal data processing related to offering goods or services to, or monitoring behavior of, natural persons in the EU. What are some steps my company should take to comply with data privacy laws outside the US? One feature of all comprehensive data protection laws is the requirement to provide notice to individuals, at the time of collection of their data, about what is being done with that data: who is collecting it, why, where the data is going and to whom. In the US, most companies comply with this requirement by including a privacy policy on their website (see our article on Privacy Policies). The EU countries notably also require notices to contain information about individuals’ rights in respect of their personal data, and how to exercise those rights. The requirements for the content of the notice are not uniform across the globe, but, at least with respect to consumers, it's usually possible to draft one notice that will get the business close to compliance in most jurisdictions. In practice, this will mean the notice is longer than it might have been were it designed to meet the requirements of only one country's law. But lengthy notices are here to stay. The GDPR mandates more detailed notices, with new types of information, such as how to file a complaint with a regulator and how long personal data is retained. The GDPR also sets out specific notice requirements if a child's data is collected. All of this means notices are getting longer, and making sure they are well drafted will become more and more important to ensure true transparency. While the privacy notice is a key transparency obligation under data protection laws, it is not the only one. The EU countries require notice relating to the use of cookies and other tracking technologies, even if no personal data is collected by those technologies. Many countries also require separate notice to be placed on any personal data collection form. And although not falling under data protection laws, EU directives mandate specific information on websites regarding the site operator and other actors. All these requirements are in addition to consumer protection laws, which also mandate providing a variety of information to consumers (usually in the form of sales terms), such as the conditions for returning a product or obtaining a refund under statutory warranty. Does my privacy policy/notice have to be in any language other than English? If you have a privacy notice intended to satisfy transparency requirements under data protection laws, you might need to translate it into the local language(s) – or you might not.
Recommended publications
  • Google Privacy Policy: Main Findings and Recommendations
    APPENDIX GOOGLE PRIVACY POLICY: MAIN FINDINGS AND RECOMMENDATIONS OUTLINE I. Main findings .............................................................................................................................................................. 2 1) Legal Framework ................................................................................................................................................. 2 2) Information ............................................................................................................................................................ 2 3) Combination of data across services ........................................................................................................... 3 4) Retention period .................................................................................................................................................. 5 II. Recommendations ................................................................................................................................................... 5 1) Information ............................................................................................................................................................ 5 i. Particular case of mobile users ................................................................................................................. 6 ii. Particular case of passive users ................................................................................................................ 7 2)
    [Show full text]
  • An Analysis of Google's Privacy Policy and Related
    1 AN ANALYSIS OF GOOGLE’S PRIVACY POLICY AND RELATED FAQs A DATA PROTECTION ANALYSIS FROM AMBERHAWK TRAINING LTD DR. C. N. M. POUNDER, MARCH 2012 An analysis of Google’s Privacy Policy (March 2012) ©Amberhawk Training Limited 2 AN ANALYSIS OF GOOGLE’S PRIVACY POLICY AND RELATED FAQs MANAGEMENT SUMMARY Google’s new combined Privacy Policy (March 2012) has been widely criticised by privacy professionals and Data Protection Authorities (in particular the CNIL – the French Data Protection Authority). However the reasons for this criticism have been made in general terms; my analysis provides a detailed explanation. The analysis shows that Google’s Privacy Policy is incoherent because it uses overlapping terms. This makes the Policy difficult to follow and to understand what type of information the Policy is claiming to protect. It cannot be fair to users if they cannot understand what the Policy means for them. The Policy is also unfair in conventional terms as it does not, in many instances, fully describe the purposes of the processing. Secondly, my analysis also confirms the claim of the CNIL that the Privacy Policy is in breach of the Data Protection Directive. However, I also show that it is in breach of the USA’s Safe Harbor Principles. As the Privacy Policy states that “Google complies with the US-EU Safe Harbour Framework”, I show that this claim cannot be substantiated if Google’s new Privacy Policy is implemented. Contradictory and confusing? The Privacy Policy uses a wide range of similar terms in different circumstances which I think are contradictory.
    [Show full text]
  • Spying on Students: School Issued Devices and Student Privacy (EFF)
    Spying on Students SCHOOL-ISSUED DEVICES AND STUDENT PRIVACY Frida Alim, Bridge Fellow Na e Cardo!o, Se"ior Sta## A or"e$ %e""ie Ge&'art, Re(ear)'er *are" Gullo, Media Relatio"( Anal$( Amul Kalia, Anal$( A-ril 1/, 21.2 ELECTRONIC FRONTIER FOUNDATION EFF3OR% 1 Authors: Frida Alim, Nate Cardozo, Gennie Gebhart, Karen Gullo, Amul Kalia With assistance from: Sophia Cope, Hugh D’Andrade, Jeremy Gillula, Rainey Reitman A publication of the Electronic Frontier Foundation, 2017. “Spying on Students: School-Issued Devices and Student Privacy” is released under a Creative Commons Attribution 4.0 International License (CC BY 4.0). ELECTRONIC FRONTIER FOUNDATION EFF3OR% 2 Table of Contents Executive Summary..................................................................................................................................................... 5 Introduction.................................................................................................................................................................. 7 Part 1: Survey Results................................................................................................................................................. 8 Methods..................................................................................................................................................................... 9 Respondents and Overall Trends....................................................................................................................10 Findings..................................................................................................................................................................
    [Show full text]
  • Privacy Policy
    Privacy Policy IDI, LLC and its affiliate, ICS Inventory, LLC (“We,” “Our,” or “Us”) respects the privacy and security of your personal information. The following describes how we collect, use and disclose information and what rights you have to it. This Privacy Policy describes our practices in connection with information that we collect from you through our software applications, services, websites and mobile applications from our public facing side of our services and products and from our private access products and services that require registration before use (“Services”) and from sources other than our Services including, but not limited to, the telephone, mail and trade shows. This Privacy Policy also applies to any information that you may provide to us via an IDI Qualified Administrator’s (“IDIQA”) credential, website and/or other access method that enables you to use our Services. By providing information to us and/or using our Services, you acknowledge and agree to the terms and conditions of this Privacy Policy. If you do not agree to these terms and conditions, please do not use our Services. Information Collection We gather various types of information from you including personal information and personal data Personal information or personal data refers to any data or information which relates to an identified or identifiable natural person, and are the subject to applicable data protection laws, such as the EU General Data Protection Regulation 2016/679 (“GDPR”), and/or the California Consumer Privacy Act (Assembly Bill 375) (“CCPA”) including, but not limited to, your name, postal addresses (including billing and shipping addresses), telephone numbers, and email addresses, and Sensitive Information (as defined below).
    [Show full text]
  • PRIVACY POLICY Institute for Economics and Peace 1. We Respect Your Privacy
    PRIVACY POLICY Institute for Economics and Peace 1. We respect your privacy a. Institute for Economics and Peace respects your right to privacy and is committed to safeguarding the privacy of our customers and website visitors. This policy sets out how we collect and treat your personal information. b. We adhere to the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) and to the extent applicable, the EU General Data Protection Regulation (GDPR). c. "Personal information" is information we hold which is identifiable as being about you. This includes information such as your name, email address, identification number, or any other type of information that can reasonably identify an individual, either directly or indirectly. d. You may contact us in writing at PO Box 42 St Leonards , Sydney , New South Wales, 1590 for further information about this Privacy Policy. 2. What personal information is collected a. Institute for Economics and Peace will, from time to time, receive and store personal information you submit to our website, provided to us directly or given to us in other forms. b. You may provide basic information such as your name, phone number, address and email address to enable us to send you information, provide updates and process your product or service order. c. We may collect additional information at other times, including but not limited to, when you provide feedback, when you provide information about your personal or business affairs, change your content or email preference, respond to surveys and/or promotions, provide financial or credit card information, or communicate with our customer support.
    [Show full text]
  • Privacy Policy
    Privacy Policy Human Rights Watch Privacy Statement This website together with any non-English language versions (the Human Rights Watch websites) are provided by Human Rights Watch, Inc. ("Human Rights Watch" or "HRW") and hosted in the United States. Human Rights Watch is a non-profit, non-governmental organization that investigates and exposes abuses around the world and advocates for the protection of human rights and human dignity around the globe. We are committed to protecting your right to privacy. What is this Privacy Statement? This Privacy Statement sets out our information processing practices in relation to you and your personal data. These principles apply when we collect personal data from you through any channel. It explains Human Rights Watch’s information processing practices and applies to any personal information you provide to Human Rights Watch and any personal information we collect from other sources. This Privacy Statement is a description of our practices and of your rights regarding your personal information, but it is not a contract and it does not create any new rights or obligations beyond what the law already provides. This Privacy Statement does not apply to your use of a third-party site linked to on this website. Please refer to the privacy statement of that third-party site to understand how they handle your personal information. Who is responsible for your information? Throughout this Statement, "Human Rights Watch" or "HRW" refers to Human Rights Watch, Inc., and its various parts around the world, including its affiliated charities, branch offices and other registered entities (also referred to as "we", "us", or "our").
    [Show full text]
  • Online Service Providers' Privacy and Transparency Practices Regarding
    THE ELECTRONIC FRONTIER FOUNDATION'S SEVENTH ANNUAL REPORT ON Online Service Providers’ Privacy and Transparency Practices Regarding Government Access to User Data Nate Cardozo, Senior Staff Attorney Andrew Crocker, Staff Attorney Jennifer Lynch, Senior Staff Attorney Kurt Opsahl, Deputy Executive Director and General Counsel Rainey Reitman, Activism Director July 2017 ELECTRONIC FRONTIER FOUNDATION EFF.ORG 1 Authors: Nate Cardozo, Andrew Crocker, Jennifer Lynch, Kurt Opsahl, Rainey Reitman With assistance from: Hugh D’Andrade, Gennie Gebhart A publication of the Electronic Frontier Foundation, 2017 “Who Has Your Back? 2017” is released under a Creative Commons Attribution 4.0 International License (CC BY 4.0). ELECTRONIC FRONTIER FOUNDATION EFF.ORG 2 Table of Contents Executive Summary.....................................................................................................................4 2017 Results Table...................................................................................................................5 Major Findings and Trends.................................................................................................................................5 Overview of Criteria...............................................................................................................7 Deep Dive and Analysis of Select Corporate Policies..............................................................................10 Follows Industry-Wide Best Practices................................................................................10
    [Show full text]
  • An Analysis of P3P-Enabled Web Sites Among Top-20 Search Results
    An Analysis of P3P-Enabled Web Sites among Top-20 Search Results Serge Egelman Lorrie Faith Cranor Abdur Chowdhury Carnegie Mellon University Carnegie Mellon University America Online, Inc. 5000 Forbes Avenue 5000 Forbes Avenue 22000 AOL Way Pittsburgh, PA 15213 Pittsburgh, PA 15213 Dulles, VA 20166 [email protected] [email protected] [email protected] ABSTRACT Keywords Search engines play an important role in helping users find P3P, Privacy Policies, Search Engines, E-Commerce desired content. With the increasing deployment of computer- readable privacy policies encoded using the standard W3C Platform for Privacy Preferences (P3P) format, search en- 1. INTRODUCTION gines also have the potential to help users identify web sites According to a 2005 poll conducted by CBS News and the that will respect their privacy needs. We conducted a study New York Times, 82% of respondents believed that the right of the quantity and quality of P3P-encoded privacy poli- to privacy in the U.S. is either under serious threat or is al- cies associated with top-20 search results from three popular ready lost. This same poll also found that 83% believe that search engines. We built a P3P-enabled search engine and companies could potentially share their personal information used it to gather statistics on P3P adoption as well as the inappropriately [7]. These responses are similar to a 2000 privacy landscape of the Internet as a whole. This search en- survey conducted by The Pew Internet & American Life gine makes use of a privacy policy cache that we designed to Project, where 86% of respondents said that they wanted facilitate fast searches.
    [Show full text]
  • The Privacy Problem a Broader View of Information Privacy and the Costs and Consequences of Protecting It
    F IRST R EPORTS VOL. 4, NO. 1 MARCH 2003 The Privacy Problem A broader view of information privacy and the costs and consequences of protecting it BY FRED H. CATE A FIRST AMENDMENT CENTER PUBLICATION Fred H. Cate is a distinguished professor, Ira C. Batman Faculty fellow and director of the Center for Applied Cybersecurity Research at the Indiana University School of Law-Bloomington. He specializes in privacy and other information-law issues and appears regularly before Congress, state legislatures and professional and industry groups on these matters. He has directed the Electronic Information Privacy and Commerce Study for the Brookings Institution and has served as a member of the Federal Trade Commission’s Advisory Committee on Online Access and Security. He is a visiting scholar at the American Enterprise Institute and a senior policy adviser at the Hunton & Williams Center for Information Policy Leadership. Cate is the author of many articles and books concerning privacy and information law, including Privacy in Perspective (AEI Press), Privacy in the Information Age (Brookings Institution Press) and The Internet and the First Amendment (Phi Delta Kappa). He is the co-author (with Marc Franklin and David Anderson) of the sixth edition of the best-selling Mass Media Law (Foundation Press). A graduate of Stanford University and Stanford Law School, Cate is a member of the Phi Beta Kappa Senate and of the board of directors of the Phi Beta Kappa Fellows, and is listed in Who’s Who in America and Who’s Who in American Law. F FIRSTIRST RR EPORTSEPORTS The Privacy Problem A broader view of information privacy and the costs and consequences of protecting it BY FRED H.
    [Show full text]
  • New Rules for Personal Data Protection and Media: Why Reconcile Privacy Policies and Media Business Models in the Digital Environment?
    New rules for personal data protection and media: Why reconcile privacy policies and media business models in the digital environment? Summary Media companies in Serbia are not sufficiently aware of the importance of personal data protection, nor are there developed procedures regarding the fulfilment of standards in line with new rules for personal data protection. Taking into account media business models in a digital environment, which are substantially based on collecting data of visitors and users of websites, it is necessary to advance their practices and internal policies. This is necessary so that they can use the potentials of digital economy and respect the privacy of their audiences in accordance with the new legislation. Introduction All around the world, 25 May 2018 will be remembered as a turning point in the protection of privacy of citizens and as the beginning of a new age of the personal data protection. This was the day when the General Data Protection Regulation (GDPR) ,a new legislative framework which is considered to be the highest standard of the privacy protection, entered into force. The GDPR introduced additional obligations to all those processing personal data, including media and journalists. The regulation covers media policies in terms of controlling data of users, which is a key resource for media business models in a digital environment. In addition, Article 85 of the GDPR places an obligation on the EU member states for ’reconciling’ the freedom of expression and information, and personal data protection in their laws. Thus they are required to establish the balance between these two rights, which also includes processing data for journalistic purposes (European Union, 2016).
    [Show full text]
  • Privacy Policy Template for Facebook App
    Privacy Policy Template For Facebook App Improperly undeclining, Victor suborn thiocarbamide and emphasising armadas. Whit usually donning jerry-buildingseasonally or herrequoting rightist boiling exchangeably, when bionic immoderate Rodolphe and caroling dying. certes and disjunctively. Edwin The us and marketing activities, financial and auditing related procedures to protect users should publish the template privacy for facebook app must notify you are a website and other information collected may be gathered PC or Mac computers, smartphones, tablets, or entity other device that is used to access or interact under the Service. Ftc has been designed for app policies and policy template allows customers. Sign in with Apple. Conditions document for your website. No catches like search terms generators. Notwithstanding the foregoing, we sniff the i to screen, remove, edit, my block any User Content we lend in violation of best Terms or local we find, not our own discretion to tank otherwise objectionable, at our own discretion. Any point we will find this data collection, or other service providers in a malicious activity or app must request through app privacy policies in your android phone number. Likewise, profit is no guarantee that our physical, technical, or organizational security measures are foolproof. You provide some of this data directly, and we get some of it by collecting data about your interactions, use, and experiences with our products. For privacy policy for some user data to assert copyright symbol of privacy. In some cases, we simply request further information in launch to commemorate your identity. This privacy and search engines, and subsequently established for case, access this includes analyzing data for app.
    [Show full text]
  • Protection of Personal Data (Both Automated and Conventional)
    THIRTY YEARS AFTER THE OECD PRIVACY GUIDELINES 2011 ORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENT The OECD is a unique forum where governments work together to address the economic, social and environmental challenges of globalisation. The OECD is also at the forefront of efforts to understand and to help governments respond to new developments and concerns, such as corporate governance, the information economy and the challenges of an ageing population. The Organisation provides a setting where governments can compare policy experiences, seek answers to common problems, identify good practice and work to co-ordinate domestic and international policies. The OECD member countries are: Australia, Austria, Belgium, Canada, Chile, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Israel, Italy, Japan, Korea, Luxembourg, Mexico, the Netherlands, New Zealand, Norway, Poland, Portugal, the Slovak Republic, Slovenia, Spain, Sweden, Switzerland, Turkey, the United Kingdom and the United States. The Commission of the European Communities takes part in the work of the OECD. © OECD 2011 Cover image: © kentoh – Fotolia.com No reproduction, copy, transmission or translation of this document may be made without written permission. Applications should be sent to OECD Publishing: [email protected] FOREWORD – 3 Foreword The OECD has played major role in shaping and defining how privacy is protected around the globe. The OECD Guidelines Governing the Protection of Privacy and Transborder Flows of Data were the first inter- nationally agreed-upon set of privacy principles. Canada participated in the Expert Group which produced the Guidelines under the wise leadership of the Honourable Michael Kirby of Australia. The Guidelines have been extremely influential in Canada, where, with minor changes, they were incorporated into the Personal Information Protec- tion and Electronic Documents Act, Canada’s private-sector privacy law.
    [Show full text]