Facing Facts: the State of US and EU Facial Recognition Legislation by Sam Choi , Hannah Lepow , Christopher Lin , and Jadzia Pierce of Covington & Burling LLP

ANALYSIS

Facing facts: The state of US and EU facial recognition legislation By sam choi , hannah Lepow , christopher Lin , and Jadzia Pierce of Covington & Burling LLP. acial recognition technology on law enforcement agencies’ use of Representatives, yvette Clarke (D-Ny) (FRT) is being developed and any biometric surveillance system in in July 2019 and introduced in the deployed at phenomenal speeds connection with police-worn body - Senate by Sen. Booker (D-NJ) in Octo - Fand lawmakers worldwide are scram - cams. 3 ber 2019—would regulate the use of bling to catch up. The resulting pieces In March 2020, Washington state FRT by landlords who receive some of legislative and enforcement efforts enacted a bill that prescribes several form of federal financial assistance. 12 convey that although there is consensus requirements for agency use of FRT. 4 Similarly, a House bill proposed by that something needs to be done to reg - Among other things, prior to deploy - Rep. Rashida Tlaib (D-MI) would pro - ulate the burgeoning technology, there ing the technology, agencies will be hibit any federal funding from being is little consensus on the approach that required to file a notice of intent and used for the purchase or use of FRT. 13 should be taken. In this article, we publish an accountability report that We are aware of one federal pro - highlight some of the key trends that will be subject to public review and posal that would broadly regulate com - have come out of the United States and comment. Use of FRT to make deci - mercial use of FRT, without a federal the European Union thus far. sions that produce legal or “similarly funding hook. The Commercial Facial significant” effects (e.g., decisions per - Recognition Privacy Act, introduced rkfqba pq^qbp taining to financial services, housing, just over a year ago in March 2019 by In the United States, legislative propos - criminal justice, or employment oppor - Sen. Roy Blunt (R-MO), would pro - als can be divided into those seeking to tunities) will be subject to heightened hibit commercial entities from, among regulate government use of FRT and requirements. In addition, certain uses other things, collecting facial recogni - those seeking to regulate commercial will be substantially limited, including tion data from end users without affir - use of FRT. the use of FRT for ongoing surveil - mative consent. 14 The bill has not pro - dçîÉêåãÉåí=ìëÉ=çÑ=coq : Propos - lance, real-time or near-real-time iden - gressed since its initial referral to als aimed at regulating government use tification, or persistent tracking with - committee. of FRT run the gamut from imposing out a warrant (or in other limited There are active bills seeking to reg - complete moratoriums on such use to circumstances). ulate commercial use of FRT in nearly a creating specific requirements and various states are considering their dozen states, from California 15 and guidelines that agencies would be own pieces of legislation that regulate New Jersey 16 to Idaho 17 and Ala - required to follow. government use of FRT in a variety of bama. 18 The majority of these follow In February 2020, Sens. Jeff ways, such as Arizona, 5 Massachusetts, 6 the formula of the broadest federal pro - Merkley (D-OR) and Cory Booker New Hampshire, 7and vermont. 8 In posal, prohibiting the use of FRT with - (D-NJ) introduced the Ethical Use of addition, multiple city governments out some type of notice provided to Facial Recognition Act, which would have taken matters into their own and/or consent obtained from the con - prohibit any federal agency official hands — the cities of San Francisco, 9 sumer. However, certain of the bills from using FRT without a warrant Oakland, 10 and Somerville, 11 for exam - focus on specific issues. For example, until Congress enacts legislation imple - ple, have ordinances in place that the Maryland state legislature recently menting guidelines for such use. 1 As largely ban city officials’ use of FRT for passed a bill prohibiting the use of FRT another example, in November 2019, surveillance. during job interviews without the Sens. Chris Coons (D-DE) and Mike `çããÉêÅá~ä=ìëÉ=çÑ=coqW= Federal applicant’s consent. 19 Additionally, one Lee (R-UT) introduced the Facial and state proposals aimed at regulating New york proposal would prohibit Recognition Technology Warrant Act commercial use of FRT range from landlords from using FRT in residential of 2019, which would prohibit using cross-sector regulation to bills that properties. 20 While none of the federal FRT for ongoing surveillance in a focus on a particular contexts, such as proposals discussed above include an public space unless such surveillance is housing or employment. express private right of action, several in support of a law enforcement activ - The majority of the federal propos - state bills do. 21 ity and certain other conditions are als addressing commercial use of FRT 2 met. from this Congressional session are brolmb^k rkflk State legislatures, meanwhile, have limited to spheres in which the federal In the EU, the General Data Protection moved past legislative proposals and government has some authority, such Regulation (GDPR), and its law actually enacted legislation. In October as through funding. For example, the enforcement counterpart, the Police 2019, California enacted A.B. 1215, No Biometric Barriers to Housing and Criminal Justice Directive, apply which creates a three-year moratorium Act—introduced in the House by to commercial and government use of

FRT. Facial images are deemed per - use. For instance, the Danish DPA White Paper on AI, 29 setting out the sonal data under the GDPR, meaning approved in July 2019 Brøndby Foot - EU’s vision for building an “ecosystem that controllers of FRT systems must ball Stadium’s use of FRT to enforce a of trust” regarding AI use in the EU comply with certain obligations — ban list for security purposes. 25 DPAs through a robust legislative framework. including transparency, processing data are continuing to investigate other uses Among other things, the White Paper fairly and securely, and complying with of FRT, such as at London King’s Cross proposes a mandatory pre-marketing individuals’ requests to exercise rights development and by Clearview AI. 26 conformity assessment requirement for they have over their personal data. In the UK, use of FRT systems was high-risk AI applications. The Commis - Where facial images are used for the challenged from a human rights law sion recognizes “remote biometric iden - purpose of uniquely identifying indi - perspective at the UK High Court. 27 tification systems” — such as FRT use in viduals they constitute “special cate - The European Convention on Human public spaces — as an example of a high- gory personal data,” and are subject to Rights provides that everyone “has the risk AI application that could be subject heightened obligations under the right to respect for his private and to this conformity assessment require - GDPR (Art. 9). In those circumstances, family life, his home and his correspon - ment. In the White paper, the Commis - the controller may need to obtain dence.” (Art. 8.) With a few exceptions, sion notes that FRT systems are already explicit consent from individuals public authorities may not interfere heavily regulated under existing EU laws whose faces are processed by the FRT with the exercise of this right. The (as described above), but that there are system, or alternatively, identify a sub - complainant alleged that South Wales unique concerns raised by their deploy - stantial public interest for the process - Police Force’s use of FRT for policing ment in public spaces. The Commission ing under EU or Member State law. and security purposes infringed this further states that it will “launch a broad In the last few years, FRT systems fundamental human right, as well as European debate on the specific circum - have been deployed in a range of differ - UK data protection laws and equality stances, if any, which might justify such ent settings in Europe. Accordingly, a legislation. The court found in favor of use, and on common safeguards.” 30 number of data protection authorities South Wales Police Force’s use of FRT (DPAs) in different Member States based on the specific facts of the case. `lk`irpflk have examined FRT use within the Nonetheless, this case prompted the Although FRT has become a popular construct of the GDPR. 22 Notably, the UK Information Commissioner to topic among lawmakers, it is unclear European Data Protection Board, investigate and issue an opinion on whether varying legislative and made up of representatives from DPAs police use of FRT, calling on the UK enforcement efforts may someday con - in each Member State and formally government to introduce a statutory verge into a unified approach. What is established to issue GDPR guidance, binding code of practice on the use of clear is that lawmakers’ activities never - has issued guidance on FRT use. 23 In biometric technology, such as live facial theless may influence the technology’s some cases, DPAs have found that cer - recognition technology. 28 continued development and use. As a tain uses of FRT systems are in breach Further regulation of FRT, particu - result, it will be critical to continue to of the GDPR. For example, on larly by public authorities, remains an track key developments and be 21 August 2019, Sweden’s DPA fined open issue in the EU. Although the prepared to adapt, as needed. the Skellefteå municipality for using GDPR offers safeguards for individuals FRT to track student attendance in a whose facial images are processed by public school, concluding that: (1) FRT systems, some policymakers and AuthoRs tracking attendance with FRT was commentators think that these meas - Sam Choi, Hannah Lepow and Jadzia overly invasive, (2) the imbalance of ures do not go far enough to protect Pierce are Associates, and Christopher power between the students (the data fundamental human rights. This debate Lin is a Legal Intern, at Covington & subjects) and the school (the data con - over the need for further FRT regula - Burling LLP in the US. troller) invalidated student consent, tion has arisen at the EU level in the Emails: [email protected] and (3) the school did not conduct a context of future regulation of AI tech - [email protected] 24 [email protected] data protection impact assessment. In nologies. On 19 February 2020, the [email protected] other cases, DPAs have permitted FRT European Commission published a

RefeRences 1 S. 3284, 116th Cong. (2020), available leginfo.legislature.ca.gov/faces/billPdf.x use-of-facial-recognition/ at html?bill_id=201920200AB1215&versio 5 S.B. 1383, 54th Leg., 2d Reg. Sess. www.congress.gov/116/bills/s3284/BILL n=20190AB121593CHP (Ariz. 2020), available at S-116s3284is.pdf 4 Alex Berengaut & Jadzia Pierce, www.azleg.gov/legtext/54leg/2R/bills/S 2 S. 2878, 116th Cong. (2019), available InsidePrivacy.com, Washington State B1383P.pdf at Passes Bill Limiting Government Use of 6 S. 1385, 91st Gen. Ct. (Mass. 2019), www.congress.gov/116/bills/s2878/BILL Facial Recognition (Mar. 23, 2020), available at S-116s2878is.pdf www.insideprivacy.com/united- malegislature.gov/Bills/191/S1385.pdf 3 A.B. 1215, 2019–2020 Leg., Reg. Sess. states/state-legislatures/washington- 7 H.B. 1642, 2020 Leg. (N.H. 2020), (Cal. 2019), available at state-passes-bill-limiting-government- available at

RefeRences gencourt.state.nh.us/bill_status/billText. egislation/H0492/ 2019), edpb.europa.eu/news/national- aspx?id=1202&txtFormat=html&sy=202 18 H.B. 295, 2020 Leg., Reg. Sess. (Ala. news/2019/facial-recognition-school- 0 2020), available at renders-swedens-first-gdpr-fine_en ; 8 H. 923 (Vt. 2020), available at legiscan.com/AL/text/HB295/id/214360 Sofia Evardsen, International legislature.vermont.gov/bill/status/2020/ 9/Alabama-2020-HB295-Introduced.pdf Association of Privacy Professionals, H.929 19 H.B. 1202, 2020 Leg., 441st Sess. (Md. How to Interpret Sweden’s First GDPR 9 City of San Francisco, Cal., Stop Secret 2020), available at Fine on Facial Recognition in School Surveillance Ordinance, available at mgaleg.maryland.gov/2020RS/bills/hb/ (Aug. 27, 2019), iapp.org/news/a/how- sfgov.legistar.com/LegislationDetail.asp hb1202T.pdf to-interpret-swedens-first-gdpr-fine-on- x?ID=3850006&GUID=12FC5DF6- 20 S. 5687, 2019–2020 Leg., Reg. Sess. facial-recognition-in-school AAC9-4F4E-8553-8F0CD0EBD3F6 (N.Y. 2019), available at 25 European Digital Rights, Danish DPA 10 City of Oakland, Cal., Surveillance www.nysenate.gov/legislation/bills/2019 Approves Automated Facial Equipment Ordinance Amendment, /s5687 Recognition (June 19, 2019), available at 21 See West Virginia, H.B. 4106, 2020 https://edri.org/danish-dpa-approves- oakland.legistar.com/LegislationDetail.a Reg. Sess. (W.V. 2020), available at automated-facial-recognition. spx?ID=3976661&GUID=CB1D4794- www.wvlegislature.gov/Bill_Text_HTML 26 Meera Narendra, Data Protection World 7549-485A-A345-B7B38B38E191 /2020_SESSIONS/RS/bills/HB4106%2 Forum, #Privacy: Swedish DPA 11 City of Somerville, Mass., Face 0INTR.pdf ; Hawaii, S.B. 3148, 30th Announces Investigation Into the Use of Surveillance Full Ban Ordinance, Leg. (Hawaii 2020), available at Clearview AI (Mar. 9, 2020), available at egiscan.com/HI/text/SB3148/id/213516 gdpr.report/news/2020/03/09/privacy- somervillecityma.iqm2.com/Citizens/De 3/Hawaii-2020-SB3148-Amended.html ; swedish-dpa-announces-investigation- tail_LegiFile.aspx?Frame=&MeetingID= Maryland, H.B. 307, 2020 Leg., 441st into-the-use-of-clearview-ai ; Information 2961&MediaPosition=&ID=20991&Css Sess. (Md. 2020), available at Commissioner’s Office, Statement: Live Class legiscan.com/MD/text/HB307/id/217169 Facial Recognition Technology in King’s 12 H.R. 4008, 116th Cong. (2019), 6/Maryland-2020-HB307- Cross (Aug. 15, 2019), available at Engrossed.pdf ; New York, S. 1203, ico.org.uk/about-the-ico/news-and- www.congress.gov/116/bills/hr4008/BIL 2019–2020 Leg., Reg. Sess. (N.Y. events/news-and-blogs/2019/08/ LS-116hr4008ih.pdf; S. 2689, 116th 2019), available at statement-live-facial-recognition- Cong. (2019), available at legislation.nysenate.gov/pdf/bills/2019/ technology-in-kings-cross . https://www.congress.gov/116/bills/s26 S1203 27 R. (Bridges) v. Chief Constable of South 89/BILLS-116s2689is.pdf 22 See, e.g., Kristof Van Quathem & Anna Wales Police , [2019] WLR (D) 496 13 H.R. 3875, 116th Cong. (2019), Oberschelp de Meneses, (U.K.). available at InsidePrivacy.com, French Supervisory 28 Sam Jungyun Choi, UK’s Information www.congress.gov/116/bills/hr3875/BIL Authority Publishes Guidance on Facial Commissioner Issues Opinion on Use LS-116hr3875ih.pdf Recognition (Nov. 18, 2019), of Live Facial Recognition Technology 14 S. 847, 116th Cong. (2019), available at www.insideprivacy.com/data- by Police Forces (Nov. 5, 2019), www.congress.gov/116/bills/s847/BILL privacy/french-supervisory-authority- www.insideprivacy.com/data-privacy/ai- S-116s847is.pdf publishes-guidance-on-facial- iot-update-uks-information- 15 A.B. 2261, 2019–2020 Leg., Reg. Sess. recognition commissioner-issues-opinion-on-use- (Cal. 2020), available at 23 See European Data Protection Board, of-live-facial-recognition-technology-by- leginfo.legislature.ca.gov/faces/billText Guidelines 3/2019 on processing of police-forces/ Client.xhtml?bill_id=201920200AB2261 personal data through video devices 29 European Commission, White Paper: 16 A.B. 3625, 219th Leg. (N.J. 2020), (Jan. 30, 2020), edpb.europa.eu/our- Artificial Intelligence - A European available at work-tools/our-documents/guidelines/ approach to excellence and trust (Feb. www.njleg.state.nj.us/2020/Bills/A4000/ guidelines-32019-processing-personal- 19, 2020), COM(2020) 65 final, 3625_I1.PDF data-through-video_en . ec.europa.eu/info/sites/info/files/commi 17 H.B. 492, 65th Leg., 2d Reg. Sess. 24 European Data Protection Board, Facial ssion-white-paper-artificial-intelligence- (Idaho 2020), available at Recognition in School Renders feb2020_en.pdf legislature.idaho.gov/sessioninfo/2020/l Sweden’s First GDPR Fine (Aug. 22, 30 Id . at 22.

Joint investigation into Clearview’s use of facial recognition The Privacy Commissioner of Canada about whether the company is collect - province and territory have also and the Privacy Commissioners in the ing and using personal information agreed to work together to develop provinces of Quebec, British Columbia without co nsent. “Media reports have guidance for organizations – includ - and Alberta have announced that they stated that Clearview AI is using its ing law enforcement – on the use of will jointly investigate Clearview AI and technology to collect images and make biometric technology, including facial its use of facial recognition technology. facial recognition available to law recognition .” The investigation was initiated in enforcement for the purposes of • See www.priv.gc.ca/en/opc-news/ the wake of numerous media reports identifying individuals,” the DPAs say. news-and-announcements/2020/an that have raised questions and concerns “Privacy regulators in every _200221/

Issue 164 APRIL 2020

Indonesia’s DP Bill lacks a COMMENT DPA, despite GDPR similarities 2-DPAs respond to Covid-19 Graham Greenleaf and Andin Aditya Rahman of Assegaf Hamzah NEWS & Partners, Indonesia, analyse the Bill’s provisions. 1- Finland invests in EU cooperation ndonesia’s long-awaited com - Johnny G. Plate announced the sub - 28 - Whim app and personal data prehensive draft Law on the Pro - mission on 28 January 2020 and was tection of Personal Data (“the summoned by the House to elabo - ANALYSIS Bill”) has been submitted by rate on the Bill in a formal meeting at I 16 - Canada: More enforcement powers? President Joko Widodo to the Chair - the end of February, after which he person of the Indonesian House of stated that he expected the Bill will 18 - Digital Identity in Africa, Middle East Representatives. Minister of Com - 22 - Facial recognition laws in US and EU munication and Information, Continued on p.3 30 Gender equality in privacy rights LEGISLATION 1- Indonesia’s DP Bill lacks a DPA Finland invests in European 13 - Dubai to update its DP law 26 - Iran moves to protect personal data cooperation, prepares to fine MANAGEMENT Finland’s DPA’s workload has stabilised after the immediate post- 9- IKEA invests in data ethics GDPR rush. The first GDPR fines are now in the pipeline. 10 - Ethics – escaping the ivory tower Laura Linkomies reports from Helsinki. s Finland prepares to issue its across EU member states regarding NEWS IN BRIEF first administrative fines the size of fines. 12 - CCPA enforcement to start in July under the GDPR, most There was some delay in setting 12 - EU issues White Paper on AI likely by the beginning of May, the up the administrative structure to A 12 - EU Parliament committee on AI Data Protection Ombudsman, Reijo enable the issuing of fines. Anu Talus, 15 - Sweden fines Google 7 million Aarnio, says that it is of paramount € importance to achieve consistency Continued on p.7 15 - Telecoms data plan to monitor spread of coronavirus in EU 21 - Google RTBF fine cancelled in France Covid-19 delays PL&B Events 21 - Belgium’s DPA on direct marketing 21 - Netherlands’ DPA fines tennis • Nowhere to Hide , PL&B’s 33rd • We have also postponed association 525,000 Annual International Germany’s Data Protection Law: € Conference, will transfer from Trends, Opportunities & Conflicts , 24 - Clearview’s use of facial recognition Cambridge to London and from to be hosted by Covington & 25 - EU GDPR review delayed summer to autumn. Please see Burling in London, from March, 25 - Israel tracks people’s movements to www.privacylaws.com/ac for a until the autumn. See battle coronavirus infections speaker list and details of their www.privacylaws.com/germany sessions. 25 - Global DPAs: Data protection does not stop data sharing for Covid-19 privacylaws.com purposes

PL&B Services: Conferences • Roundtables • Content Writing Recruitment • Consulting • Training • Compliance Audits • Research • Reports COMMENT

ISSUE NO 164 APRIL 2020

PUBLISHER Stewart H Dresner DPAs respond to Covid-19 [email protected] We are all affected by the coronavirus pandemic, and not least in our private lives. Suddenly restrictions to civil liberties that would have EDITOR seemed draconian feel acceptable if suitable safeguards are provided, for Laura Linkomies [email protected] example, using mobile phone data to monitor the spread of the virus (p.15 ) by means of tracking our movements. It is pleasing that the DEPUTY EDITOR global DPA community has concluded that data protection law does Tom Cooper not stop data sharing for Covid-19 purposes ( p.25 ) – but at the same [email protected] time we need to stay vigilant that the current exceptions do not become ASIA-PACIFIC EDITOR the norm in future. DPAs have issued statements and guidance on the Professor Graham Greenleaf coronavirus situation for organisations whose privacy compliance [email protected] teams are now often working remotely. Much of that is related to the kind of data which can be gathered on employees, but there is also REPORT SUBSCRIPTIONS K’an Thomas guidance on how to manage data security issues for remote workers. In [email protected] addition, the European Union Agency for Cybersecurity (ENISA) on 24 March issued its top tips for cybersecurity when working remotely. CONTRIBUTORS Andin Aditya Rahman For everyone who has suddenly needed to take up new technologies to Assegaf Hamzah & Partners, Indonesia organise virtual meetings, Zoom has become a popular option. Nick Rhodes BAE Systems Applied Intelligence, UK However there have been reports of Zoom’s bad track record with data Colin J. Bennett protection measures. Zoom has defended itself by saying that “No data University of Victoria, Canada regarding user activity on the Zoom platform – including video, audio, Tripti Dhar and chat content – is ever provided to third parties for advertising Reina Legal LLP, India purposes.” In the US, a class action lawsuit has been launched, and on Oliver Butler 1 April the Hong Kong Privacy Commissioner for Personal Data Oxford University, UK made data security recommendations to Zoom users. Tayebeh Saheb Modares University, Iran Elizabeth Coombs Before the travel restrictions kicked in, I was in Finland to interview UN SRP Taskforce the Ombudsman and his Deputy ( p.1 ), and a travel app company Sam Choi, Hannah Lepow, Christopher Lin, Whim ( p.28 ). Other articles in this issue include a world first analysis and Jadzia Pierce (in English) of Indonesia’s new data protection Bill ( p.1 ), updates on Covington & Burling LLP, US Canada ( p.16 ), Iran ( p.26 ), Dubai ( p.13 ), data ethics ( p.10 ), facial Published by recognition ( p.22 ), and privacy aspects of gender equality ( p.30 ). In Privacy Laws & Business, 2nd Floor, this issue, we also report on digital identity developments in Africa and Monument House, 215 Marsh Road, Pinner, Middlesex HA5 5NE, United Kingdom the Middle East ( p.18 ). Tel: +44 (0)20 8868 9200 Email: [email protected] Unfortunately, we have had to move Nowhere to Hide , PL&B’s 33rd Website: www.privacylaws.com Subscriptions: The Privacy Laws & Business International Annual International Conference from Cambridge to London and Report is produced six times a year and is available on an from summer to autumn. Please see our website at annual subscription basis only. Subscription details are at the www.privacylaws.com/ac for a speaker list and details of their sessions. back of this report. Most speakers will be, in principle, available for our conference, which Whilst every care is taken to provide accurate information, the we can arrange only when social distancing stops and travel starts. publishers cannot accept liability for errors or omissions or for any advice given. Design by ProCreative +44 (0)845 3003753 Laura Linkomies, Editor Printed by Rapidity Communications Ltd +44 (0)20 7689 8686 ISSN 2046-844X PRIvACy LAWS & BUSINESS

Copyright : No part of this publication in whole or in part may be reproduced or transmitted in any form without the prior written permission of the publisher. Contribute to PL&B reports Do you have a case study or opinion you wish us to publish? Contri butions to this publication and books for review are always welcome. If you wish to offer reports or news items, © 2020 Privacy Laws & Business please contact Laura Linkomies on Tel: +44 (0)20 8868 9200 or email [email protected] .

O======^mofi=OMOM======PRIVACY LAWS & BUSINESS INTERNATIONAL REPORT © 2020 PRIVACY LAWS & BUSINESS Join the Privacy Laws & Business community The PL&B International Report , published six times a year, is the world’s longest running international privacy laws publication. It provides comprehensive global news, on 165+ countries alongside legal analysis, management guidance and corporate case studies. PL&B’s International Repo rt will help you to: Stay informed of data protection legislative Find out about future regulatory plans. developments in 165+ countries. Understand laws, regulations, court Learn from others’ experience and administrative decisions and what through case studies and analysis. they will mean to you. Incorporate compliance solutions Be alert to future privacy and data into your business strategy. protection law issues that will affect your organisation’s compliance and reputation.

Included in your subscription: NK=páñ=áëëìÉë=éìÄäáëÜÉÇ=~ååì~ääó QK= m~éÉê=îÉêëáçå=~äëç=~î~áä~ÄäÉ TK=bîÉåíë=açÅìãÉåí~íáçå Postal charges apply outside the UK. Access events documentation such OK=låäáåÉ=ëÉ~êÅÜ=Äó=âÉóïçêÇ as PL&B Annual International Search for the most relevant content RK=kÉïë=réÇ~íÉë Conferences , in July, Cambridge. from all PL&B publications and Additional email updates keep you events. you can then click straight regularly informed of the latest UK=eÉäéäáåÉ=båèìáêó=pÉêîáÅÉ through from the search results into developments in Data Protection Contact the PL&B team with the PDF documents. and related laws. questions such as the current status of legislation, and sources for specific PK=bäÉÅíêçåáÅ=sÉêëáçå SK=_~Åâ=fëëìÉë texts. This service does not offer legal We will email you the PDF edition Access all PL&B International advice or provide consultancy. which you can also access via the Report back issues. PL&B website. privacylaws.com/reports

I would like to congratulate the editors of Privacy Laws & Business . This Report gives me the latest information and useful suggestions that are a great help for my research projects. This magazine is very valuable for anyone involved in privacy. Professor Fumio Shimpo, Department of Policy Management, Keio University, Japan

UK Report Subscriptions Privacy Laws & Business also publishes Subscription licences are available: PL&B UK Report six times a year, covering • Single use the Data Protection Act 2018, the Freedom • Multiple use of Information Act 2000, Environmental • Enterprise basis Information Regulations 2004 and Electronic • Introductory, two and three years discounted Communications Regulations 2003. options Stay informed of data protection legislative developments, learn from others’ Full subscription information is at privacylaws.com/subscribe experience through case studies and analysis, and incorporate compliance solutions into your business strategy. Satisfaction Guarantee If you are dissatisfied with the Report in any way, the unexpired portion of your subscription will be repaid.