In July 2021, the EU began accepting proposals for a study of the impact of recent developments in adtech and their impact on privacy, the publishers, and advertisers.

In France, the data privacy regulator (CNIL) continues its pursuit of organisations with non-compliant cookie regimes and is effectively supported in Germany by Max Schrems’ organisation (NOYB) which has filed 422 formal complaints of organisations with cookie non-compliance with 10 regulatory authorities.

Much of the news focused on China and its increasingly aggressive stance on the data privacy requirements of national and global tech giants, and restriction of processing data in perceived conflict with the national interest.

The US and EU continue to attempt to breathe life back into the Privacy Shield Program and indicate that discussions are advanced.

These and other news items detailed below.

In our heartland of B2B, the UK and EU continue to move towards the granting of an adequacy provision to allow for the free flow of data. There has been some pushback within EU circles, resulting in the EU stating that they reserve the right to withdraw such status if the UK goes off piste. 

The EU also claims to be close to the release of revised and more flexible standard contractual clauses (SCC) to allow the flow of data to jurisdictions that do not carry the EU adequacy status. This will help close the legality chasm in the current transfer of data between the EU and USA, created when the Privacy Shield arrangement was struck down. (The UK will publish its own version of SCCs.)

There is ‘noise’ amongst EU regulators, who are in some unseemly tussles over the ‘one stop shop’ mechanism, which of the regulators can pursue the global tech giants, and whether those in the frame as ‘lead regulator’ are doing a decent job.

Pressure continues in the US for federal privacy legislation as the region becomes increasingly complex with more and more disparate state laws being passed.

China has made moves proposing a ‘consent’ model on tech companies through a draft Personal Information Protection Law (PIPL).

Also, an interesting discussion on the topical issue of video interviews for job applicants and the related privacy implications.

US legislative developments feature highly in the last thirty days in Virginia, Arizona, Florida, Colorado and at federal level with the Information Transparency and Personal Data Control Act, the first federal level activity of 2021.​

In Europe, the UK and EU continue the dance that will determine the expected adequacy decision for the UK enabling the unencumbered bilateral movement of personal data. The UK makes noises about a more progressive UK data privacy regime and its sovereign right to agree other data sharing arrangements, which unsettles the EU.

Meanwhile, the EU and US announce that they will step up efforts to agree a data sharing agreement, but with little conviction or credibility. Most informed sources see significant challenges to any such agreement.

Pragmatic corporate data privacy professionals remain focused on the inching forward of EU ePrivacy legislation and for clarity over approved legal clauses to export data from the EU and the US. Corporates continue to export data anyway, now technically illegally, and wait for the army of lawyers and legislators to get a grip with the real world and catch up.

Away from politics and into the corporate fray, Apple begins to flex its muscles through blocking apps that do not comply with their new (non-cookie) privacy regime. Fun times in Data Privacy!

The debate and discussion about the legality of international transfers of data continued during February, the EU institutions of EDPB (European Data Protection Board) and EDPS (Supervisor) providing opinion on the revised standard contractual clauses. These ‘SCCs’ are now deemed central to the ability to transfer personal data outside the EU and its approved partners deemed to have ‘adequate’ data protection regimes.

Meanwhile the UK still pursues and expects adequacy status to be granted by the EU, while at the same time messaging the benefits of an independent regime where the benefits of data sharing are recognised alongside the importance of its protection. Of note, the upcoming ePR will become law in the EU but not in the UK where its predecessor (PECR) will still be the local statute of reference. A potential divergence will be the subject matter of discussion over coming months.

In the US, the weight of media coverage suggests a continued expectation of federal data protection legislation as more states take local action (Florida, Virginia, Minnesota) a notable exception being North Dakota where legislation was voted down.

Amongst the data ‘ethic topics’ is the use of ‘pixel’ tracking tactics, where content such as outbound emails and web pages contain invisible pixels that track a user’s engagement with content. While such use should be disclosed in privacy policies, the reality is that consumers are often unaware of this tracking of their activity. While this might be legal, is it ethical?

​Brexit discussions continue, with UK Government sources indicating that a positive UK adequacy decision is likely within the extended transitional window (open to June 2021). Observers wonder whether this is an entirely objective assessment or whether the EU might choose to exact further pressure on the UK.

The Portuguese presidency of the council of the EU has brought further impetus to agreement of the terms of the much-discussed ePrivacy legislation, now ready for presentation to the Parliament.

In the US, expectation and speculation continues around the need for, and likelihood of, federal data privacy law. Certainly, the privacy debate shows no sign of abating.

In APAC, the ten member states of ASEAN (Singapore, Brunei, Cambodia, Indonesia, Lao, Malaysia, Myanmar, Philippines, Thailand and Vietnam) approved the new Data Management Framework (DMF) and Model Contractual Clauses for Cross Border Data Flows.

Tech companies continue to posture and wrestle over tracking technologies, with Apple assuming a moral high ground in the scheduled withdrawal of cookies and requiring the user to opt in to IDFA (Identifier for Advertisers), a move that threatens a Google revenue stream heavily dependent on the ability to target users based on cookie deployment. This move could be disruptive for organisations heavily invested in cookie-based targeted advertising.

WhatsApp has seen a large negative reaction to its announced changes in privacy terms and data sharing agreements with Facebook, and an increase in users choosing alternative messaging platforms.

At a more tactical level, organisations are reminded that the ‘new normal’ of working from home carries the risk of employees processing personal data in ways that pose a risk to its security.

Why audience inflation doesn't work 
​
Is your marketing team tempted to grab as big an audience as possible for each of their outbound campaigns? Why wouldn’t they? After all they are only measured on number of responses. They just load up that big outbound communications gun and ‘FIRE!’.