Doug Smith, CIPP/US, CIPM

I'm looking forward to discussing the changing legal and technological landscape of privacy with Pinar Yildirim's Marketing Strategy course for The Wharton School on August 10th. The rate of change in the ad tech space is accelerating, creating risks and opportunities for brands. Prescient leaders who anticipate and embrace these changes stand to realize outsized benefits as those who fail to adapt are left behind.

91

2 Comments

Join us as we discuss AI Strategies, Data Privacy and emerging trends in AI implementation

22

It was such an engaging, informative, and fun event. IAPP - International Association of Privacy Professionals event hosted by Troutman Pepper. Robyn Lin and Sadia Mirza, CIPP/US, CIPM were terrific at presenting The CCPA DoorDash Settlement: A privacy roundtable and networking event. Great networking and I learned a lot. Isn't that refreshing for a #CPE? Have you been to a great event lately? Genevieve Walser-Jolly I'm so sorry that we didn't get to connect at the event. We must get together soon. #privacy #cybersecurity #networking lawesomeGC #CIPP

41

8 Comments

Finally a shred of sanity from SCOTUS (except J. Alito and J. Gorsuch) about the Consumer Financial Protection Bureau. Yes: Congress' appropriation of the Bureau's budget through the Federal Reserve comports with the language and the historical implementation of the Appropriations Clause. My favorite part of the opinion summary: "The First Congress’ practice confirms this understanding, as appropriations that supplied funding to the Customs Service and the Post Office were not time limited. The associations resist the analogy to the Post Office and other fee-based agencies, arguing that such agencies do not enjoy the same level of fiscal independence as the Bureau. But, the associations fail to explain the relevance of that difference to the question whether a law complies with the constitutional imperative of an appropriation." And that is the history of the ongoing gaslighting of the CFPB: "No other agency is as unaccountable as the CFPB!" Whenever it's pointed out that many other agencies have a similar governance structure or similar funding mechanism as the CFPB, it's ignored. The most original such contrived argument was that of the Fifth Circuit, who claimed that the problem was that the CFPB's budget is "double-insulated" from Congress. The only precedent I found for such a concept was from the precedential film Animal House with J. (Dean) Wormer: Greg: What do you intend to do sir? Delta's already on probation. Dean Wormer: They are? Greg: Yes, sir. Dean Wormer: Oh. Then as of this moment, they're on double secret probation! Greg: Double secret probation, sir? Dean Wormer: There is a little-known codicil in the Faber College constitution which gives the dean unlimited power to preserve order in time of campus emergency. Find me a way to revoke Delta's charter. You live next door. Put Neidermeyer on it. He's a sneaky little shit, just like you, right? [Greg nods] The time has come for someone to put their foot down. And that foot is me.

5

We have provided our thoughts on #APRA in this blog post.

6

What in the world is this American Privacy Rights Act, and what does it mean for advertising?!? Well, it could mean some significant changes. This Digiday article does a quality job of laying out its shifts for the industry.

3

Early thoughts on the new proposed Federal Privacy Law . . . Earlier this month, House Committee on Energy and Commerce Chair Cathy McMorris Rodgers (R-WA) and Senate Committee on Commerce, Science and Transportation Chair Maria Cantwell (D-WA) unveiled their bipartisan, bicameral discussion draft of the American Privacy Rights Act (APRA draft). Chair Rodgers is bent on getting a House vote by May 24, and both Chairs want to get the APRA through during this congressional term (which ends 3 Jan 2025). We’ll see if this one gets traction or if it will meet a similar fate of 2022’s American Data Privacy and Protection Act (ADPPA), which was considered in 2022, during the 117th Congress. There are several excellent summaries online, including this one by IAPP Staff Contributor Cobun Zweifel-Keegan. The IAPP also has prepared a very handy “cheat sheet” (see comments for link). There are some interesting aspects (if not surprises), including state preemption and a limited private right of action . . . which are two polarizing issues that were unhelpful to getting the ADPPA pushed through. Congressional lawmakers have already launched criticizing salvos, and (like last time under the ADPPA), California regulators don’t like the APRA, or at least aspects of it.

Interesting point of view from the CPPA regarding the American Privacy Rights Act Discussion Draft, and to see that overall Privacyt rights are taken more seriously at a state level. #dataprivacy #CPPA #CCPA

1

Governor Moore signed the Maryland Online Data Privacy Act into law today, bringing the number of states with general privacy laws up to 18. (Sadly, Clay Davis wasn’t involved.) MODPA doesn’t follow the California or Washington model but introduces a new (lake trout?) flavor of privacy law. Notable differences: * For all personal data, businesses must limit the collection of personal data to what is “reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer” – not just disclosed in the privacy policy. (Keep an eye on this requirement; it's a biggie.) * Lower applicability thresholds: 35K individuals or 10K individuals plus >20% revenue derived from the sale of data. * No selling data of kids under 18 if you know or “should have known” the kid is under 18. * No geofencing within 1,750 feet of mental or reproductive/sexual health facilities to identify, track, or collect data from consumers or to send notifications to consumers regarding their data.  * Can’t collect or process data for unlawful discrimination, except for self-testing or mitigation. * No private right of action (whew!) * 60-day cure that’s discretionary with the AG Goes into effect on October 1, 2025 #law #privacy

54

6 Comments

Our latest Public Company Watch newsletter!

10

Check out The Cybersecurity Law Report's Matt Fleischer-Black's article for everything you need to know about Colorado's first-in-nation AI regulation.

16

Appearing on the eve of the total solar eclipse, the draft text for an American Privacy Rights Act (#APRA) has prompted almost as much discussion among privacy pros as the eclipse event generated in the media. In just over a week, there have been dozens of blogs and webinars delving into the proposed law's definitions and data minimization, transparency, preemption, and enforcement provisions. But there hasn't been much analysis of the APRA's proposed co-regulatory compliance mechanism. So, in addition to summarizing the law, I took a close look at the "compliance codes" section. I compared it with other privacy compliance and certification models under COPPA, the GDPR (EU and UK), and Congress' last attempt at comprehensive federal privacy legislation, the American Data Privacy and Protection Act. Although the APRA's prospects for passage are still uncertain, from ESRB Privacy Certified's perspective, it's clear that "regulated, self-regulatory" compliance mechanisms should be part of any modern comprehensive federal privacy law. #APRA, #COPPA #privacycompliance

6