Welcome to the latest edition of the Privacy Insider newsletter. Each week, we send you the latest and smartest news in the world of data privacy.
In browsing the news over the holidays, quite a few stories have been published that look back on the privacy trends of 2020 and forward to what to expect in 2021.
Perhaps the most important development to watch here in the U.S. is whether federal privacy legislation will pass. It seems more likely now than ever that the time is now, but, then again, lawmakers in Washington and privacy advocates have been saying that for about a decade, if not more.
However, with the Biden administration poised to take office, there is an air of optimism that privacy regulation will be a priority. That's partly because of pushes at the state level to pass privacy legislation after California passed its groundbreaking law in 2018 and as a multitude of other states aim to follow suit (note, watching Washington State as it tries for the third time to get it done this legislative session). In addition, there's pressure from the EU to indicate the U.S. is up to the task of protecting Europeans' data. The Safe Harbor agreement was invalidated in 2015, followed by its successor, the Privacy Shield, in 2020. Both data-sharing agreements were eliminated because of EU mistrust that the U.S. can provide a level of data protection equal to the EU.
Finally, Vice President-elect Kamala Harris established the Privacy Enforcement and Protection Unit when she served as attorney general of California, and she has historically indicated support for reigning in big tech companies' data practices, including in her work as a U.S. Senator.
It remains to be seen how a Biden administration may or may not approach gathering bi-partisan consensus for a potential privacy law. But there sure are a lot of companies, advocates and legislators who are ready to provide input, again, on what a law should look like.
Hoping digging out after the holiday wasn't too painful. Welcome to the New Year! See you next week.
Here are the top stories you might have missed:
Singapore gov’t: Police can access COVID-19 data to solve crimes
Law enforcement in Singapore will be permitted to access data collected for COVID-19 contact tracing to aid in criminal investigations, ZDNet reports. And there’s a lot of data up for grabs, considering more than 4.2 million residents use the country’s “TraceTogether” contact tracing app. The government announced recently the app would be mandatory for anyone aiming to access public venues in 2021.
Read Story
2. Employers using wide range of surveillance tactics
The line between employees’ personal and professional lives is blurred now more than ever as workers work from home. That’s risky, because there are a number of surveillance tactics employers can use to spy on their employees, and there is a lack of strong rules to dictate whether those tactics should be allowed. In a blog post, Brookings Institution's Darrell West outlines the various ways companies can spy on employees, including keylogger software, video surveillance and “attention tracking.”
Read Story
3. Judge grants child anonymity in her privacy suit against TikTok
In the U.K., a judge has said a 12-year-old girl’s identity should be protected in her case against social media company TikTok. The girl “intends to go to a court asserting … that her privacy rights and those of others like her have been infringed in ways that call for a remedy,” said Judge Mark Warby in a recent decision, adding that not granting anonymity could “have a chilling effect the bringing of claims by children to vindicate their data-protection rights,” Bloomberg reports.
Read Story
4. Opinion: To protect U.S. elections, we need a federal privacy law
While many pundits have cited the need for bolstered cybersecurity to protect U.S. elections’ integrity, what’s really needed is federal privacy legislation and “greater transparency surrounding tech platforms’ data collection and ad targeting practices.” That’s according to New America’s Christine Bannon and Spandana Singh, who write in a piece for The Washington Post that stopping misinformation starts with knowing “how it spreads.”
Read Story
5. How police use vehicle data and the privacy risks onboard
Jalopnik reports on police use of onboard computers in vehicles and the risks to drivers’ privacy that presents. A recent NBC News report cited in the article discusses the trove of data available to police via vehicles “black boxes” and the “infotainment” system, which, together, allow investigators to both “reconstruct a vehicle’s journey and paint of a picture of driver and passenger behavior.” To date, no federal laws dictate how police can or cannot use such data.
Read Story
6. Payments processor leak leads to dark web data-sale
An India-based payments platform’s data breach has resulted in more than 100 million credit and debit cardholders’ sensitive data being leaked, Gadgets 360 reports. The leak, which was discovered by cybersecurity researcher Rajshekhar Rajaharia recently, involves online transactions data processed by Juspay between March 2017 and August 2020. Rajaharia said the leaked data was for sale on the dark web.
Read Story
7. In 2021, data privacy restrictions will only become more stringent
Digital Journal reports that data restrictions will continue to proliferate in 2021, and businesses should prepare themselves. Data governance will become increasingly difficult because so many organizations have moved data to the cloud because of the remote-work environment COVID-19 produced, the report states. In addition, customers are becoming increasingly aware of their data rights thanks to laws like that of California, so complying with data subject access rights will become increasingly important.
Read Story
8. Telco offers to replace 2.5 million SIM cards following hack
Following a “massive” data breach, an Italian mobile operator says it has offered to replace all affected customers’ SIM cards. A security analyst discovered Ho Mobile’s database for sale on the dark web Dec. 28. The hack impacted an estimated 2.5 million customers, ZDNet reports. The stolen information included full names, telephone numbers, Social Security numbers, emails and home addresses, the report states.
Read Story