Europe finds UK data privacy system adequate, for now. On June 28, 2021, the Europe Union granted two adequacy decisions to the United Kingdom for personal privacy purposes. 

1. Decision on the adequate protection of personal data by the United Kingdom - General Data Protection Regulation 
2. Decision on the adequate protection of personal data by the United Kingdom - Law Enforcement Directive

This assures, for now, that data flows between the EU and UK can continue without restrictions.  But for the first time, the EU’s decisions were not permanent and will last only four years. What’s going on?

Because of Brexit, the UK and the EU reached a transition agreement at the end of 2020. This included six months for the UK and EU to reach an agreement about data privacy flows. The deadline approached, and the EU decision was made just in time (the UK had already issued its own adequacy decision regarding data going to the EU). Had it not been made, one estimate was that UK businesses would face immediate compliance costs of about 1.6 billion pounds, aside from other costs. So, UK businesses can rest easy – for a time. According to Kim Walker, a leading UK privacy attorney at the firm of Shakespeare Martineau (Kim Walker | Shakespeare Martineau (shma.co.uk), 11% of global data flows through the UK, and 70% of UK data flows through the EU.

Why the last-minute timing and why the unusual temporary grant of an adequacy decision? The answer lies in the same surveillance issues that restrict data flows between the EU and the United States. Without a comprehensive and protective federal personal data privacy law, the United States is unlikely to receive an adequacy decision from the EU indefinitely. The EU is particularly skeptical of mass surveillance by U.S. authorities. The British mass surveillance system is not that different from the American approach to how and when public authorities can access private personal information. The EU is concerned that by granting adequacy to the UK, this could create a back door for the UK to grant unrestricted data flow to the United States, thus undermining Europe’s basic GDPR approach to restricting data flows that may disrupt the protections of personal privacy at the heart of GDPR.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Data Privacy Detective Podcast

Episode 67 - Data Flows After Brexit... For Now

Listen

In this second podcast episode about data localization, we spotlight India. Since 1993 the world’s largest democracy has enacted data localization laws aiming to keep certain personal records within India or otherwise restrict data transfers of Indians’ personal data. When in 2017 the Indian Supreme Court found personal privacy to be a fundamental constitutional right, a Personal Data Protection Bill (PDPB) was promptly drafted. It has since been percolating towards adoption. The draft bill defines certain personal data as “critical” and so must be stored only within India. Other data is called “sensitive,” and may be processed outside of India with a copy kept within India. A third category of “regular” data could be transferred abroad, pursuant to data transfer rules.

Unlike China, reviewed in the last podcast episode (episode 73,) India has a robust tech industry heavily involved in processing foreign data. India processes more personal data than any other country, so that parochial data laws would stand in stark contrast to this essential industry of India. Yet, Amazon, Facebook, Google and other global businesses dominate the Indian home markets, unlike their absence from China. Protectionist forces within India are calling for strict data controls, purportedly to protect the privacy of Indian residents while also favoring the interests of local tech and other firms. Indian businesses such as Reliance talk of “data colonization,” the idea that foreign companies control too much of the data of Indian residents and are plundering the wealth of India as measured by the data of its 1.3 billion people.

Indian sources expect the PDPB to be enacted in the winter session of 2021-22. The enacted version will reveal whether India adopts a protectionist approach to data or embraces a more global approach to how personal data is collected and processed. This in turn will affect how other nations will respond. The outcome will affect how data privacy is enhanced or diminished as the rules governing data evolve country by country.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 74 - Data Localization - The Case of India

We turn to Russia in our data localization series. Russia’s 2015 personal data protection law requires “data operators” to collect and keep information about Russian residents within Russia. It forces them to keep personal data about its citizens on a Russian located server, which must at all times keep at least as much data as is kept on a company’s servers outside Russia. This law resulted in LinkedIn’s being blocked from the Russian internet in 2016 for failing to do this.

In 2019 Russia expanded the authority of its regulator, Roskomnadzor, to levy fines instead of being limited to blocking for violations. While the fines are modest in amount, this lets regulators allow popular sites into Russia while insisting on data localization Russian style. In July 2021, Russia began requiring giant social media companies to establish a Russian presence to connect with Russian citizens. 

It’s believed that more than 600 foreign companies have registered with Russian authorities to participate in the Russian market and comply with Russian data laws. These include giants such as Microsoft, Apple, and Samsung. If they fail to comply with Russian law regarding the data of Russian citizens, they can face advertising bans or blocking of access.

Russia’s approach lies between the stricter regimen of China and the globally open approach of the United States. Russia’s Government would argue that its laws are there to protect Russian citizens from data abuse by foreign companies. But tech protectionism and Russian sovereignty over its citizens’ internet use are also at work. Podcast Episode 75 asks what Russia’s data localization means for the original internet dream of communications and commerce across borders. Tune in for the conversation.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 75 - Data Localization - The Case of Russia

Turkey is the first 2022 stop on our global tour about data localization. What is Turkey’s approach to cross-border transfers of personal data about its citizens and residents?

Turkey’s Law on Protection of Personal Data is comprehensive and like the European Union’s former Data Protection Directive, though it differs in some respects. Data localization is not part of this existing Turkish law. Instead, Turkey takes a sectoral approach to cross-border collection and processing of personal data of its residents. Turkish banks must collect and store Turkish customer data within Turkey. Data localizations requirements apply to payment and electronic money institutions, forcing companies like Paypal or Venmo to locate a payment system within Turkey and to comply with Turkish data privacy regulations. Social media providers must register with and report every six months to Turkish authorities about Turkish social media users. 

In August 2021, the Turkish Data Protection Authority (KVKK) proposed to amend Turkish law to permit cross-border data transfers if it issues an adequacy decision about another country. But unlike GDPR, the amendment would require the foreign country to be reciprocal in its data privacy laws, a unique approach that extends beyond adequacy. If adopted, the KVKK approach would encourage multinational companies to use Turkish-based servers and a Turkish subsidiary to have broad access to the Turkish market but would allow flexibility through binding corporate rules and notifying the Turkish authorities of a standard undertaking.

Tune in to Episode 78 to learn how and why Turkey may be aligning with evolving European standards instead of more authoritarian and protectionist rules evident in China, Russia, and India.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 78 - Data Localization - The Case of Turkey

The data protection laws of the European Union require many European and other companies holding or processing personal information of EU residents to appoint a Data Protection Officer – a DPO. This role creates a triangle of DPO duties – with responsibilities to the individuals whose personal information is at stake, to the company the DPO serves, and to the Data Protection Authorities who enforce GDPR.

Marie Penot provides outsourced DPO services to companies in German, French, and English from her own German consultancy. We explore with her the working life of an outsourced DPO. Learn how companies benefit from the independent role of a DPO regarding EU residents’ personal data. Explore advantages and disadvantages of an outsourced DPO instead of one appointed internally.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 84 - The Role of EU Data Protection Officers

Japan is a major U.S. ally commercially and otherwise. What is the Japanese approach to personal data privacy, and how does it differ from the U.S.’s privacy culture?

Erik Jacobs addresses the differences in how privacy is conceived and addressed in Japan in contrast to the complex U.S. system that has no overarching federal law about how our personal information is collected, stored, sold, and otherwise handled. Erik advised the White House Office of Science and Technology and coordinated policy at the U.S. Energy Department during the prior administration. Fluent in Japanese and English, Erik is now Policy Manager for the U.S. and Asia at Access Partnership, a leading global public policy firm dedicated to opening markets for technology. He discusses the Japanese attitude toward privacy policy and Japan’s 2022 Act on Protection of Personal Information (APPI), a comprehensive personal data privacy code that augments sectoral and other laws governing the flow of personal data.

Tune in to learn Japan’s approach and what the U.S. can learn from how a leading Asian ally developed a national approach to data privacy protection.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 87 - Japan’s Data Privacy Approach

Data localization – we’ve devoted several episodes to what countries are doing to control and restrict data flows involving their residents. What happens when there’s a war (or “military operation” if you prefer) going on? Do recent actions by the Russian government reflect a growing trend toward a splinternet, treating data as though it were national cattle being locked within a corral? Or is this more a reaction to sanctions imposed by other nations, having little do with data? 

This podcast considers how data localization is on the rise in democracies like Indonesia, but India’s government shelved a draft national data law that would have increased control and domestication of data after pressure and objection from its broader society. With Yugo Nagashima, a Frost Brown Todd attorney focused on international and domestic data privacy and technology, we discuss expanding fines and Russia’s seizure of Google’s Russian subsidiary’s bank account, aiming to force U.S. and other non-Russian companies to agree to Russia’s controls over data as a condition of offering services to Russians.  

Will the internet achieve its dream of global information flows with reasonable privacy protections, or are we headed to a splinternet, where nations control and restrict what their residents can share and receive across borders?

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 95 - Russia Ratchets Control of the Russian Internet

Listen for free

Get an update on lawsuits launched and settled in August 2022. Consider FBI warnings about DeFi platform and CISA declarations about protecting critical infrastructure. Learn of a draft bill circulating in California about an age-appropriate code for websites. A data broker is sued by the Federal Trade Commission for selling geolocation data that can be used to track who’s visiting a women’s reproductive health center, an addiction treatment facility, and everywhere else a smartphone travels.  

Tune in for this September 2022 update of what’s been happening in data privacy and cybersecurity.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 97 - Data Privacy Happenings in August 2022

How a California statute works in practice 

In August 2022, California’s Attorney General settled a case with Sephora, a beauty products company. Under the California Consumer Privacy Act (CCPA), California requires companies subject to its laws that they must provide their customers the right to stop the companies from selling their personal information to others. The privacy policy on Sephora’s website did not have such a provision. The case was settled for a $1.2 million civil penalty and an agreement to provide what the CCPA requires.

Sephora promptly changed its website. But how? This podcast discusses how in this CCPA example, the consumer’s ability to exercise a legally protected right was not made clear or easy. The settlement also shows how the word “sell” itself has no settled definition. Sephora argued that it was merely “sharing” rather than “selling” its customers’ personal information to other businesses, but the attorney general disagreed. The California Privacy Rights Act (CPRA) effective in 2023 will address the “sharing” of personal information, a much broader reach than “selling.”

Tune in to Episode 98 to learn how a privacy law moves from theory to practice, what it means for personal privacy rights, and how businesses that rely on data sharing and selling may not make it simple for their customers to exercise rights that a law creates.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 98 - “Do not sell my personal information”

Cybersecurity Awareness Month is co-led by the National Cybersecurity Alliance and the Cybersecurity and Infrastructure Agency (CISA). For more information about ways to keep you and your family safe.

1. Instagram fined 405M Euros for GDPR violations.

2. Google and Meta were fined a total of $72 million by South Korea’s Privacy and Protection Commission for tracking behavior on other sites without consumer approval, then using that data for advertising.  

3. The Internal Revenue Service acknowledged Friday that it had inadvertently exposed a batch of taxpayer information linked to some non-profits and other tax-exempt organizations, following a Wall Street Journal report that said as many as 120,000 individuals may have been affected by the error.

4. While its contents might seem unremarkable for China, where facial recognition is routine and state surveillance is ubiquitous, the sheer size of the exposed database is staggering. At its peak the database held over 800 million records, representing one of the biggest known data security lapses of the year by scale, second to a massive data leak of 1 billion records from a Shanghai police database in June. In both cases, the data was likely exposed inadvertently and as a result of human error.

5. China hopes to tighten its cybersecurity laws with higher fines for some violations. If the amendments are approved, fines for critical information infrastructure operators who use products or services that have not undergone security reviews could be 5% of revenue or 10 times their cost.

5. According to Acronis, ransomware losses worldwide are expected to surpass $30 billion by the end of 2023.

6. Lloyd’s of London Ltd. has told insurers that nation-state attacks and related losses will be excluded from insurance coverage after 1Q 2023. A 2022 court ruling dashed insurers’ hopes that “cyber war” exclusions would let them avoid payment for such losses.

7. Québec’s personal information privacy act takes effect September 22, a provincial statute that supplements Canada’s federal legislation, including the term “confidentiality incidents” and addressing biometric information.

8.  Euractiv reports that the EC will introduce its proposal for a Cyber Resilience Act this week.  The Act will address cybersecurity issues with consumer-connected devices.  

9. UK - The Telecommunications (Security) Act 2021 (Commencement) Regulations 2022 have been made.  They bring the Telecommunications Security Act 2021 (TSA) into force from 1 October 2022.  The Electronic Communications (Security Measures) Regulations 2022 under the TSA will come into force on the same date.

10.  After TikTok allegedly violated U.K. privacy regulations, the Information Commissioner’s Office sent a notice of intent including a possible fine of £27 million. 

11. California Governor Gavin Newsom has signed The California Age-Appropriate Design Code Act into law.

The new legislation, signed by Newsom on September 15, 2022 and passed by the state congress in late August, will implement some of the strictest privacy requirements for children in the US, especially in relation to social media.

12.  U-Haul International disclosed that it has experienced a data breach of names, drivers’ licenses/state IDs but indicated no credit card or financial information was compromised.

13. A teenage cyberattacker gained full access to Uber’s systems after impersonating an IT professional from the popular rideshare company to gain VPN access.

14. Congress is investigating Meta after The Markup discovered the tech giant’s Pixel tool gathered information on users’ private health records.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 99 - National Cybersecurity Awareness Month

Data breaches are now daily news, like weather reports. Podcast 101 digs beneath the headlines into what happens with data incidents that result in breaches – where our personal information goes, whether it’s ever truly recoverable, what businesses can to do to prevent and address breaches, what consumers can do about it, and how one company officer became the first U.S. person to be criminally convicted for mishandling a company’s data breach.

Andy Lunsford, founder/CEO of BreachRx, offers insights and advice for what companies and individuals can do about data breaches. Companies that have a data response plan in place and test it in advance are best positioned to deal with them. The October 5, 2022 conviction of Uber’s former Chief Information Security Officer highlighted the rising risks involved for business officers charged with data breach management. Consumers can act immediately when informed that their data was breached. Despite the need for a global standard about data breach response time and other non-political aspects of cross-border data, there is none, and not even a U.S. common approach.

Tune in to understand what happens when a data breach occurs and what each of us can do to respond to it.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 101 - Data Breaches - The impact on consumers and company personnel

Data brokers acquire and sell data that includes personal location information. This exposes to others visits of women seeking pregnancy healthcare options, the church, synagogue, or mosque we attend, and other sensitive information we would prefer to be kept private. In August 2022, the U.S. Federal Trade Commission sued Kochava, an Idaho based data broker, claiming that it engages in an unfair business practice by sharing location data it gathers from data sources.

Mike Swift, Chief Global Digital Risk Correspondent for MLex Market Insight, a Lexis-Nexis global news organization, discusses the lawsuit and the vital privacy interests at stake. On October 25, 2022, Kochava filed a motion to dismiss and earlier preemptively sued the FTC. Kochava aggressively argues that the FTC lacks authority to make its claims and that data brokers serve an important, positive function. 

The Kochava suit will test whether there is federal authority to regulate the sharing of sensitive private information through data brokers. If not, data brokers may be almost entirely unregulated, able to do virtually anything they wish with personal information we did not knowingly authorize them to obtain and sell. You’ll learn what businesses can do amidst a chaotic and evolving global legal compliance and what individuals can do to protect their sensitive personal location information.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 102 - Data Brokers and Our Private Location Information

Many of us wonder how the internet knows so much about us. We are barraged with tailored ads as we use the internet. How does this happen? How does this affect the compliance risks of businesses and the data privacy of us all?

Dan Frechtling, CEO of Boltive, explores the digital advertising ecosystem in Episode 115. Explore the sub-terrain of the internet, how it creates advertising revenue that is the business model of many tech firms, how unwanted ads and mal-advertising encroach, how it affects our personal privacy, and how regulation increasingly requires businesses to offer consumers the choice of refusing the sale or sharing of their information. Learn how businesses can minimize risk and avoid compliance violations and how consumers can make privacy choices within their control.

For information about inadvertent data leakage, Visit Boltive at https://www.boltive.com/ to learn more about inadvertent data leakage. Visit https://www.linkedin.com/in/frechtling/ to connect with Dan. 


Time Stamps:

01:40 — What brought Dan into the data privacy space?
07:50 — Consumer privacy concerns about digital advertising
09:06 — Data privacy minimization
09:42 — What Boltive does to address these issues
11:13 — What is the future of the digital advertising business model?

Episode 115 - The Digital Advertising Ecosystem: Privacy and Compliance Challenges

Prominent South African data privacy attorney Ahmore Burger-Smidt described 2022 as a year of “bloodbath” for personal data privacy in a recent report from her firm Werksmans. The firm manages the Lex Africa Legal Alliance, with members in over twenty-five African countries.

Cybercrime is extensive and growing in Africa, similar to trends evident in the rest of the world.
Cybercriminals employ increasingly sophisticated phishing attacks and business email compromise schemes and have expanded with cryptocurrency attacks and direct entry into data storage and other technology to steal personal data and identities.

African countries have responded through governmental and private sector efforts. South Africa’s Protection of Personal Information Act (POPIA) is about two years in force, with its implementation encouragingly steadfast. Click on Episode 118 for an African view of how the battle between cybercrime and civil society is unfolding.



Time stamps:

01:33 — What cyber crime / data privacy issues are we seeing in South Africa?
03:49 — Business email compromise
09:08 — South Africa's regulatory approach to data privacy
15:35 — South Africa's regulatory regime has both carrots and sticks

Episode 118 - Africa – Cybercrime and Data Privacy: A Report from South Africa

What do ChatGPT, Iowa, TikTok, and Spyware have in common? They all made data privacy news in March 2023. 
Italy’s Data Protection Authority blocked ChatGPT internet use on privacy grounds, the first western government to do so. Iowa became the sixth U.S. state to adopt a comprehensive personal data protection code. President Biden issued an Executive Order against federal use of social media containing spyware, without expressly naming TikTok or China as the targets.
Join the Data Privacy Detective’s conversation with Mike Nitardy and Yugo Nagashima, attorneys with the Data Privacy Team of Frost Brown Todd LLP. Explore the meaning of these developments for data privacy and its place in the world of technology and of us all.
Time stamps:
00:43 — ChatGPT in Italy
06:54 — Iowa develops a comprehensive personal data protection code
12:00 — Executive order against federal use of social media containing spyware

Episode 119 – News Digest: Data Privacy Developments — ChatGPT, Iowa, Spyware, and TikTok

Join Duane Laflotte and Patrick Hynds of Pulsar Security as the Data Privacy Detective asks these essential questions about cyber-crime and data privacy:

	How hard is it to break into a website or organization’s IT system?
	
	What are top tips for mid-sized organizations to defeat data attacks?
	
	What’s the future for people seeking a cybersecurity career?

Pulsar Security offers institutions cyber-protection through software and services to prevent data leaks and losses at reasonable cost. Offensive Network Security | Enterprise Security Software | Pulsar Security. Tune in for insights into countering the growing tide of data and identity theft 

Time stamps:

02:15 — How hard is it for a bad actor to infiltrate a company's website or IT system?

03:37 — How much safer is HTTPS?

05:50 — What are the top ways a mid-sized business can protect itself from cybercriminals?

07:10 — Why is it important to know which data is flowing through your organization?

09:55 — How often should you change your passwords?

13:18 — Are we going to be able to keep up with cybercriminals?

Episode 121 - The Battle For Data Privacy: What Does A Mid-Sized Organization Do?

The modern automobile – a marvel of technology and transportation. It collects enormous amounts of data about us. This information is used for continuous improvement in design and safety and for our convenience. But it also creates risks to personal privacy. Episode 124 provides a tour of what automakers, suppliers, and users can do to create fair controls over how the automobile monitors, records, and shares personal information.
Standard setting includes the Alliance for Automotive Innovation, in its Consumer Privacy Protection Principles. NIST (the National Institute for Standards and Technology) issued 2023 revisions to its Cyber-Security Framework. In the absence of national law or regulation about automotive privacy, these standards are a baseline for acceptable use of automotive generated personal data. Tune in to consider what automotive businesses and private individuals can do to safeguard personal privacy while allowing continuing technological and safety progress. Matt Schantz, an attorney with Frost Brown Todd’s Automotive Industry Team, with a focus on intellectual property and technology agreements, leads an exploration of how our car is watching, listening, recording, and sharing our data – and choices business and consumers have to protect personal privacy.
Time stamps:
01:10 — How do today's automobiles collect data about their drivers?
05:00 — How do automakers and suppliers address privacy concerns?
06:40 — What guidance does NIST have on balancing automaker interests with individual privacy concerns?
10:19 — Tips for automakers and suppliers about meeting privacy concerns and/or regulations?
13:57 — TIps for drivers about safeguarding their data

Episode 124 — Data Privacy & the Automobile: Your car is watching, recording, and sharing your data

Identity orchestration. Explore its meaning. Discover in Episode 125 how identity orchestration can protect data privacy and data security. Founder and CEO of Strata Identity [https://www.strata.io/], Eric Olden explores with us the change under way from passwords and multi-factor authentication to a radically different approach to safeguarding and verifying identities in a world of distributed data. Learn what a blue checkmark will mean within LinkedIn as one example.
Consider how a system of passwords and identity exposure sprinkled among hundreds of applications and sources exposes individuals and organizations to hacking and theft risk at the weakest link. Can technology protect us from ourselves? Learn what OIDC (OpenID Connect) means and how it relates to the ongoing struggle between mal-actors and the rest of us.

Time stamps:
01:12 — What is Identity Orchestration?
04:12 — What is Project Indigo?
07:01 — OIDC - OpenID Connect Protocol
15:25 — Challenges for privacy as technology changes, and what we can do about it

Episode 125 — Identify Orchestration: Are Passwords Obsolete?

Employers and employees – how much privacy is there in the workplace? Episode 130 explores this question in the United States. What’s an employee’s reasonable expectation of privacy while working? How do federal and state laws limit employer surveillance of employee activity? What limits are there to an employer’s monitoring of employee use of company time and property? 
Employees use company-provided computers, phones, and other property for a variety of personal purposes, often injecting personal information through a company’s IT system. What should employers and employees do about this? And what about departing and former employees – to what extent can or should an employer monitor a departing employee’s data streams or keep a former employee’s personal information?
Annee Duprey, a partner in the Labor & Employment Group of Frost Brown Todd LLP in its Columbus office, and Seth Granda, a senior associate in the firm’s Nashville, Tennessee office, tour this complicated and challenging terrain and offer top tips to both employers and employees. 
Time stamps:
01:20 — What is a reasonable expectation for employee privacy in the US workplace?
08:18 — Are there limits to what kind of monitoring employers can conduct on their employees?
14:35 — What limitations are there for employees on what they can do with company-provided devices?
20:15 — Top tips for employees and employers?

Episode 130 — Privacy In The US Workplace

The U.S. Government collects data globally about persons and organizations. In doing so, it collects vast amounts of data about U.S. persons “incidental” to collecting foreign intel for national security purposes. Since the Carter Administration when the Foreign Intelligence Surveillance Act (FISA) became law, this has raised conflicts between the personal privacy of U.S. and foreign persons and the Government’s interest in national security and crime prevention. The FBI has accessed FISA databases millions of times through U.S. person queries without a warrant – creating front-page news and raising major concerns from the left and right of politics.

Tune in to understand what is at stake, as Congress considers by December 31, 2023 whether and how to extend FISA. Learn about FISA, the reach of Section 702, how it operates in practice, and how the privacy issues involved affect data flows and commerce between the United States and Europe and the privacy of persons domestic and foreign. Consider how information about U.S. persons is involved and can be accessed without a judicial warrant. Our guests are Gene Price, a partner in Frost Brown Todd’s Louisville office, retired as Read Admiral from the U.S. Navy where he supported U.S. Cyber Command and Naval Information Forces Reserve, and Yugo Nagashima, a partner in the firm’s Washington, D.C. office and Deputy Chair of its Data Security and Privacy Team.


Time stamps:

01:45 — What is FISA?

09:23 — What is a “US person query”?

15:15 — What are the privacy implications of FISA?

Episode 137 — Foreign Intelligence & Data Privacy - FBI Access to FISA Databases

Amazon Store challenges the European Union over whether it is a VLOP. What’s that, you ask? Find out and discover how an EU Court issued an early split decision under the EU’s Digital Services Act. America’s first state, Delaware becomes the 12th state to adopt a comprehensive data privacy code. Google agrees to pay $93 million, strengthen its privacy policies, and be more transparent about location tracking, to settle California claims. 

Explore the deeper meaning of these September 2023 data privacy developments. Yugo Nagashima, Brion St. Amour, and Joe Dehner, members of Frost Brown Todd LLP’s Data Privacy and Cyber Security Team, discuss what these events mean for organizations and individuals. Join the dialogue!

Time stamps: 

00:33 — Delaware adopts data privacy code
05:20 — Google agrees to pay $93 million
10:48 — EU Court issues split decision under EU’s Digital Services Act

Episode 142 — September 2023 Data Privacy News

October 2023 was a busy month for data privacy. Join our monthly podcast of three major developments in the world of personal information and technology. Our picks are these:
1. On October 30, President Biden issued an Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence (AI).  Noteworthy to Data Privacy was his call for Congress to pass bipartisan data privacy legislation, especially for children, which would be a significant step towards a federal data privacy law.  In addition to national security and other features, the EO prioritizes federal support for accelerating privacy-preserving techniques, strengthening privacy-preserving research and technologies, evaluating how agencies collect and use commercially available information, and developing guidelines for federal agencies to evaluate the effectiveness of privacy-preserving techniques.  Explore what the Executive can do in the absence of Congressional action on data privacy. FACT SHEET: President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | The White House.
2. The Federal Trade Commission amended its Safeguards Rule to require non-banking financial institutions to report certain data breaches to the FTC. Learn which businesses are covered and what the rule requires of them. Explore how the new reporting requirements will force a wide range of businesses to report data breaches in detail to the FTC, and how this could affect data privacy.
FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches | Federal Trade Commission.
3. 	A United Kingdom court rules on October 17 that Clearview AI was not liable to the UK’s Information Commissioner for scraping the photos of UK residents from the internet and offering its services to foreign law enforcement agencies. ukftt_grc_2023_819.pdf (nationalarchives.gov.uk). Learn why the extraterritorial reach of GDPR principles does not extend as many thought it might, how UK residents who have not consented to Clearview’s use of their images have no remedy, and what this means for any regulation of what people post on the internet.


Time stamps:
00:25 — Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence
05:53 — FTC amends Safeguard Rules
11:16 — UK Court rules in favor of Clearview AI

Episode 146 — October Data Privacy Highlights

How small and mid-sized organizations can afford privacy by design: Making data privacy and security affordable and scalable
Tech giants have vast budgets for cybersecurity and data privacy. But most organizations are small or mid-sized enterprises (SMEs) and can’t afford expensive in-house talent, hardware, and software to combat data piracy or prevent data breaches. How do startups, SMEs, and MSPs create a privacy responsible foundation as they start and grow? How can they make privacy part of their offering to customers? How can they maintain first-class cybersecurity and data privacy as they scale and grow on an affordable budget?
Darren Gallop, co-founder and CEO of Carbide (Company | Carbide (carbidesecure.com), provides advice on these and other topics in this Episode. With an overview of how secure personal information is today, Darren explains the benefits of starting with a secure privacy-centric foundation on an outsourced basis, then adding essential tools as an organization grows. Listen for top tips on how organizations and individuals can protect sensitive personal information on an affordable basis.

Time stamps:
01:59 — How secure is personal info these days?
06:10 — On a limited budget, how can small and mid-sized businesses invest in data protection?
12:02 — How does an SME maintain first-class data privacy practices?
17:19 — Top privacy tips for individuals

Episode 147 — How small and mid-sized organizations can afford privacy by design

Post-Quantum Data Privacy – what is it? What does it mean for organizations and individuals? That is this episode’s focus. Tune in to learn how one company offers privacy-protect ive messaging and cryptocurrency services in the age of Web 3.0 and quantum computing. JB Benjamin, the founder of UK-based Kryotech Ltd. (Kryotech Group), provides a tour of Vox Messenger and Vox Wallet. These services employ privacy-centric technology. Explore how our personal information is collected, used, and shared often without our knowledge or approval. Consider how technology beyond passwords is essential to deter unwanted use of our personal information and to minimize rising theft of our financial resources and even our identities.

Quantum computing means an exponentially increased power that can be used to break through lengthy passwords and otherwise hack and misuse data, both personal and organizational. Defenses are also evolving. Post-quantum privacy entails use of double-ratchet encryption, message immolation, sophisticated use of public and private keys, and other techniques. Individuals can be empowered to make choices about the value of their digital information and identities, which otherwise are swept up and used by businesses without payment. Understanding post-quantum data privacy is essential to empowering each individual to decide how to exercise choices about use of personal data.

Time stamps:

01:08 — How is our personal info used by companies to make a profit?
04:51 — What does Kryotech do to enhance privacy?
12:54 — What is Vox Crypto and how does it enhance privacy
18:03 — Top tips for businesses who want to focus more on privacy
20:10 — Top tips for individuals who want to protect their privacy

Episode 148 — Post-Quantum Data Privacy: Learnings from a Pioneer

Blockchain technology. Can it be a solution to privacy risks inherent in traditional IT? How is it different from cryptocurrency? What can it do to allow both individuals and organizations to limit and protect personal information exchanged in daily life?

Explore these questions in Episode 149, with Zenobia Godschalk, head of communications for Swirlds Labs (https://swirldslabs.com). Take a brisk tour of an open-source approach that applies blockchain technology to our evolving web. Learn about Hedera – an open source, leaderless proof-of-stake network. Consider how an individual need not share a lot of personal information when a transaction requires only proof of one thing – such as whether the individual is an adult or whether a person actually is a bank account holder.

Listen for top tips to organizations and individuals about how open-source blockchain technology can minimize risks to personal information and identity theft. Hear how public ledgers for decentralized economies are changing our digital existence and can be a means of protecting personal privacy without disrupting our digital world.


Time stamps:

01:02 — What is blockchain technology, and how is it different from cryptocurrency?

07:30 — What is tokenization?

12:42 — Is blockchain 100% effective?

14:44 — Top tips for organizations in considering blockchain technology as a replacement for traditional IT

18:52 — Top tips for individuals in considering blockchain

Episode 149 - Privacy & blockchain: an open source approach to privacy by design

Perry Johnson & Associates (PJ&A) provides medical transcription services to healthcare organizations. Its website states that it offers “secure HIT solutions,” using “multiple U.S. based, secure data centers for documentation storage and disaster recovery.” But in November 2023, PJ&A began informing about nine million people by individually sent letters that “between March 27, 2023 and May 2, 2023, PJ&A learned that an unauthorized party gained access” to its network and “acquired copies of certain files from PJ&A systems.”
A November 2023 TechRadar report summarizes the background:
“A total of 8.95 million individuals are affected, with the stolen data including full names, birth dates, postal addresses, medical records, and hospital account numbers. Furthermore, the hackers took admission diagnoses, as well as dates and times of service. In some cases, the hackers also stole Social Security Numbers (SSN), insurance and clinical information from medical transcription files, and names of healthcare providers - all of which would be more than enough to stage highly convincing social engineering attacks (phishing, identity theft, etc.) and could result in many class-action lawsuits.”
How did a leading MedTech company respond to this cybersecurity incident? Tune in to learn how one podcast listener was informed by letter about the wrongful release of the individual’s medical information and sought details with no success. Consider how society must prepare better to address the aftermath of data breaches and what we can do collectively and individually to protect our most sensitive information.

Episode 150 — Nine Million Medical Records Leaked - How can victims find out what happened?

Major data privacy news from November - the meaning beneath the headlines:
California issues proposed rules on ADTs – Automated Decision-making Technology. Applying California’s principal data privacy statute, the California Privacy Protection Agency proposes opt-out requirements, pre-use notices, and other measures for AI and related organizations. A New Landmark for Consumer Control Over their Personal Information: CPPA Proposes Regulatory Framework for Automated Decisionmaking Technology (ca.gov).
The TSA is using biometrics at U.S. airports with little notice or disclosure. Some U.S. Senators have called “time-out.” What’s going on with biometrics at airports? BUR23A41 (senate.gov). 
The influential Data & Trust Alliance proposes eight cross-border Data Provenance Standards. Learn how international standards are being set by the private sector to increase transparency, reliability, and use of datasets essential for AI. Will data become labeled and tracked like food and art? How does private standard setting lay the groundwork for privacy conscious laws and regulations? Consider the immediate opportunity to provide your comments about AI and personal data privacy. The Data & Trust Alliance (dataandtrustalliance.org).
Tune in to Episode 151 for analysis, as the world of data privacy spins toward 2024.

Time stamps:
00:59 — ADTs
09:02 — The TSA is using biometrics
13:47 — Data & Trust Alliance proposed Data Provenance Standards

Episode 151 — Top November 2023 Data Privacy News

Data clutter – we keep our homes tidy, at least some of us do. But what about digital data? It accumulates and grows over time. Unlike hard copy files, which can be pitched or sent to long-term (expensive) storage, data is silent and unobservable (except perhaps to IT personnel).
Explore how organizations amass vast amounts of data containing personal information, some highly sensitive. There it resides, posing serious risks to organizations and individuals.

In Episode 152 Jason Cassidy, CEO of Shinydocs (https://shinydocs.com ), takes us on a tour of data clutter. Learn the vast amounts of unintended data gathered and kept by businesses that don’t need it, how this can be managed, how personal privacy can be more secure through state-of-the-art data management. Consider how data can be auto-classified on creation, how files can be better located with data breach risk minimized. Hear an industry expert’s top tips about data management for organizations and individuals. Make it a new year’s resolution to de-clutter, to data-minimize, to control fileshares, to design privacy-centric creation, retention, and storage of digital data. 

Time stamps:

01:10 — What info do organizations typically store in their databases?
07:20 — What risks to our personal privacy are posed by data clutter? 
14:48 — Tops tips to organizations for dealing with data clutter
16:53 — Tops tips to individuals for dealing with data clutter

Episode 152 — Data Clutter & Data Privacy: Databases and the privacy risks they entail

When we visit websites, we increasingly see popups. Why is this? How does consent affect online advertising? And what’s changing in 2024?

Mate Prgin, founder/CEO of Enzuzo (https://www.enzuzo.com) explains how Google’s 2024 standards force online retailers to obtain express consent from customers for collecting and sharing personal information. Bolstered by the recent Quebec Law 25 (first in North America to adopt GDPR-style consent standards) and spreading U.S. state laws led by California, North American online sellers are driven to change their website technology and practices to give consumers the choice of allowing or refusing their personal information to be shared and used for personalized advertising. The meaning of “consent” and how it is provided in practice become essential for internet commerce in 2024. Understand how internet retailers can comply with law and private sector standards, how individuals will be empowered to exercise choices when shopping online about how their personal information will be used and shared.

Time stamps:

01:30 — What do you see in 2023 about data privacy compliance
04:23 — Google’s 2024 standards, explained
10:48 — Top tips for businesses in setting up their websites with privacy for users in mind
11:58 — Top tips for individuals who want to protect their privacy

Episode 153 — Online Advertising, Consent, and Data Privacy: Big Changes looming for 2024

Why do businesses create cookies for their websites – and what choices can visitors make when a popup asks us to choose? Can chatbots write privacy policies for businesses? How can we determine if a website shares personal information we provide to it – and if so, for what purposes?

Donata Stroink-Skillrud, President and Legal Engineer of Termageddon (https://www.termageddon.com), addresses these questions. As data privacy laws and regulations spread, data privacy technology and policies must adapt. As website visitors, we should understand our choices when deciding what to click on cookie popups and should know whether a website business is gathering our personal information for limited and proper purposes. Learn a trick about how to know if a business shares personal information. Businesses wishing to be privacy compliant and earn a privacy-centric reputation should consider top tips. For individuals, hear advice for how we can protect our personal information in a world of growing threats to our privacy.

Time stamps:
01:00 — Cookies, explained
06:21 — Chatbots, explained
10:56 — How can we find out if a business is sharing our personal information?
14:21 — Tips for businesses that want to focus on user privacy
15:24 — Tips for individuals who want to protect their privacy

Episode 154 — Online Privacy - Cookies, Chatbots, And Data Sharing

Episode 155 considers three important developments as 2024 opens: 

-How the European Union’s pending AI Act blazes a new trail 
-How umbrella insurance may or may not apply to claims involving biometrics
-How Quebec’s 2023 data privacy act will reshape privacy notices throughout North America.

Yugo Nagashima and Brion St. Amour, attorneys with the coast-to-coast U.S. law firm Frost Brown Todd LLP, team with the Data Privacy Detective to cover these three essential matters.

On December 9, the European Union published a preliminary agreement on the Artificial Intelligence Act, a pioneering law that provides a framework for sale and use of AI in the EU. We consider what the AI Act covers and the four-levels-of-risk approach the EU will take for regulating AI.

We then jump into discussion of a class action lawsuit against Krispy Kreme Doughnut Corp. The suit claims a violation of the Illinois Biometric Information Privacy Act (BIPA). Does Krispy Kreme’s insurance coverage apply? We consider the distinction between the lawsuit's claims and the company’s umbrella policy. The insurer declared that Krispy Kreme is not entitled to an insurance paid defense, based on a policy exclusion.

The Quebec Act for protection of personal information in the private sector became law in September 2023. December 18, 2023 Guidance from Quebec’s Commission covers what must be in privacy notices, including that they be in clear, simple language (in French and English). https://www.cai.gouv.qc.ca/politiques-de-confidentialite/ What is “clear and simple”? The Guidance offers a checklist of what organizations should say in their website privacy postings, and is certain to force changes in websites of digital businesses that cover U.S. and Canadian markets.

Time stamps:
01:16 — EU’s pending AI Act
10:11 — Umbrella insurance and biometrics
17:08 — Quebec’s 2023 data privacy act

Episode 155 — Data Privacy News From December 2023

Privacy is dead, get over it. This is what a blockchain entrepreneur told a conference at the European Court of Justice on September 30, 2016. And yet, we know this is not true. If privacy were dead, we would know all the details of Donald Trump’s tax returns and we would have access to every email of Hillary Clinton from both public and private servers while she was Secretary of State. And we don’t.

Personal data privacy is alive and well, but it is under attack. And our own worst enemy is ourselves. Data privacy is not about protecting data – it’s about protecting you. Listen for tips on how to eliminate unnecessary risk by taking some simple steps to protect the data on your smartphone.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Data Privacy Starts with You – a simple tip about smartphones and your privacy

Episode 1 - Data Privacy Starts With You

The May 2-3, 2019 International Association of Privacy Professionals Conference featured leading U.S. officials and participants in the data privacy field. Mike Nitardy, a certified Privacy Professional (U.S.) and data privacy attorney at Frost Brown Todd LLC shares highlights from the conference. 

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Data Privacy Detective

Episode 35 - Hot Topics in Data Privacy - from the U.S. front

Episode 35 - Hot Topics In Data Privacy - From The US Front

What do serial killers, employees who don’t want their fingerprints shared and a U.S. Senator have in common? Data privacy. In this podcast, Victoria Beckman, Co-Chair of Frost Brown Todd’s Privacy and Data Security Team, discusses this and other news.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 37 - Catching Serial Killers, Employee Biometrics, Tracking and Personal Data Privacy

The laws governing legal advertising in some states require the following statements in any publication of this kind:

"THIS IS AN ADVERTISEMENT."

Frost Brown Todd Podcast

Pinned to spotlight

Popular tracks