The New York Times reports on the growing use and application of facial recognition technology by private businesses. Such rollouts are proliferating around the world but most notably in the U.K. More specifically, businesses are using facial recognition to combat minor crimes and create watchlists largely unbeknownst to individuals being surveilled. U.K.
The IAPP released the Privacy Risk Study 2023, which examines the significant privacy challenges faced by organizations in relation to risk assessment and management. Teaming with KPMG on the 2023 edition, the IAPP studied companies' public 10-K submissions to the U.S. Securities and Exchange Commission while gathering further perspective from a range of senior privacy leaders.
An amendment to a procedural bill could allow for Ireland's Data Protection Commission to make all of its procedures confidential, Euractiv reports. The provision was added as an amendment to the "Courts and Civil Law (Miscellaneous Provisions) Bill 2022" by Department of Justice Minister of State James Browne.
Ireland's Commercial Court extended Meta's interim stay on the order from the Irish Data Protection Commission to suspend its EU-U.S. data transfers, The Irish Times reports. Per the order, the stay will continue through the end of July and was granted on an ex-parte basis. The DPC will have an opportunity to respond. In May, Meta was fined 1.2 billion euros by the DPC and ordered to cease all data transfers of EU citizens' data to the U.S.
India's Personal Data Protection Bill, 2022 will be on Parliament's monsoon session agenda beginning 17 July, the Financial Express reports. The bill was reintroduced in November 2022 after it was first withdrawn in August. Per the revamped legislation, the maximum penalty for data breaches is now INR5 billion, whereas in previous iterations the penalty was 2-4% of a firm's global turnover.Full story
Publishers Clearing House agreed to pay a USD18.5 million settlement in a lawsuit brought by the U.S. Federal Trade Commission, The New York Times reports.
Privacy rights group NOYB submitted a complaint to Belgium's data protection authority, the ADP, against U.S.-based companies over alleged privacy violations concerning cellphone data use. The complaint alleges telecommunications provider BISC and fraud prevention firm TeleSign improperly collected and shared data between them on Europeans' cellphone activity.Full story
Brazil's data protection authority, the Autoridade Nacional de Proteção de Dados, published guidance on data processing activities related to research endeavors. According to the ANPD, the guidelines aim to "clarify doubts about the legal hypotheses that authorize the processing of personal data" in the research context.
The U.K. National Cyber Security Centre announced additions to its risk management toolkit for practitioners. The updates include an eight-step cybersecurity risk management framework, a refined toolkit concept to cover practices across sectors and all-sized entities, and an introductory risk management and assessment methodology.
Oregon SB 619, an act relating to protections for the personal data of consumers, received final approval from the Oregon State Legislature 22 June after a 54-0 House vote to pass. The comprehensive privacy bill covers entities that control or process personal data on 100,000 consumers or derive 50% of revenue from selling the data of more than 25,000 consumers. It contains unique definitions for biometric and personal data, required data protection assessments and a 30-day right to cure that sunsets 1 Jan. 2026.