Harvard Pilgrim Health Care's parent organization Point32Health said a cyberattack that began in March exposed patient and provider personal information, CBS News reports. Information accessed from 28 March to 3 April included personally identifiable information. Harvard Pilgrim said it is "taking steps to implement additional data security enhancements and safeguards to better protect against similar events in the future."Full Story
France's data protection authority, the Commission nationale de l'informatique et des libertés, published its 2022 annual report. Among the highlights, the CNIL said for the first time since the EU General Data Protection Regulation entered into force, it handled more complaints — 13,160 — than it received — 12,193. The CNIL said the response is the result of a portal that enables users to "follow their file, simplify and secure exchanges."Full Story
Five years after the EU General Data Protection Regulation entered into force, privacy professionals are experiencing the legislation in a new era, with more consequential enforcement, court rulings and privacy-related legislative initiatives. It's also applicable to new technologies, and dozens of countries beyond the EU have taken inspiration from the legislation for their own laws. An infographic published in the IAPP Resource Center highlights the GDPR's influence and impact. Full Story
U.S. President Joe Biden announced additional initiatives exploring potential impacts and risk mitigation related to artificial intelligence technologies.
Dutch consumers' associations Consumentenbond and Stichting Bescherming Privacybelangen are preparing to file a class-action lawsuit against Google for tracking, collecting and selling consumers' data without consent, NL Times reports. "Google collects data in a way where real consent from users is impossible," the Consumentenbond said.
After its introduction in Canada's Parliament last year, Bill C-27, the Digital Charter Implementation Act, became a major point of debate among privacy professionals. Industry stakeholders believe the remaining sticking points are solvable. However, regulators, such as the Office of the Privacy Commissioner of Canada, believe the legislation is incomplete and needs to go further to protect citizens' privacy rights. IAPP Staff Writer Alex LaCasse has the details.Full Story
The U.K. Information Commissioner's Office published guidance on responding to subject access requests. The ICO said businesses and employers risk fines or reprimands for compliance failures, but ICO Policy Group Manager Elanor McCombe said many employers misunderstand the requests or underestimate their importance.
TechCrunch reports Ireland Data Protection Commissioner Helen Dixon told members of European Parliament this year will further demonstrate effective EU General Data Protection Regulation enforcement.
Carnegie Mellon University's Privacy Engineering Master's Program is seeking organizations to sponsor capstone projects for the 2023 fall semester.
The Association of Southeast Asian Nations and the European Commission released joint guidance on the application and use of respective contractual clauses. The guide aims to provide a high-level comparison of ASEAN model contractual clauses and the EU's standard contractual clauses to help facilitate cross-border data transfers. By comparing and contrasting the clauses, the guide also provides best practices for companies to meet the requirements set forth in both jurisdictions.