We’ve compiled the latest in Data Protection and Privacy news for your convenience below.

1) Newly Published Documentation

• A “Digital Partnership Agreement” and “Digital Trade Principles” have been signed as a follow-up to the announcement of a new digital partnership between the EU and Singapore in December 2022. These documents aim to strengthen cooperation between the EU and Singapore on digital technology fields like trusted data flows and data innovation, among others. Read here →
• The European Union and the United States of America strengthen their cooperation on research in artificial intelligence and computing for the public good, by signing an Administrative Arrangement on Artificial Intelligence, among others. Read about this news on our blog →
• To help with the hiring process, CNIL has released a guide and a series of useful sheets. Processing individual candidate data is a necessary part of recruitment. While safeguarding the rights and freedoms of applicants, their personal data, and lowering the danger of privacy invasion, this publication assists recruitment professionals in their compliance with the GDPR at all stages of recruitment. Read here → (in French)
• CNIL has published the 2022 report on its repressive action, which also included a major reform of corrective procedures. Last year, the CNIL adopted 21 penalties, 147 formal notices and numerous compliance notices, whilst the cumulative fines dished out exceeded 100 million euros in value. Access here → (in French)
• The European Commission will start regularly checking the progress of all ‘large-scale’ GDPR cases across the EU. This monitoring was triggered following an action by the Irish Council for Civil Liberties (ICCL) which criticized the lack of GDPR enforcement against Big Tech, and the European Commission’s failure to monitor how the GDPR is applied. Read more here →

2) Notable Case Law

• The CNIL fined the voice, video, and text communication service Discord Inc 800,000 euros for failure to comply with the General Data Protection Regulation (GDPR). The fine was issued on the basis of findings further to an investigation carried out on the authority’s own initiative, involving an online check on both the “discord.com” website and the DISCORD mobile application. Read about the decision here →
• The US Federal Trade Commission (FTC) fined the telehealth and prescription drug discount provider GoodRx Holdings Inc., US$1.5M for sharing sensitive health data with social media platforms and other tech giants. The FTC has taken an enforcement action under its Health Breach Notification Rule against GoodRx, for failing to notify consumers of its unauthorized disclosures of consumers’ personal health information to Facebook, Google, and other companies. The Authority’s summary can be found here →
• The US-based developer, Luka Inc. , has come under fire from the Italian Garante since its AI-powered chatbot ‘Replika’, which generates a ‘virtual friend’ using text and video interfaces, was found to be in breach of the EU data protection Regulation. The chatbot was found not to comply with transparency requirements and was deemed to process personal data unlawfully. Indeed, too many risks were associated with children and emotionally vulnerable individuals through the use of this chatbot. Read about his on our blog →

3) New and Upcoming Legislation

• Industry associations call on EU decision-makers to halt the Data Act. 30 trade organizations pleaded with the co-legislators of the Data Act to refrain from taking “a leap into the unknown” with the new law in a joint statement released on Wednesday (1 February). Reported here →
• Judicial reforms in Israel and changes in legal frameworks are raising concerns in the EU and could impact data flows. Head of the International Department at Norway’s data protection authority, Datatilsynet, said that the impending reforms might lead the EU to reconsider Israel’s adequacy status. Such a reform would imply that suddenly one cannot transfer data freely from Europe to Israel anymore, and probably European companies would avoid Israeli companies as well. Indeed, this may lead to Israel being placed in the same category as China. Read about it here →
• US LAW UPDATES
  • New York: Bill 3162 on data subject rights; Bill 3281 on child data privacy; and Bill 2390 on biometric data and advertising all introduced to State Senate
  • New Mexico: Bill 319 for the age appropriate design code introduced to Senate
  • Utah: Bill 152 on Social Media Regulation introduced to State Senate
  • Illinois: Bill 1230 to amend Biometric Information Privacy Act and Bill 1381 on right to know introduced to General Assembly
  • Tennessee: Bill 932 on consumer biometric data protection introduced to House
  • Minnesota: Senate Bill 954 relating to biometric privacy introduced to and Senate Bill 950 for an act relating to consumer data privacy introduced to Legislature
  • Nebraska: Bill 308 for Genetic Information Privacy Act to be heard in committee and opens for public comments.
  • New Jersey: Senate passes Bill 332 on requirements for personal information disclosure. This Bill mandates that commercial Internet sites and online services notify users when personally identifiable information is collected and disclosed and provides an opt-out mechanism.
  • Virginia: Bill 1432 for privacy of health records passed by Committee on Education and Health; Bill 1087 on amendments for genetic data privacy passed by the Senate; and Bill 1688 on child protection provisions passed by House after third reading.
  • West Virginia: House Bill 2964 relating to online privacy protection of minors introduced to Legislature.
  • Arizona: Bill 1238 on biometric identifiers read for the second time in State Senate
  • Hawaii: Consumer data protection bill 1497 passes committee.
  • California: The California Consumer Privacy Act, as amended (the “CCPA”), was further implemented by the California Privacy Protection Agency (CPPA), which overwhelmingly adopted and approved the Agency’s rule-making package, as modified, on February 3rd, 2023. The proposed regulations have not yet taken effect, since the Office of Administrative Law must first approve them; the office has 30 working days from the date of filing to do so. You may get the meeting materials here.

4) Strong Impact Tech

• A data breach that let hackers obtain the personal information of millions of consumers has been verified by Google. According to Google, the hackers only gained access to a small amount of user data, such as phone numbers, account statuses, SIM card serial numbers, and details about the customers’ mobile service plans. Reported here →
• TikTok CEO is to testify before US Congress on 23 March 2023 over data privacy concerns. The scrutiny of the Chinese-owned app has culminated in the CEO’s impending appearance before the House energy and commerce committee, as confirmed by Republican representative Cathy McMorris Rodgers. The CEO will face legislators amid concerns over the social media app’s alleged collusion with Beijing in accessing user data. More on this story here →

Other key information from the past weeks

• The EU Health Council has agreed on amendments concerning secondary use of data in the EU health data space.
• Dutch officials have been told not to use the TikTok app since the Chinese-owned video-sharing platform poses privacy risks.
• In response to worries that EU legislation is not adequately shielding the creative industries from quickly evolving generative AI technologies like ChatGPT, artist groups are organizing a drive for legal amendments.