.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.png?width=148&height=200&name=Privacy%20Insider%20Book%20(mock%20w%20shadow).png)
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
.svg){kind=small}
Hello all, and happy Thursday!
Regular readers of this newsletter will recognize the name Clearview AI. This facial recognition company got into hot water by collecting and processing facial data from more than 20 billion images on the internet, all without collecting proper consent or establishing an appropriate legal basis.
If you’re familiar with GDPR at all, then you’ll know this is very much against EU and UK law. Clearview AI was quickly hit with enforcement actions from a number of EU member states as well as the UK’s Information Commissioner’s Office (ICO). But, as reported in one of our stories in this week’s newsletter, the ICO recently lost an appeal against Clearview AI, effectively canceling a 7.5 million pound fine.
Although Clearview AI used to have commercial customers, it limited its services to law enforcement agencies after an ACLU lawsuit. Because its only customers are law enforcement agencies—none of which were based out of the UK—a tribunal ruled that the ICO could not levy a fine against Clearview AI.
Essentially, the tribunal asserted that this fine would in effect serve to dictate the actions of a foreign government’s law enforcement agencies, which falls outside the scope of the UK’s data protection rules.
Data privacy regulations are intended to regulate private companies, not governments. But unfortunately, not all threats to individuals’ data privacy rights come from the private sector. Many of the most worrisome rights violations do come from governments—in fact, several recent data privacy regulations codify significant exemptions for government agencies’ data processing activities.
Ultimately, this reversal highlights one of the enduring challenges in data privacy: Private companies need to play by their governments’ rules, but those rules won’t always respect individuals’ fundamental rights.
Best,
Arlo
Top Privacy Stories of the Week
Jordan Issues First Personal Data Protection Law
The Jordan Personal Data Protection Law (PDPL) was published in the Official Gazette on 17 September 2023 and will come into effect 17 March 2024. The Jordan PDPL follows the same structure as many other data privacy laws, though it does provide a number of government exemptions.
Facial Recognition Company Clearview AI Overturns UK Privacy Fine
Last year, Clearview AI was fined more than £7.5m by the Information Commissioner's Office (ICO) for unlawfully storing facial images in what has been described as a “perpetual police line-up.” Because Clearview AI’s database was solely used by law enforcement outside of the UK, it was able to reverse the ICO’s privacy fine.
Google Reminds Advertisers to Prepare for End of Third-Party Cookies
In November, Google is preparing to release a suite of tools to help companies evaluate their use of third-party cookies as preparation for its intention to phase out the use of third-party cookies in the Q1 of 2024. It should be noted that third-party cookies make up a small portion of data trackers used to collect personal information.
US Consumer Watchdog Proposes New Financial Data Sharing Rules in Competition Boost
The Consumer Financial Protection Bureau (CFPB) proposed rules that would make it easier for consumers to access their own financial data from lenders. The purpose of this proposed rule would be to make it easier for consumers to switch lenders, thereby encouraging greater competition.
Belgian Data Protection Authority Publishes Guidance, Checklist on Cookies
The Belgian Data Protection Authority has published a number of guidelines and tools on the appropriate use of cookies, including a cookie checklist, templates, and more.
Osano Blog: CCPA/CPRA Data Mapping: The Why, What, and How
What is data mapping, and why is it so essential for CCPA/CPRA compliance? We explain everything you need to know about data mapping for CPRA in this blog.
If you’re interested in working at Osano, check out our Careers page!
