Enforcement: More Than Just Fines

Hello all, and happy Thursday!  

For most businesses subject to a privacy law, when they hear “enforcement,” they think of the massive fines being applied to egregious violators of the law. In part, that’s because much of what goes on in regulatory enforcement happens behind the scenes. The Connecticut Data Privacy Act (CTDPA), however, gives us a chance to peek behind the curtain. 

Under the CTDPA, the Attorney General’s Office is required to issue an annual report describing its efforts to educate consumers and enforce compliance—we’ve linked to it in one of this week’s stories below. In this report, you can find information on what drives complaints, why companies get put on notice, and so on. Extrapolating the information in this report out to the rest of the U.S. (and other jurisdictions covered by data privacy laws) can give you greater insight into what’s going on in enforcement across the wider data privacy world. 

Some highlights from this year’s report: 

• The Attorney General received 30 complaints in the first 6 months after the CTDPA went live. Primarily, these related to consumer privacy rights—especially the right to delete personal data. 
• However, a full third of these complaints were directed to entities exempt from the CTDPA (e.g. non-profits, entities subject to HIPAA, and so on). 
• The office issued 10 cure notices aimed at privacy policy deficiencies.  

Something else that the team at Osano noticed: one of these cure notices was issued to a car brand after privacy concerns were highlighted in the Mozilla Foundations's *Privacy Not Included. We talked about Mozilla’s report in a previous edition of Privacy Insider—in this instance, it looks like there was a pretty clear line between being called out for poor privacy practices and being investigated by data protection authorities. 

All of this is just to call out an opportunity to learn more about what goes on in enforcement beyond the big, seven-figure penalties that make headlines. There are a lot of smaller actions and steps before those penalties reach those stratospheric heights. 

Best 

Arlo 

P.S. Don’t miss out on next Thursday’s webinar on data mapping! Osano has partnered with KPMG to dive into what, why, and how of data mapping—register on the IAPP’s website here.  

Top Privacy Stories of the Week

UK Anti-Trust Regulator Says Google Cannot Phase Out Third-party Cookies Until Its Concerns Are Addressed 

The Competition and Markets Authority (CMA) has said that Google “cannot proceed with third-party cookie deprecation” until its concerns are resolved, sparking further uncertainty across the industry. The CMA’s concerns center on the Privacy Sandbox, Google’s attempt to enable data processing in a more private manner. Specifically, the CMA said that Google must not “design, develop or use the Privacy Sandbox proposals in ways that reinforce the existing market position of its advertising products and services, including Google Ad Manager." 

Read more

Attorney General Bonta Announces CCPA/CPRA Investigative Sweep 

California Attorney General Rob Bonta recently announced his office would be investigating companies with popular streaming apps and devices in order to assess their compliance with the California Consumer Privacy Act. Attorney General Bonta indicated that his office would be looking at whether or not these businesses complied with requirements around the sale/sharing of personal and the right of consumers to opt out of the sale of their data. 

Read more

Attorney General’s Report Highlights Connecticut Data Privacy Act Enforcement, Suggested Amendments 

Under the CTDPA, the Connecticut Attorney General is required to issue a report no later than February 1 listing various enforcement metrics. In this first CTDPA report, Attorney General Tong’s office listed and described complaints received, the nature of violations, cure notices issued, and more. Additionally, the Attorney General identified several ways in which the CTDPA could be strengthened.

Read more

Uber Fined €10 Million for Infringement of Privacy Regulations 

The Dutch Data Protection Authority (AP) is imposing a fine of €10 million on Uber after the company failed to disclose the full details of its retention periods for data concerning European drivers, failed to name the non-European countries in which it shares this data, and obstructed its drivers’ efforts to exercise their right to privacy. 

Read more

UK Data Protection Authority Cracks Down on Non-Compliant Websites and Cookie Banners 

Last November, the Information Commissioner’s Office (ICO) wrote to 53 of the UK’s top 100 websites, warning that they faced enforcement action if they did not make changes to advertising cookies to comply with data protection law. While most websites complied with the warning, the ICO affirmed that it would continue to seek out non-compliance, including through the development of an AI solution. 

Read more

Osano Blog: The New Jersey Data Privacy Act (NJDPA): The Basics 

They may not agree on whether it’s called Taylor Ham or a pork roll, but New Jerseyans do agree on data privacy. Find out all about the essentials of compliance with the New Jersey Data Privacy Act on our blog. 

Read more

If you’re interested in working at Osano, check out our Careers page!