Privacy Insider Newsletter: June 8

Welcome to Privacy Insider, a round-up of the week's most important stories.

Second, today, Colorado passed its privacy law. The bill needs a signature from the state’s governor, but he isn’t expected to veto it. Here’s what you need to know about the bill: 

• It looks similar to California’s new privacy law, the California Privacy Rights Act (CPRA). 
• It includes a Global Privacy Control provision, which would allow Colorado residents to opt out of personal data processing.
• It requires consumers to opt in before companies can collect “sensitive” personal data.
• It allows the Colorado attorney general to enforce the law and to start issuing guidance in 2025. 
• It requires data protection assessments where data processing could present a heightened risk to consumers. 
• It does not include de-identified or pseudonymous data within the definition of “personal data."
• It does not include a private right of action as a consumer remedy, unlike the CPRA. 
  
  

The bill passed the Colorado Senate just a few hours ago, so lawyers and pundits are still gathering their thoughts on its implications. I’ll have more extensive coverage of what the law requires at Osano.com tomorrow, but for now, see The Denver Post’s coverage at story #2 below. 

Enjoy reading, and I'll see you next week!

1. European Commission issues new standard contractual clauses

   Last Friday, the European Commission finally published its new terms for standard contractual clauses (SCCs). Ever since the Commission canceled the Privacy Shield as a data-transfer mechanism, companies transferring data out of the EU and into another jurisdiction have nervously waited to hear what kind of requirements they’d need to include in contracts with data importers or subprocessors. Here is a look at some of the significant changes from what used to exist to now. 
   Read Story 

   2. Colorado passes comprehensive privacy law

   On Tuesday, June 8, Colorado’s Senate approved a bill giving state residents rights over their data. The Colorado Privacy Act, or SB21-190, now goes to the governor’s desk for signature. The law goes into effect in July 2023 and would allow Coloradans to use a global privacy control browser setting to opt-out of data collection on all websites, The Denver Post reports. 
   Read Story

   3. Apple’s push to make privacy its competitive advantage

   Apple announced new versions of its operating systems this week, “which showed that the company’s focus on privacy has taken a new turn,” CNBC reports. While Apple has made strides to come across as the most privacy-focused tech company, its latest app and feature unveiling at the World Wide Developers Conference indicated that “Apple’s privacy strategy is now part of its products.”  
   Read Story

   4. TikTok’s change to US privacy policy allows it to collect biometric data

   TikTok made changes to its U.S. privacy policy to notify users that, in the future, it might collect their biometric information. But the company hasn’t responded to media questions about the changed policy, which says TikTok may collect users’ faceprints and voiceprints. When The Verge inquired, the company said, “As part of our ongoing commitment to transparency, we recently updated our Privacy Policy to provide more clarity on the information we collect,” The Verge reports. 
   Read Story