Publishings Digital Citizen

Leading consumer privacy organizations in the United States write to express surprise and concern that not a single consumer representative was invited to testify at the September 26 Senate Commerce Committee hearing “Examining Safeguards for Consumer Data Privacy.”

The European Union's updated data protection legislation comes into effect in Europe on May 25, 2018. It gives individuals new rights to better control their personal information and strengthens some of the rights that already exist. Enforcement and redress mechanisms have also been strengthened to ensure that these rights are respected. And – importantly – the definition of personal data is wider in the GDPR than in the current EU legislation, and now includes online identifiers, such as an IP address. Read the summary of the eight rights here. The right to information to access to rectify to delete (or “to be forgotten”) to restrict processing to data portability to object to avoid automated decision making and profiling.

Consumer advocates, digital rights, and civil rights groups are calling on U.S. companies to adopt the requirements of the General Data Protection Regulation (GDPR) as a baseline in the U.S. and worldwide. Companies processing personal data* in the U.S. and/or worldwide and which are subject to the GDPR in the European Union, ought to: - extend the same individual privacy rights to their customers in the U.S. and around the world; - implement the obligations placed on them under the GDPR; - demonstrate that they meet these obligations; - accept public and regulatory scrutiny and oversight of their personal data practices; - adhere to the evolving GDPR jurisprudence and regulatory guidance (*Under the GDPR processing includes collecting, storing, using, altering, generating, disclosing, and destroying personal data.) Specifically, at a minimum, companies ought to: 1. Treat the right to data privacy as a fundamental human right. - This right includes the right to: + Information/notice + access + rectification + erasure + restriction + portability + object + avoid certain automated decision-making and profiling, as well as direct marketing - For these rights to be meaningful, give individuals effective control over the processing of their data so that they can realize their rights, including + set system defaults to protect data + be transparent and fair in the way you use people’s data 2. Apply these rights and obligations to all personal data including to data that can identify an individual directly and indirectly. 3. Process data only if you have a legal basis to do so, including - On the basis of freely given, specific, informed and unambiguous consent - If necessary for the performance of a contract 4. In addition, process data only in accordance to the principles of fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality/security. 5. Add extra safeguards, including explicit consent, when processing sensitive personal data (such as data about ethnic or racial origin, political opinions/union membership, data concerning health, sex life or sexual orientation, genetic data, or biometric data) or data that reveals sensitive personal data, especially when using this data for profiling. 6. Apply extra safeguards when processing data relating to children and teens, particularly with regard to marketing and profiling. 7. Be transparent and accountable, and adopt technical and organizational measures to meet these obligations, including - Provide for algorithmic transparency - Conduct impact assessments for high risk processing - Implement Privacy by Design and by Default - Assign resources and staff, including a Data Protection Officer - Implement appropriate oversight over third party service providers/data processors - Conduct regular audits - Document the processing 8. Notify consumers and regulatory authorities in case of a breach without undue delay. 9. Support the adoption of similar requirements in a data protection law that will ensure appropriate and effective regulatory oversight and enforcement for data processing that does not fall under EU jurisdiction. 10. Adopt these GDPR requirements as a baseline regardless of industry sector, in addition to any other national/federal, provincial/state or local privacy requirements that are stricter than the requirements advanced by the GDPR.

The European General Data Protection Regulation (GDPR) will take effect May 25, 2018. The Trans Atlantic Consumer Dialogue (link is external) (TACD), of which CDD is a member, published a document detailing 10 things that US citizens and companies need-to-know about the forthcoming General Data Protection Regulation (GDPR).

In an open letter to Facebook's CEO Mark Zuckkerberg, members of the Transatlantic Consumer Dialogue urge the company "to confirm your company’s commitment to global compliance with the GDPR".

Today’s political candidates and issue campaigns are fully integrated into the growing Big Data marketing infrastructure, with more and more companies in this sphere accelerating the pace of research and innovation and promising to transform how political campaigns and elections are conducted. Data management platforms, marketing clouds, and other new data services enable information about one’s finances, health, race, ethnicity, shopping behavior, and geo-location to be combined with political interests, reading habits, and voting records. Social media and digital platforms are facilitating many of these techniques, monetizing and normalizing “fake news,” “dark posts”, and other practices, and challenging fundamental principles such as privacy, data protection, and individual autonomy. It has been widely reported that political Big Data digital micro-targeting played a role in the election of President Trump as well as the Brexit vote in the UK, and is now the subject to growing scrutiny by regulatory authorities. Is the use of such technologies likely to cause harm and undermine the democratic process? What is the link between these technologies and fake news? How do policy frameworks in western democracies compare, in terms of controlling political election campaigns practices? What is the role of data protection legislation in protecting the privacy of voters? And what are the challenges for data protection authorities in addressing how commercial data can be sold or shared with political groups? --- Chair: Paul-Olivier Dehaye, PersonalDataIO (CH) Moderator: Anna Fielder, Transatlantic Consumer Dialogue (UK) Speakers: Michael McEvoy, Office for Information and Privacy Commissioner of British Columbia (CA); Irina Vasiliu, DG Justice, European Commission (EU); Jeffrey Chester, Center for Digital Democracy (US); Juhi Kulshrestha, Hans Bredow Institute for Media Research (DE)

The phone and cable lobby will use its new power over the Internet to further erode the privacy rights of Americans. Comcast, AT&T, and Verizon will be entirely free to tap into the data flowing from our mobile devices, PCs, gaming and streaming platforms and set-top boxes. These ISP giants have already built up a formidable (link is external) commercial data gathering and Big Data analytics infrastructure. Now they will expand their gathering of our personal information, inc. financial, health, media use, and also force competitors to share the data they collect. If you want ISPs to give you preferential treatment, content providers will be forced to give up your data, so phone and cable can further expand their ad revenues. Independent and small content companies—including non-commercial and diversely-owned services—will be pressed to consent to terms that favor the digital gatekeepers that control our broadband highway. The FCC’s Net Neutrality decision will trigger a powerful wave of consolidation and deal making that further reduces the range of content and services we should expect in the 21st Century (including for children). We also believe that Google, Facebook and other providers will likely make their peace with the big ISPs, creating a powerful alliance that controls the U.S.’s digital destiny. CDD will be a part of the collaborative work to address this. We urge everyone to also “follow the data” as they examine the digital marketing plans of Verizon, Comcast and AT&T (link is external). There they will find plenty of opportunity to educate the public about our digital future has been placed at great risk.