Enforcement updates
The Federal Trade Commission issued a fine of USD 150,000,000 on Twitter, Inc. for deceptively using users’ account security data for the purpose of targeted advertising. Twitter sought phone numbers and email addresses from its users to protect their account and allowed advertisers to use the data so collected to target specific users and thereby profit from it. Twitter’s actions violated a 2011 FTC order that prohibited Twitter from misrepresenting its privacy practices.
Belgian Data Protection Authority (DPA) imposed a fine of EUR 50,000 on Roularta Media Group for violating provisions of the GDPR following an investigation into the cookie management practices of the company’s website. The DPA concluded that the consent to processing of personal data using cookies on the company-operated sites were invalid. Roularta’s privacy policy also contained insufficient information on its use of cookies.
Italian DPA imposed a penalty of EUR 1,000 on Musicraiser S.r.l. for violating GDPR provisions on the right to object to the processing of personal data for direct marketing. The complainant stated that they continued to receive a newsletter after signing up on Musicraiser’s web platform despite requesting for cancellation. The DPA also warned the company regarding prompt exercise of data subjects’ rights.
Regulatory updates around the world
- Thailand’s Personal Data Protection Act 2019 entered into effect on 1st June 2022.
- Senate Bill for the New York Privacy Act amended.
- Maryland’s Act Concerning Data Privacy entered into effect of 1st June 2022.
Guidance updates
- Latvia’s Financial and Capital Market Commission developed recommendation for processing personal data in the field of preventing money laundering and terrorism.
- Thailand’s Ministry of Digital Economy and Society issued guidelines under Personal Data Protection Act 2019.
- Brazilian DPA released recommendations to the government on cookie collection practices as per General Personal Data Protection Law (LGDP).
US updates
- Telemedicine abortion organizations are strengthening privacy fearing digital surveillance after Roe v. Wade. Reports Politico
- Kentucky’s House Bill for the Genetic Information Privacy Act entered into effect on 1st June 2022.
UK updates
- Department for Digital, Culture, Media, and Sport began consultation on the Online Advertising Programme. Comments may be submitted before 8th June 2022.
- Central Digital & Data Office published its Data Sharing Governance Framework.
India updates
- Ministry of Electronics and IT released proposed amendment to IT Rules, 2021. Comments may be submitted in the next 30 days.
- Bangalore Metro Rail Corporation to reportedly replace smart cards and tokens with facial recognition technology in partnership with Google. Reports Hindustan Times
- SpiceJet faced attempted ransomware attack leading to delayed flights.
News around the globe
- Mastercard launched controversial Biometric Checkout Program that lets users pay by smiling.
- Singapore’s Personal Data Protection Commission launched a data anonymization tool.
- Chicago Public Schools reported personal data breach after five months of the incident.
Big tech updates
- Microsoft faces class action suit under Biometric Information Privacy Act for collecting facial scans of Uber drivers without consent.
- Google faces class action suit in UK for using medical records of 1.6 million individuals for its AI subsidiary, DeepMind. Reports ET CIO
Read our digital newsletter here.