We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
Sometimes the most interesting things that emerge from
conferences are whispered across the aisle just after a
presentation or debated by attendees off-site over a glass or two
of wine.
The big-ticket question at last week's IAPP Europe Data
Protection Congress in Brussels wasn't on the agenda: Will
members of the European Parliament and the European Council manage
to bridge their differences and pass a new Data Protection
Regulation amidst significant competing pressures from various
stakeholders?
A new Regulation (to replace the 1995 Directive) was announced
by the European Commission in January 2012. (Our summary of the
Regulation can be found
here). European legislators originally estimated that the new
Regulation could be passed as soon as the middle of 2013 (to be
followed by a two year implementation period). Jan Philipp
Albrecht, a Member of the European Parliament and champion of the
Regulation, conceded last week that the end of 2013 might be more
realistic. However, none of the government speakers whose sessions
I attended considered a scenario where the Regulation simply
wasn't adopted for lack of sufficient consensus on its
substance.
Some members of the audience, however, noted the deep fault
lines that were evident between the views of various speakers on
issues ranging from questions of power-sharing among national
governments (specifically, the potential loss of power of certain
"stricter" national data protection offices under the
"one stop shop" system) to widely varying assessments of
the practical and economic burden that the Regulation would place
on businesses (will businesses flee Europe due to increased
compliance costs and the threat of substantial fines, or will
customers be so enamoured of European-style privacy that they will
flock to companies that adhere to the Regulation?).
Testing which way the wind is blowing – and how fast
– is always a tricky proposition. But my overall sense from
the recent Congress is that the Regulation will pass –
eventually, and probably not in 2013 — in a form that retains
the proposed fines (enthusiastically endorsed by several government
speakers), breach notice requirements (with more realistic timing
than the current proposal of 24 hours), and expanded notion of what
constitutes personal data (everything you've ever posted on the
Web?). But some of the items that largely didn't even reach the
agenda at the Congress, such as the logistically challenging
"right to be forgotten" and the "right of
portability," may not make it through the legislative process,
or may survive in an industry-specific form.
Watch this space. But in the meantime, if you are a tech
company, keep on developing those privacy compliance products. More
than a few were already being promoted last week at the Congress.
And that may be the best predictor that we have.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
The 2010 theft of an unencrypted laptop containing confidential health care information made front-page news in 2013, not because a huge number of patients were affected, but for the exact opposite reason.
Identity theft is a serious threat. In 2012, more than 12.6 million adults became victims of identity theft in the U.S.1 And the costs have been astronomical.
On April 22 Verizon released its 2013 Data Breach Investigations Report (DBIR), which has since 2008 become a leading annual survey of data breaches, with participants across the globe.
Increasingly, privacy is a big concern in app development. California and other jurisdictions are ramping up enforcement efforts around existing privacy laws.
Understanding the complexities of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules is often a challenge for health care providers and consumers.
Any company that collects personal data from consumers should take proactive steps to have appropriate legal counsel review its data security practices, as well as its terms of service or privacy practices, to identify any potential problem areas.
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published on its website a series of factsheets designed to educate consumers unfamiliar with their rights under the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy and Security Rules.
FTC On The Prowl, And Businesses Looking For Guidance On New COPPA Changes
