Inside Privacy

> As long as the companies have the legal requirement to protect EU data in an equivalent way to an EU company, and there are legal routes to enforce it, I don't see anything particularly wrong about them in principle. But if there is US law which overrides that promise then it's not legally enforceable. That's why jurisdiction is so important. I'm not picking on the US particularly - I might have the same concern if I was an EU citizen and my data was in the UK post brexit. Or I was a US citizen with data aboard. > And storing data in AWS UK doesn't exactly get around that, because the US government can just force their UK subsidiary to exfiltrate the data. I'd agree even keeping it in the UK is now not a help from a US law perspective. The following case is very instructive: https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States Essentially the CLOUD Act - tries to give US government the right to demand US companies move data to the US - as I said - any promise a company makes is worthless. A lot of countries might see this as a the US trying to extend it's legal reach beyond what is reasonable. The EU say the CLOUD act is not compatible with GDPR without further international agreements. https://www.insideprivacy.com/data-privacy/european-data-protection-bo… Currently the EU is playing nice, but it could decide to then charge the US companies officers with crimes ( stopping them ever visiting the EU ), or investigate the…

If one can't countenance the US, then Australia would be off the table too because of their own US Cloud Act law, no? https://www.ag.gov.au/international-relations/international-crime-coop… https://www.insideprivacy.com/cross-border-transfers/australia-passes-…

The 9th circuit ruled the same way a few years ago: https://www.insideprivacy.com/data-privacy/ninth-circuits-interpretati…

Whether over months or years, they have certainly gotten worse. It is a race to the bottom or to 1 micrometer above the legal red line if one should ever be established. CFPB and FTC talked about it: https://www.consumerfinance.gov/compliance/circulars/consumer-financia… Summary of comparable talk in the EU: https://www.insideprivacy.com/eu-data-protection/the-eu-stance-on-dark… Down in the details, it looks like there has been enforcement in individual cases, but it obviously was not enough to stop the flood.

> Google: promises Google is not promising this out of the goodness of their heart. They're just getting ahead of what the EU is planning to mandate [0], and doing that to get some good marketing while they're at it. So, while Google's track record leaves a lot to be desired, in this, I think they'll keep their promise, either because they actually care, or because the EU will force them to. Either way, we, the end users, will benefit from it. And this will apply to all electronic device makers. That's probably why Samsung also increased their updates policy to five years as well. [0]: https://www.insideprivacy.com/cybersecurity-2/eu-publishes-draft-cyber… > "The requirements apply for the lifetime of a product or five years from its placement on the market, whichever is shorter."

Since CCPA was superseded at the ballot box by CPRA (2020 Prop 24), that would probably govern (basically the reason CPRA exists). - https://www.insideprivacy.com/ccpa/californians-approve-ballot-initiat… - https://ballotpedia.org/California_Proposition_24,_Consumer_Personal_I… - https://ballotpedia.org/Legislative_alteration

I'm pretty confident this is to comply with a recent EU ruling that held that EU antispam laws apply to display ads that look like an email in your inbox. In essence the left prompt is a marketing email opt-in, even if it doesn't look like one (nastier people than I would say it's disguising its true nature - not I, of course). Here's the CJEU case in question: https://www.insideprivacy.com/european-union-2/court-of-justice-of-the…

"To anonymize these datapoints, we run them through a hash function with a rotating salt. `hash(daily_salt + website_domain + ip_address + user_agent)`" Isn't this just PII with extra steps? OK it's at least better then the traditional approach. Keep in mind though that anonymizing is also a use of personal data in it self and requires a legal basis. https://www.insideprivacy.com/data-privacy/german-federal-commissioner…

Thailand has some new and strong privacy laws: https://www.insideprivacy.com/data-privacy/thailand-passes-personal-da…

GDPR, I think, is the root cause for the more complex PSD2 flow. https://www.insideprivacy.com/financial-institutions/overlap-between-t…

I've just read the article you linked[1], as well as several others [2][3][4] and cannot find any information about this: >all companies foreign or not must provide unencrypted access to data to the Chinese government and must do so in secrecy either plainly stated or implied. Can you provide a source for this claim? I don't doubt that this may occur, but I'd like to speak with _my own_ managers about my china & encryption concerns in an informed way. [1] http://www.xinhuanet.com/english/2019-10/26/c_138505655.htm [2]https://www.insideprivacy.com/data-security/china-enacts-encryption-la… [3]https://thediplomat.com/2019/10/decoding-chinas-cryptography-law/ [4]https://www.iflr.com/Article/3907570/PRIMER-Chinas-cryptography-law.ht…

I agree that the third party doctrine is a huge problem for privacy. We're making progress on that front: https://www.insideprivacy.com/data-privacy/supreme-courts-carpenter-de…

Definitely. Here is an example: https://www.insideprivacy.com/data-privacy/portuguese-hospital-receive… There are also many, many more examples for smaller companies that get fined 5000-20000.

The US government is pushing for stronger data retention laws here as well: http://www.insideprivacy.com/united-states/department-of-justice-calls…

I received four separate calls that “my social security number has been suspended for illegal activity” calls yesterday. The hammer just came down on the telco responsible.[1] That particular scam is on the list attached to the FCC's letter. Under the new administration, the FCC isn't fooling around. Here's what the FCC actually sent that telco: Federal Communications Commission Enforcement Bureau VIA CERTIFIED MAIL - RETURN RECEIPT REQUESTED To: Omar Luna CEO R Squared Telecom LLC 526 S Main St. Suite 802 Akron, OH 44311 [email protected] Re: Official Correspondence from the Federal Communications Commission Dear Mr. Luna, We have determined that R Squared Telecom LLC (R Squared) is apparently transmitting illegal robocall traffic on behalf of one or more of its clients. You should investigate and, if necessary, cease transmitting such traffic immediately and take steps to prevent your network from continuing to be a source of apparently illegal robocalls. As noted below, downstream voice service providers will be authorized to block all of R Squared’s traffic if you do not take steps to “effectively mitigate illegal traffic” within 48 hours, or if you fail to inform the Commission and the Traceback Consortium within fourteen (14) days of this letter (April 27, 2021) of the steps you have taken to “implement effective measures” to prevent customers from using your network to make illegal calls. In the original, "block all of R…

Consumer unfriendly behavior, your words, strongly suggests that it isn't a communications issue; rather it is likely a consumer affairs issue. https://www.ftc.gov/about-ftc/bureaus-offices/bureau-consumer-protecti… Specifically: https://www.ftc.gov/system/files/documents/public_statements/1212043/m… "A simpler consumer protection solution exists. Congress should fully repeal the common carrier exemption in the FTC Act, and enable both the FTC and FCC to protect consumers and the openness and innovation of the internet." https://www.insideprivacy.com/united-states/federal-trade-commission/f… "The FTC argued that if Congress really intended to divide jurisdiction along industry lines, it could have exempted from the FTC’s authority everything subject to the Communications Act or the Federal Communication Commission’s (FCC’s) jurisdiction."