Observance of Data Privacy Week — which culminates with Data Privacy Day 28 Jan. — provides an opportunity to reflect and emphasize the growing need for privacy and data protection worldwide. The IAPP marked the occasion with a LinkedIn Live 22 Jan. that delved into what's behind those growing needs and what will keep privacy professionals busy in the coming months and years.
IAPP President and CEO J. Trevor Hughes, CIPP, hosted a roundtable discussion with Mastercard Chief Privacy and Data Responsibility Officer Caroline Louveaux, CIPP/E, CIPM, Cooley Partner Travis LeBlanc and IBM Chief Privacy and Trust Officer Christina Montgomery.
US musings
While there was consensus that a federal comprehensive privacy legislation from U.S. Congress is unlikely this year, panelists expect more states to add comprehensive privacy laws. Thirteen states have already enacted laws while New Hampshire is on the verge of joining the group.
IBM's Montgomery said with states continuing to add their own statutes, it could be difficult for businesses to adapt to each law and their unique provisions.
"I think we are kind of suffering a little bit from death by a thousand cuts," Montgomery said. "Which is the technical implementation requirements that companies are going to have to adopt to address all the nuances in every state privacy bill if it continues to play out the way it's playing out."
Artificial intelligence technologies are set to face heightened federal scrutiny, building off U.S. President Joe Biden's comprehensive executive order on AI issued October 2023, which directed federal agencies to enlist chief AI officers and laid out eight guiding principles and priorities for how AI systems should be developed and deployed.
Montgomery indicated there will be "a continued push" in AI legislation with several bills in the works, including the Artificial Intelligence Research, Innovation, and Accountability Act introduced by U.S. senators. The bill aims to improve accountability and ensure companies appropriately navigate risks when developing and using AI technologies.
Meanwhile on Capitol Hill, Section 702 of the Foreign Intelligence Surveillance Act — and privacy implications around its potential reauthorization — is an early 2024 priority for Congress. There is a possibility Section 702 is renewed on or before the April deadline with a requirement on the FBI and U.S. intelligence agencies to obtain a warrant before searching foreign intelligence databases for information related to U.S. residents. That same standard would not be applied to non-U.S. residents, which may create friction on EU-U.S. data transfers depending on the work of the U.S. Data Protection Review Court.
"Congress will have to take that up. That is a top priority for the administration," said Cooley's Leblanc, who also serves on the U.S. Privacy and Civil Liberties Oversight Board. "But because it is focused on government surveillance, I believe you can reasonably expect that any existing legislation around surveillance and government authorities, whether or not it's foreign intelligence surveillance, could end up being packaged with it together."
U.S. children's privacy issues will remain prevalent in 2024, highlighted by the ongoing lawsuit between the U.S. Federal Trade Commission and Meta over children's data. The FTC also proposed updates to the Children's Online Privacy Protection Act Rule in December 2023 with an eye toward stopping children's data from being monetized.
An expansion of children's privacy protections is also anticipated at the state level, with many state legislatures seeking to mimic the California Age-Appropriate Design Code Act despite its legal uncertainty.
"We're seeing a lot of activity continue around age-appropriate design laws," LeBlanc said. "We expect several of those to be passed throughout the year."
Panelists also expect privacy and data security enforcement efforts to strengthen in the U.S. this year. The FTC's recent orders against location data collection and use are examples, but the panel also called attention to the U.S. Securities and Exchange Commission's USD26 million fine against software company SolarWinds and its chief information security officer Timothy Brown.
"Last year they (the Securities and Exchange Commission) implemented the new cyber risk management rules that went into effect in December and will now apply to every single public company in the United States, " LeBlanc said. "The SEC is hot to trot on cyber these days, and I think they will almost certainly continue to be in 2024."
The EU digital rulebook's potential clout
The European Union's proposed AI Act may pass this year despite the potential pushback from some member states. The EU institutions reached a political agreement on the AI Act the 8 Dec. 2023 after the trilogue negotiations stretched for more than 32 hours. In addition to the AI Act, the EU will face an increase in policies coming into play in 2024 including the Digital Services Act, Data Governance Act, and Digital Markets Act. EU regulators will have to work together to confirm compliance with new policies.
"If you actually want this to be a success, they are going to have to find a way to collaborate with each other, and have consistent interpretations and enforcement," Matercard's Louveaux said.
Despite minor issues that could block the EU AI Act from passing, the panel believed it would pass regardless of additional features proposed. "I think that the EU has shown with DSA, DMA, DGA, GDPR, that it recognizes the political power of the EU regulatory engine," Hughes said.
With enforcement efforts and the advancement of AI, Louveaux said she expects the connection between sustainability and privacy to expand due to the EU's Corporate Sustainability Reporting Directive. The directive, which went into effect on 5 Jan., works to ensure investors are aware of corporations and their technology's impact on the environment, as part of the European Green Deal.
"A lot of our investors have started to ask questions about (environmental, social, and corporate governance). Sustainability and privacy come into play every single time," Louveaux said. "You may have heard about the EU's CSRD that has been adopted and companies — and not only privacy … companies — may be required to assess and report on the environmental impacts of data and AI activities."
