According to research we conducted in late 2019, 80% of respondents have updated their organization’s privacy notice one or more times in the last 12 months.

Well, it’s time for the IAPP to do it, too.

We first conducted a major overhaul of our General Data Protection Regulation. Our goal was (and still is) to offer information to our members about what personal data we collect from them, under what circumstances and why in a way that embodied what the GDPR expects of data controllers.

ADVERTISEMENT

Cassie IAPP Leaderboard - Future-proofing your data, 2025 and beyond

Since that version, we have not necessarily engaged in many new data-processing practices. But we have continued to learn more about them. We have also paid attention to questions sent in by alert members who — as privacy pros will do — have been reading our privacy notice carefully either out of curiosity or when they have a specific question.

Here’s an example: When someone seeks to sit for one of the IAPP’s California Consumer Privacy Act, even though the IAPP (as a nonprofit with no shareholders or owners) is not a “business” under the CCPA. Many of our co-sponsors are businesses and wish to ensure the transaction is not considered a sale of data under the law.

  • Subscribers to the IAPP’s newsletters who are opted in to “marketing” cookies may notice that the IAPP keeps a record of when they click on a link in the newsletter and are directed to an article or white paper on the IAPP’s website. For those who are curious about this operation, we provided more detail.

    • This short summary does not do justice to the many hours that went into getting here today.

    Whenever someone writes to dpo@iapp.org with a question about our data-processing practices, we react with a sense of urgency and curiosity. Our members are often highly sophisticated and knowledgeable about privacy and data protection laws, so we are humble enough to admit we can always learn a thing or two. As well, we are aware that such questions provide us an opportunity to communicate internally, develop a deeper understanding of our own practices and perhaps even reach out to a data processor with questions and clarifications. This helps them learn, too.

    Sometimes input from our members results, after investigation and several meetings, in changes either in our practices or in our transparency about them. This, I think, is not an admission of neglect but just the opposite. Data privacy is not something achieved at a point in time, it is an ongoing and iterative process requiring cooperation and communication throughout the enterprise.

    What a pleasure it is to work with such privacy-dedicated colleagues — the IAPP team and all of you!