Ask just about anyone who has been in the privacy game for a minute, and they’ll probably tell you 2019 was just absurd. I know for myself, it was my busiest year on record. The news just would not stop coming. It was an onslaught!
Of course, much of that was thanks to newly passed or soon-to-be-passed legislation. The EU General Data Protection Regulation coming into force in 2018 changed the rules, and the most-read news stories in The Privacy Advisor reflect that.
Once companies could be penalized with massive fines from European data protection authorities, the anticipation built to a crescendo over who would be the first to get fined and whether they’d get a slap on the wrist or it would be the kind of severe warning heard 'round the world.
Regulators have been promising for some time that the fines are coming and have asked — by explaining the intricacies and complications of due process under the GDPR — that the public be patient with them. As Irish Data Protection Commissioner Helen Dixon said back in May: They "certainly can't be done overnight. Enforcement is coming, but it takes time."
But while the world waited for the EU to act, the U.S.’s de facto privacy regulator, the Federal Trade Commission, made news of its own when in July it fined Facebook a record-breaking $5 billion over violations of its consent decree with the company. Later in the year, it would again break records by settling with YouTube over alleged violations of the Children’s Online Privacy Protection Act. In the settlement, Google was ordered to pay a record $170 million. Given concerns about whether the fine and settlement were severe enough, it's no surprise that the stories on both were two of your most-read stories in The Privacy Advisor this year.
Beyond regulatory and enforcement news, it's clear you all are using Advisor to find answers to the practical, operational questions you might have. And that's great news to me, because that's what we aim to do with The Privacy Advisor: Give you news that will help you do your daily job better. The numbers indicate you're most interested in stories on cross-border data transfers (specifically, what the "Schrems II" case might mean for their future) how to operationalize the now-mandated data protection officer, and (gulp), what constitutes a "sale" under the provisions of the California Consumer Privacy Act.
Finally, we'd be remiss not to recall the passing of European Data Protection Supervisor Giovanni Buttarelli this year, a loss felt around the globe.
Below, here are some of your most-read stories of 2019. Read the ones you missed; brush-up on the ones you've already consumed. Think of this list as a yearbook of sorts.
Here's to what is sure to be a wildly active year in privacy yet again. To 2020!
So the fine is $5B; does that change anything?
Ever since news leaked that the U.S. Federal Trade Commission had fined Facebook $5 billion over violations of its 2011 consent decree with the agency, the Twitterverse went into a tizzy. There were those who cited it was the highest privacy enforcement fine in the FTC's history, and there are those who said $5 billion is a drop in the bucket to a company as rich as Facebook and therefore indicates a failure on the FTC's part to enforce consumer privacy.
At CJEU hearing on 'Schrems II,' concerns over ruling could be sweeping
The Court of Justice of the European Union July hearing in case 311/18, also known as "Schrems II," stretched arguments to the limit. Reactions after the fact included concerns that the court's ruling in 2020 could take down both standard contractual clauses and the Privacy Shield, too, leaving companies' abilities to make global data transfers in a bind.
Dixon, Denham hint at sanctions coming soon
It was clear from the keynote stage at the IAPP Global Privacy Summit 2019 in Washington that it wasn't the first time Irish Data Protection Commissioner Helen Dixon had heard the question: When are you going to issue a fine? Dixon and fellow regulators Elizabeth Denham from the U.K. Information Commissioner’s Office and Head of the Austrian Data Protection Authority Andrea Jelinek discussed their priorities as enforcers, as well as the much-anticipated question: When are those sanctions coming?
The privacy and antitrust worlds are starting to intersect
Those who have been paying attention to the antitrust world recently may have spotted a trend: Competition regulators are getting very interested in the data that large tech companies, in particular, collect, store and analyze. The biggest tech firms acquire data any which way they can, and once they have a sufficient amount, it puts them in what may be an unassailable position. Here's a look at how the privacy and antitrust worlds are starting to cross over.
The struggle can be real in getting hired in privacy today
Finding the job of your dreams or even one tangentially related to your field can be emotionally exhausting, and privacy professionals are no exception to this general rule. But the added complication for privacy pros is that they also must navigate a field that is still relatively new, which means the organizations that need them are still working out the kinks internally. Here are some insider tips on finding a job in the privacy industry from three different perspectives: the candidate, the recruiter and the person who signs off on the hiring.
Navigating disclosures of 'sales' under the CCPA
The requirements of the California Consumer Privacy Act enter into force Jan. 1, 2020, and impose an array of requirements on companies that are subject to the law. Among them are obligations related to the sharing of “personal information” that obligate businesses to push down contractual limitations on service providers and other recipients of personal information and to offer California “consumers” the right to opt out of disclosures that qualify as a “sale” as that term is broadly defined under the CCPA.
FTC touts historic COPPA settlement as 'game changer'
In September, the U.S. Federal Trade Commission heralded its settlement with Google and its subsidiary YouTube as a historic moment and a "game changer" for enforcement under the Children's Online Privacy Protection Act. At a news conference, FTC Chairman Joseph Simons said the $170 million fine is "three times larger than any privacy penalty assessed against Google anywhere else in the world, and it is 10 times larger than the civil penalties we have obtained in all of our 31 prior COPPA cases combined."
The DPO must be independent, but how?
The EU General Data Protection Regulation requires certain organizations to appoint a data protection officer. The DPO must be involved in all issues concerning the protection of personal data in an organization at the earliest opportunity, but they may be internal or external. Due to the critical role they play, the GDPR requires that the DPO is allowed to exercise their functions independently. Here's a closer look at the responsibilities of the DPO and why it's important for them to operate in an independent manner.
Giovanni Buttarelli, 1957–2019
European Data Protection Supervisor Giovanni Buttarelli died in August. He was 62. Buttarelli, who was a leading figure in European data protection, was appointed to his role as EDPS Dec. 4, 2014. Here, privacy leaders from around the world remember him.
Photo by Luis Villasmil on Unsplash
