A little privacy: week of June 21

–

USA

FTC cracks down on the sharing of sensitive HeALTH data without consent

Last week, the FTC entered into a settlement with Flo Health, makers of the Flo Period & Ovulation Tracker app. The FTC had alleged that the company shared sensitive health data from app users with marketing and analytics firms, including Facebook and Google. Now Flo Health must obtain affirmative consent from app users before sharing any personal health info with others. 

–

Europe

a formal investigation of Google’s ad business 

The European Commission opened a formal investigation into “possible anticompetitive conduct” by Google’s online advertising business. What does that cover? Restrictions on other companies’ ability to access user identity and behavior data that Google’s ad business has available to itself, Google’s deprecation of the third-party cookie, and Google’s plans to stop making the Android adID available to third parties when a user opts out of personalized advertising.  

The European Data Protection Board issued final recommendations for data transfers to third countries. This includes modifications addressing the importance of examining the practices of third-country public authorities, as well as the possibility of considering the practical experience of the importer in the data exporter’s assessment. 

–

Global

Privacy heats up in Canada and South Africa

The Ontario, Canada Ministry of Government and Consumer Services (MGCS) issued a proposal for public comment to establish “comprehensive, up-to-date rules” to protect privacy rights. This includes proposals regarding user rights, automated decision making, enhanced consent, transparency, and children’s data. Comments on the proposal are accepted through August 3, 2021. 

The South Africa Information Regulator issued several statements this week in advance of the Protection of Personal Information Act (POPIA) going into effect July 1, 2021, including guidance on exemptions from the conditions for lawful processing. 

–

Industry

Google and the third-party cookie

In case you somehow missed it, Google announced a delay of its deprecation of third-party cookies. Instead of January 2022, Google has postponed until late 2023 to give more time for the industry to adapt, as well as for “continued engagement with regulators.” Google says they aim to have key technologies for Chrome deployed by late 2022 so that the developer community can adopt them over a 9-month period. Third-party cookies will then be phased out over a 3-month period starting in mid 2023.