A little privacy: week of July 5

USA

COLORADO MAKES PRIVACY LAW OFFICIAL

The Colorado Privacy Act was officially signed into law this week, making Colorado the third U.S. state to enact comprehensive privacy legislation, just following Virginia. The law will take effect July 1, 2023. One notable provision for the advertising industry (effective July 1, 2024) obligates those who process personal data for targeted advertising or the sale of personal data to allow consumers to opt out through a “user-selected universal opt out mechanism” but allows consumer consent through a controller’s web page or app to take precedence over any universal opt out.

–

BIDEN SIGNS COMPETITION EXECUTIVE ORDER

U.S. President Biden signed an Executive Order, which, among other things, encourages the FTC to establish rules on surveillance and the accumulation of data, citing that “many of the large platforms’ business models have depended on the accumulation of extraordinary amounts of sensitive personal information and related data. The order also announces an administrative policy of greater scrutiny of mergers by dominant internet platforms “with particular attention to the acquisition of nascent competitors, serial mergers, the accumulation of data, competition by ‘free’ products, and the effect on user privacy”. 

–

Europe

ITALY RATIFIES DATA PROTECTION AMENDING PROTOCOL

Italy became the 12th state to ratify the Amending Protocol (Treaty No. 223) to the Council of Europe’s Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (Treaty No. 108), a multilateral treaty that promotes data protection policies among member countries. The Amended Protocol includes (among other things) enhanced requirements regarding transparency, data breach notification, data subject rights (particularly in an algorithmic decision making context), processing of sensitive personal data, accountability measures, restrictions on transborder flows of personal data and obligations concerning impact assessments and privacy by design and privacy by default. The Amending Protocol will come into force on October 2023 if at least 28 Parties have ratified it as of such date, or earlier if all Parties ratify it.  

–

UK ICO ANNOUNCES NEW GUIDELINES UNDER CHILDREN’S DESIGN CODE

The UK ICO announced this week that it is creating the first drafts of guidance to help designers comply with its Age Appropriate Design Code, which will be enforceable as of September 2, 2021 and covers data collection practices, among other things. They will be running workshops and seeking feedback over the next few weeks to test the draft guidance. According to the ICO, “If your online service is likely to be accessed by children under the age of 18, even if it’s not aimed at them, then you are probably covered by the code.”

–

–

UK GOVERNMENT PUBLISHES PLAN FOR ONLINE ADVERTISING ‘SAFETY’

Meanwhile, the UK Department for Digital, Culture, Media & Sport published a policy paper on its “Plan for Digital Regulation” and invited comments by September 28, 2021. The Plan includes an online advertising consultation in the next 6 months and an intention to legislate in the area of “Online Safety” (among others). With respect to the Online Advertising Programme, the paper says “The regulation of online advertising needs to reflect the evolving market and the expectations of consumers and businesses that platforms will take their own actions to stop misleading or harmful adverts. It should incentivise compliance, companies proactively reducing harm, and rapid remedial action when rules are breached.” The paper also stresses the importance of non-regulatory tools, such as industry-led technical standards, to complement or provide alternatives to traditional regulation.

–

INDUSTRY

LOW CONSENT ON APPLE SHIFTS AD SPEND TO ANDROID

Ad spending has shifted from Apple to Android since Apple started requiring apps to obtain user consent for tracking, according to research reported by the Wall Street Journal. The Journal reports that less than 33% of iOS users opt in to tracking and, as a result, prices for mobile ads directed at iOS users have declined, while prices for ads targeting Android users have risen. 

–