UK’s GDPR replacement bill consultations will focus on EU adequacy

Want to receive these weekly privacy recaps in your inbox? Sign up for our privacy newsletter, A Little Privacy, Please.

UNITED STATES

Updated California Draft Regulations Released, Again

The California Privacy Protection Agency (CPPA) once again released updated draft regulations, this time in response to feedback from staff and board members resulting from the agency’s October 28 and 29 board meetings.

A new 15-day public comment period has commenced, with comments due November 21.

A board meeting originally scheduled for November 4 has been cancelled. 

TAKEAWAY

Among other changes, the updated regulations: added “clarity” of disclosures as a consideration in determining whether a purpose for processing is consistent with the reasonable expectations of a consumer, emphasizing the importance of disclosing purposes for processing to consumers in a transparent, coherent manner.

The regulations also added language to confirm that the application of the opt-out preference signal to “any consumer profile associated with a particular browser or device” includes application to pseudonymous profiles. 

Gameloft App Found by CARU to Violate COPPA

The Children’s Advertising Review Unit of BBB National Programs (CARU) announced its finding that Gameloft’s Disney Getaway Blast mobile app violated the Children’s Online Privacy Protection Act (COPPA) by failing to respect an age screen on the app, among other violations.

CARU discovered the violation by creating a test account identifying as a 10-year-old child, after which a prompt was generated by Apple’s App Tracking Transparency Framework to ask the “child” for permission to track activity across other companies’ apps and websites, without requiring parental consent.

CARU reported that Gameloft has made and is continuing to make corrective actions.

TAKEAWAY

COPPA allows certain “mixed audience” apps and services (directed to children under 13 but not as its primary audience) to age screen users and apply different privacy practices to children under 13 vs. all other users.

However, it’s important for services exercising this option to ensure that the age screen is working properly to ensure that personal information is not collected, processed, used or disclosed from children identifying in the age screen that they are under 13 without parental consent. 

EUROPE

UK Data Legislation to Undergo Additional Consultation

An official with the UK’s Department for Culture, Media and Sport (DCMS) reportedly confirmed that the Data Protection and Digital Information Bill, which was designed to replace the UK’s version of GDPR, will undergo further consultation in the coming weeks. Additional consultation will reportedly focus on ensuring adequacy with the EU.

The bill reached its second reading in the House of Commons last month, followed by a pause when Liz Truss was appointed as prime minister.

A spokeperson has reporteldy assured, however, that the new consultation will not be a formal public consultation and will not impact the bill’s timeline. 

TAKEAWAY

The bill was introduced in July 2022, shortly after the UK Government issued its response to a 10-week data protection consultation conducted in autumn 2021.

In its response, the UK government highlighted the UK’s EU data adequacy decision as one of three themes that emerged from stakeholder feedback in the consultation.

However, the resulting bill’s departure, in some respects, from the GDPR has caused some commentators to question whether the bill could threaten the UK’s adequacy decision. 

Want more of the privacy highlights that matter to adtech and martech? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.