The Commonwealth of Virginia is on the verge of becoming the second state with a consumer data protection law. The Consumer Data Protection Act (“CDPA”), which awaits signature by Governor Northam (who is expected to sign the bill into law), would go into effect on January 1, 2023. Like California’s CCPA (and CPRA, also set to take effect January 1, 2023), the CDPA establishes a “comprehensive” framework for the collection and use of personal data of Virginia residents while also (and ironically) not applying to companies across the board. The CDPA would apply “to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.” Unlike CCPA, the CDPA does not contain an “annual revenue” threshold.
Continue Reading States Are “Stepping Up” to the Privacy Plate. Who’s Next? Virginia.
#dataprivacy
Key Takeaways from the Recent Grindr Decision and “Tentative” $11M Fine
By Céline Guillou on
Posted in data privacy, GDPR
Online advertising – or “adtech”, as it is often referred to – does not mix well with many privacy laws, beginning with the GDPR. In recent years since GDPR went into effect, privacy advocates have increased their demands on EU regulators to more deeply scrutinize targeting practices and how data is shared within the advertising ecosystem, in particular when it comes to real-time bidding (RTB). Complaints have been filed by many privacy-minded organizations, and all of them allege that, by its very nature, RTB constitutes a “wide-scale and systemic” breach of Europe’s privacy laws. This is because RTB relies on the massive collection, accumulation and dissemination of detailed behavioral data about individuals who use the internet.
Continue Reading Key Takeaways from the Recent Grindr Decision and “Tentative” $11M Fine
Voters Approve the California Privacy Rights Act: What Businesses Need to Know
By Chiara Portner on
Consistent with California’s history of prioritizing consumer privacy protections, Proposition 24 (full text here), a.k.a the California Privacy Rights Act (“CPRA”), was placed on the November ballot and handily approved by voters last week. The measure’s background itself indicates that the CPRA was being put forward to make privacy more transparent to users, similar to “ingredient labels on foods.” Background information also indicates a willingness to strengthen privacy rights over time rather than diluting them (particularly as regards to children), and in fact this push for increased transparency and protection is consistent with how certain platforms are requiring clearer policies (we discuss Apple’s new requirements here). While the CPRA will be fully effective and enforceable January 1, 2023, certain provisions take effect earlier and have a look-back provision. Businesses should start to familiarize themselves with the new or updated definitions and additional requirements contained in the CPRA.
Continue Reading Voters Approve the California Privacy Rights Act: What Businesses Need to Know