Privacy & Information Security Law Blog

On August 26, 2020, as reported by Brazilian firm Mattos Filho, Veiga Filho, Marrey Jr. e Quiroga Advogados, the Brazilian Senate unexpectedly rejected the President’s Provisional Measure that was previously passed by the House of Representatives and aimed to postpone the applicability of the new Brazilian data protection law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”). The LGPD now will come into effect when the President signs the bill within 15 days of receiving the bill from Congress. The LGPD’s sanctions provisions, however, will continue to apply from August 1, 2021. The President also has issued a decree creating the new Brazilian data protection authority.

On August 27, 2020, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, the “Dutch DPA”) announced it approved the “Data Pro Code,” a code of conduct drafted by industry association NLdigital (the “Code”). This Code is the first code of conduct approved by the Dutch DPA under the EU General Data Protection Regulation (the “GDPR”). Adhering to the Code will help organizations active in the Information and Communications Technology sector comply with their obligations under the GDPR. The Code includes, among other things, a series of practical GDPR compliance tools, such as the “Data Pro Statement” that companies may use to inform potential customers of the data protection safeguards they have in place.

On August 25, 2020, Hunton’s Centre for Information Policy Leadership (“CIPL”) released a new paper entitled “Data Protection in the New Decade: Lessons from COVID-19 for a US Privacy Framework.” The paper examines how the COVID-19 pandemic has emphasized the need for a U.S. federal privacy law.

Apple’s iOS 14, which was announced by Apple in June 2020 and is scheduled for official release later this year, will require that all apps receive affirmative (i.e., opt-in) user consent to (1) access an iPhone’s unique advertising identifier (Identifier for Advertisers, or “IDFA”) or (2) to "track" users.

On August 20, 2020, Secretary-General of the Presidency of the Republic, Jorge Antônio de Oliveira Francisco, announced that the administrative decree to create the new Brazilian data protection authority (the Autoridade Nacional de Proteção de Dados, or “ANPD”) is ready and may be published at any time, after final technical adjustments are made. The Secretary-General made this statement during his remarks at the webinar “The ANPD: from the letter of law to the practice,” jointly organized by the Centre for Information Policy Leadership (“CIPL”) and the Centro de Estudos de Direito, Internet e Sociedade of Instituto Brasiliense de Direito Público (“CEDIS-IDP”) and hosted by the news channel JOTA.

On August 18, 2020, the U.S. National Institute of Standards and Technology (“NIST”) published a draft report, Four Principles of Explainable Artificial Intelligence (Draft NISTIR 8312 or the “Draft Report”), which sets forth four proposed principles regarding the “explainability” of decisions made by Artificial Intelligence (“AI”) systems.

The Age Appropriate Design Code (the “code”) created by the UK Information Commissioner’s Office (the “ICO”) has completed the Parliamentary process and was issued by the ICO on August 12, 2020. It will come into force on September 2, 2020, with a 12-month transition period for online services to conform to the code.

On August 14, 2020, the California Attorney General announced that the California Office of Administrative Law (“OAL”) approved the final regulations issued under the California Consumer Privacy Act of 2018 (“CCPA”) and filed them with the California Secretary of State. As we previously reported, the California Attorney General submitted the draft regulations to the OAL on June 1, 2020, and requested that the regulations become effective on the same day they are filed with the Secretary of State. The OAL has complied with that request, and the regulations go into effect ...

Earlier this year, The Retail Equation, a loss prevention service provider, and Sephora were hit with a class action lawsuit in which the plaintiff claimed Sephora improperly shared consumer data with The Retail Equation without consumers’ knowledge or consent. The plaintiff claimed The Retail Equation did so to generate risk scores that allegedly were “used as a pretext to advise Sephora that attempted product returns and exchanges are fraudulent and abusive.”

On August 6, 2020, President Trump signed executive orders imposing new economic sanctions under the International Emergency Economic Powers Act (50 U.S.C. § 1701 et seq.) and the National Emergencies Act (50 U.S.C. § 1601 et seq.) against TikTok, a video-sharing mobile application, and WeChat, a messaging, social media and mobile payments application. The orders potentially affect tens of millions of U.S. users of these applications and billions of users worldwide.