Regulatory

The Irish Data Protection Commission (DPC) has determined that Meta Ireland infringed Article 46(1) of the GDPR when it “continued to transfer personal data from the EU/EEA to the USA following the delivery of the CJEU’s judgment in Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems.” The DPC has given Meta Ireland 6 months to find a solution. This is just enough time to create the possibility of a road forward; a possibility which is contained primarily in the effective implementation of proposed European – U.S. Data Privacy Framework on the part of the U.S. and the EU.

This resource page is a curated list of WPF public comments to agencies, as well as other public comments focused on privacy.

Comments on EASA –The World Privacy Forum submitted comments today on the European Advertising Standards Alliance’s Best Practice Recommendation on Online Behavioural Advertising. Our comments focus upon three key areas: First, the EASA recommendation fails to recognize the protection of consumer privacy in Online Behavioral Advertising (OBA) as a key policy goal. Second, the recommendation’s protections are narrow, creating illusory protections for user privacy, whether or not they opt out of OBA. Finally, we critique the oversight and compliance mechanisms, which are not likely to foster consumer confidence nor police the industry. Drawing upon the WPF’s 2007 report, The NAI: Failing at Consumer Protection and at Self-Regulation, the comments argue that EASA’s approach suffers from the same weaknesses as self-regulatory approaches deployed in the United States, and that European lawmakers should not replicate the failed American approach. Law students from the Samuelson Law, Technology & Public Policy Clinic helped draft the comments as part of an ongoing project on consumer privacy and OBA.

Department of Commerce and Safe Harbor — New Report The World Privacy Forum published a new report today that evaluates the US Department of Commerce’s work on privacy protection for consumers, given its role overseeing such critical programs as the US/EU Safe Harbor data agreement. The report, The US Department of Commerce and International Privacy Activities: Indifference and Neglect, identifies a number of issues of concern regarding the Department’s privacy programs, most particularly, the current Safe Harbor framework. The report’s analysis find that three separate studies consistently show that many and perhaps most Safe Harbor participants are not in compliance with their obligations under Safe Harbor.

Genetic non-discrimination regulations (GINA) — The World Privacy Forum filed comments on proposed regulations for implementing Title I of GINA, the Genetic Non-Discrimination Act. The WPF requested a change to the proposed regulations, asking the Department of Health and Human Services require immediate posting of revised notices of privacy practices on the web sites of affected health plans. Under the proposed regulations, written notice of revised privacy practices to individuals could be delayed due to the cost of postal mailing. The WPF noted that a revised privacy notice posted on a health plan’s web site would not incur postal costs, and that regulated entities should take this minimum step to inform consumers of any changes regarding privacy practices affecting genetic non-discrimination.