Category: Government Regulation, Legislation & Enforcement

1
California’s answer to the GDPR – the California Consumer Privacy Act kicks in on 1 Jan 2020
2
Double-Edged Sword: Cambridge Analytica Whistle-Blower exposes the dual nature of Technology
3
The FBI understands if you pay ransom to cyber hackers, but isn’t too pleased about it
4
Hand Out of the Cookie Jar: CJEU Issues Long-Awaited Decision on Cookies
5
Brexit: Deal or No-Deal? Data is the Question
6
Technology mightier than the Sword: US Military’s Secret Cyber Strike stifles Iranian Forces
7
AI (Adverse Inferences): AI Lending Models may show unconscious bias, according to Report.
8
Uniformity of Law: NSW Government opens consultation to consider making Data Breach Reporting mandatory in respect of State Government Agencies
9
Not just for jilted ex-lovers: The criminalisation of the non-consensual distribution of intimate images in WA
10
Facial Recognition Technology – Good or Bad?

California’s answer to the GDPR – the California Consumer Privacy Act kicks in on 1 Jan 2020

By Cameron Abbott ,Tan Xin Ya and John ReVeal

In just a short few weeks, a monumental change of privacy regulations will kick in for US businesses. On 1 January 2020, the California Consumer Privacy Act (CCPA) will come into effect, with a compliance deadline at the end of January 2020, and signifies a shift in tone in the privacy sphere for the US – with a move closer to global privacy norms, and away from the perspective that personal data is a company asset.

A series of data disasters such as Facebook’s Cambridge Analytica scandal and the massive Equifax breach left many Americans feeling powerless. Regulators stepped in after the fact to punish the companies, but at the time, there was little that U.S. consumers could do to prevent data breaches. Under the CCPA, Americans (well, Californians, mostly) move a step closer to general privacy protection. However, the Act only targets larger companies or those with prolific data use so there is still a long way to go to being general protection.

In October, the California Governor signed five bills to amend CCPA to provide some regulatory relief for businesses when the CCPA comes into effect. For a detailed analysis on the amendments, we refer you to Volume 2 of our colleagues’ Volume 2 of The Privacists available at the K&L Gates Hub.

Double-Edged Sword: Cambridge Analytica Whistle-Blower exposes the dual nature of Technology

By Cameron Abbott, Max Evans and James Gray

In his cautionary tale, 1984, author George Orwell spoke of a paradigm where the unregulated use of powerful technology, referred to as “telescreens”, manifested a society beholden to the ethics of the controller. This paradigm is perhaps more real than ever, according to an article by Reuters

By exploring the views of Cambridge Analytica whistle-blower Christopher Wylie, the article advises that the deep, multifaceted involvement of big tech companies in consumers’ lives, the ultimate dependence that arises from such involvement and the overwhelming vulnerability of such consumers renders tech companies “too big to fail”. Wylie argues that the vast imbalance of power and information in favour of these companies over users is resulting in a constant scrambling by regulators to control the rapid adoption of such technology forms.

Read More

The FBI understands if you pay ransom to cyber hackers, but isn’t too pleased about it

By Cameron Abbott and Karla Hodgson

While the FBI won’t be impressed if you pay ransomware demands in order to get your systems or data back after a cyber attack, its updated ransomware guidance contemplates that this might just be the outcome of an attack anyway.

Read More

Hand Out of the Cookie Jar: CJEU Issues Long-Awaited Decision on Cookies

By Cameron Abbott and Max Evans

Earlier this month, the Court of Justice of the European Union (CJEU) issued a long-awaited decision with respect to the requirements necessary for entities to satisfy in order to attain the valid consent of a user to the use of cookies to track and analyse his or her personal information.

Read More

Brexit: Deal or No-Deal? Data is the Question

By Cameron Abbott and Max Evans

With the Brexit deadline looming as 31 October 2019, and no finalised deal in place, the prospects of an inconclusive Brexit are growing. Therefore, there remains significant uncertainty as to the actions and preparations of entities who are subject to the unpredictable tides of this political sea. So how should such companies prepare in these circumstances of a foreseeable no-deal? Our colleagues have tackled this challenging question in Volume 1 of The Privacist available at the K&L Gates Hub.

Technology mightier than the Sword: US Military’s Secret Cyber Strike stifles Iranian Forces

By Cameron Abbott and Max Evans

Everyone knows the saying “the Pen is mightier than the sword”. The famous saying has been used for centuries to describe the ultimate power of words and communication over forms of violence. However, the rapid implementation and use of technology as a “combat” method doubts whether this saying is correct in a modern technological era, and begs the question as to whether technology is in fact mightier than the sword!

This dilemma is highlighted through the recent cyberstrike conducted by the United States. According to a Report by the Washington Post, in June of this year the Cyber Command of the US Military utilised a technology cyberstrike to target a significant Iranian database in the Persian Gulf. The relevant database was alleged to have been used by the IRGC, Iran’s elite paramilitary force, to damage oil takers and shipping traffic in the Persian Gulf. According to the Pentagon, the operation was in the works for weeks after Iran’s alleged attacks on two US tankers in the Gulf of Oman earlier in June, and following an attack by Iranian forces on an unmanned U.S. Surveillance drone hours earlier, the cyber-strike was immediately given the go-ahead.

Read More

AI (Adverse Inferences): AI Lending Models may show unconscious bias, according to Report.

By Cameron Abbott and Max Evans

We live in an era where the adoption and use of Artificial Intelligence (AI) is at the forefront of business advancement and social progression. Facial recognition technology software is used or is being piloted to be used across a variety of government sectors, whilst voice recognition assistants are becoming the norm both in personal and business contexts. However, as we have blogged previously on, the AI ‘bandwagon’ inherently comes with legitimate concerns.

This is no different in the banking world. The use of AI-based phishing detection applications has strengthened cybersecurity safeguards for financial institutions, whilst the use of “Robo-Advisers” and voice and language processors has facilitated efficiency by increasing the pace of transactions and reducing service times. However, this appears to sound too good to be true, as according to a Report by CIO Drive, algorithmic lending models may show an unconscious bias.

Read More

Uniformity of Law: NSW Government opens consultation to consider making Data Breach Reporting mandatory in respect of State Government Agencies

By Cameron Abbott, Warwick Anderson and Max Evans

We have blogged numerous times on the notifiable data breach scheme provided for in Part IIIC of Privacy Act 1988 (Cth) including more recently in relation to its success in assisting the preparedness of the health sector to report and respond to data breaches.

Whilst the NSW Information Privacy Commissioner recommends that public sector agencies notify it and affected individuals where a data breach creates a risk of serious harm, neither NSW privacy laws nor the notifiable data breach scheme require public sector agencies in NSW to provide such notification. There are many reasons for state government agencies to mandatorily report data breaches. Informing citizens when privacy breaches occur provides an opportunity for individual protection against potentially adverse consequences, whilst mandatory data breach reporting would address the current under-reporting of data breaches in NSW, which according to the consultation may be the norm.

Read More

Not just for jilted ex-lovers: The criminalisation of the non-consensual distribution of intimate images in WA

By Cathryn Palfrey and Esther Power

This week marked the conclusion of the first prosecution under the Criminal Law Amendment (Intimate Images) Act 2018 (WA). Mitchell Joseph Brindley, 24 years old, pleaded guilty to posting ten intimate images of the woman he dated. The images were taken with the woman’s consent whilst they were in a relationship. When it ended, Mr Brindley created fake Instagram accounts under her name and posted the images without her consent.

Non-consensual intimate image dissemination is colloquially known as ‘revenge porn’. A study in 2017 found that 20% of Australians between the ages of 16-49 years had a picture or video of themselves shared without their consent.

A global movement has emerged to counter the surge of ‘revenge porn’.

Read More

Facial Recognition Technology – Good or Bad?

By Cameron Abbott, Michelle Aggromito and Jacqueline Patishman

As of June 2019, law enforcement agencies are working with the city of Perth in running a 12-month trial in the use of facial recognition software. The trial involves the installation of the software in 30 CCTV cameras and is part of the Federal Government’s Smart Cities plan, which was created with the aim of increasing interconnectivity and building intelligent, technology-enabled infrastructure throughout Australia.

Read More

Copyright © 2019, K&L Gates LLP. All Rights Reserved.