A multifacted week in privacy

Welcome to the Serious Privacy podcast, where Paul Breitbarth, Ralph O'Brien, and Dr. K Royal, discuss a week in privacy. We have some jucy news from Europe, New Jersey, and the United Kingdom. Tune in!

If you have comments or questions, find us on LinkedIn and Instagram @seriousprivacy, and on BlueSky under @seriousprivacy.eu, @europaulb.seriousprivacy.eu, @heartofprivacy.bsky.app and @igrobrien.seriousprivacy.eu, and email podcast@seriousprivacy.eu. Rate and Review us!

From Season 6, our episodes are edited by Fey O'Brien. Our intro and exit music is Channel Intro 24 by Sascha Ende, licensed under CC BY 4.0. with the voiceover by Tim Foley.

Transcript

Tim 0:53

You're listening to the award-winning Serious Privacy Podcast sponsored by Trust Arc. Please welcome your hosts, Paul Breitbart, Ralph O'Brien, and Dr. K Royal.

Paul 1:06

After celebrations last week, it's back to normal, and that means a week in privacy because even though summer has kicked in, still things are happening in data protection land. And we'll talk to you about that today. There is new legislation in the US, there is enforcement happening in Europe, even the EDPB telling member states to enforce, and the UK has a new government. So what else is there to talk about? My name is Paul Greitberg.

Ralph 1:31

My name is Ralph O'Brien.

K 1:33

And I'm K. Royal and well And I'm K. Royal.

Paul 1:38

Try that again.

K 1:39

And I'm K Royal and welcome to Serious Privacy.

Paul 1:44

You would think after 300 episodes you had that in the bag, but apparently.

Ralph 1:48

It's funny. After I haven't been on here for all 300 episodes, but every time I say at the start of a trading course, hi, I'm Ralph O'Brien, I always want to follow it. And welcome to Serious Serious Privacy.

Paul 2:00

No, you can because it's your company, so you can actually do that.

K 2:04

You can. And I did the same thing when I was being interviewed for a pageant podcast. She introduced herself, I said, and I'm K Royal. And it is not welcome to serious privacy. Okay, I have the unexpected question though, guys. What's the s I was gonna ask you, how would you bring sexy back, but we'll save that for another time.

Ralph 2:23

What do you mean bring it back?

K 2:25

You're like, it never left.

Ralph 2:27

Exactly.

K 2:28

What's the strangest talent you have?

Ralph 2:32

I don't have any talents. You don't have any talents. That's a lie, Paul. That's a lie. Right now, my my talent for filling air and making stuff up on the spot is failing me, I'll put it that way. I suppose not a lot of people know this, and I don't often go public with this one, but I will do. I was a club dancer when I was in my late teens. So I can dance.

Paul 2:53

I know you can dance because we danced together. Oh my god, we didn't we. There is even pictures of it. Yeah, we didn't we?

Ralph 3:01

That was in Jersey, wasn't it? It was, yeah.

K 3:04

When they can't dance together in Jersey.

Paul 3:06

At the GPA party.

K 3:08

But I was at the GPA party.

Paul 3:10

But you were not at the party. Because you were feeling unwell.

K 3:14

Oh, was this the after one rather than the before one? Got it. Yeah, I didn't go to that one. That was the one. That was the whole K's whole life flashed before her eyes, and she was, yeah.

Ralph 3:25

Yeah, and I suffered a tidy bit of verbal abuse.

K 3:28

Sorry.

Paul 3:31

So hidden hidden talents. I don't think I have hidden talents.

K 3:37

It said strangest.

Paul 3:40

Okay. Not sure if it's really strange, but making hot sauce, is that strange enough?

K 3:46

Making hot sauce?

Paul 3:48

Recipe for the cook basic basically just trying to make everything myself if I can, if I have the time.

K 3:57

And we'll have to make that anecdote in the cookbook that is in early draft.

Paul 4:03

Early production.

K 4:04

Early draft format. We have the placeholder.

Paul 4:07

Maybe reserve a spot under your cu in under your Christmas tree.

K 4:10

There you go. I like that. But when I first started in pageants, of course, there you don't do pat you don't do talents for my age, but often the judges will ask, What's your talent? And I had to think of what actual talent do I have other than always seeing the silver lining. Always seeing the silver lining. But it is I speak movie quotes. Being married to Tim, surrounded by his brothers, he corrupted my daughters. I now speak movie quotes. It's only a flesh wound.

Ralph 4:43

Indeed.

K 4:44

Indeed. And I've never seen the movie, but I know the stupid movies.

Ralph 4:47

You've never seen the movie.

K 4:48

No, I refuse to watch stupidity on that level. But my my my family does, and it's only a flesh wound. But yes, I know how to speak mov. Now I probably can't carry on an entire 20 minute conversation with movie quotes the way my husband can, but I can speak movie quotes.

Paul 5:06

You may very well think so, but I couldn't possibly comment.

K 5:11

There we go. Strangest talents we have. But I also hear, and this is a strange talent because we're all privacy people. That's strange in and of itself. What news do we have happening? By the way, let me say before we go into the news, let me say that with the the master's course that I'm taking, we have to do discussion boards every week. And I found the first week that my interpretation of a discussion board and my professor's interpretation of a discussion board were two separate totally separate. He considers it an academic writing, therefore you have to do sites and all of this stuff. And I'm like, what? Anyway, so this one we had to, and I forget what it was, but it was something about why is compliance so important nowadays and why do people need to stay current on developments? So I said, All right, uh I have to go personal here. We host a serious privacy podcast, and we're about to record our 300th episode. This is one way I stay current in my job on what's happening in privacy, because otherwise the teaching, the podcast, other than those two, I would be head down getting my work done without staying current on events because there's too many newsletters to pay attention to. There's too many sources to keep absolutely straight, and there's too much happening from one day to the next. One day you're telling your board of directors you have to do XYZ for Colorado, and then the next week they have new regulations. So, or for the first time, the EU delays enforcement of a major law that they've passed, which as far as I know has never happened before in my history. And so the Lord's going, oh, so they're delaying enforcement. So we don't ever have to worry about another EU law ever again because now they're going to start delaying them just like the US does. No, that's not how that works. So this podcast, as much as our listeners and our fans love it, keeps me sane and keeps me educated for my day job.

Ralph 7:13

Yeah, we have to do our research in order to be able to give the news to our wonderful provettes out there.

Paul 7:20

No, I fully agree because for me, that's also people ask me all the time, how do you manage all these different hats that you have? And my main answer is because everything cross-contaminates each other. If I read something for the podcast, I can use that same guidance for my main role. I can use it in my teaching, and questions I get in my teaching can come up in the podcast or enrich my work in my main role. So everything is tied together because it's all around the same topic.

K 7:51

Yeah.

Ralph 7:52

Talking of New Lords in America, shouldn't we talk about New Jersey, K?

K 7:57

Talk about New Jersey, because for some reason I have a feeling you think I actually did do research.

Ralph 8:02

Okay. Well, Kate is that.

K 8:04

Well, I'm pulling up New Jersey, and I was looking at it before it was passed. While while I pull up New Jerseys, we can talk about it or I can let y'all go talk about another one why why you get what I'm trying to say organize, but just to give you the overview of New Jersey's, they enacted it. We knew it was coming. It hasn't been surprising. But they're targeting data brokers and companies that sell or license consumer information. So it has strict bans on selling sensitive data. And their definition of sensitive data is the typical definition that you can expect in the United States now, which I believe does include data on miners. I think their language is on miners rather than from miners. So I'll see if I can look that up quickly. And there is a mandatory registry for data collectors with annual fees up to $1.5 million. And that's always going to be on your last annual report cycle is how you would interpret that. But violations is $50,000 per record. So this goes beyond the Illinois Biometric Information Privacy Act because that's $5,000, I think, per event or record. This is $50,000 per record. So it's pretty significant. The ban on sensitive data, you can't sell it or license it by any individual legal entity, regardless of whether you fall under the New Jersey Data Privacy Act or not. And every time I hear this, I wonder if our friend on Facebook was like cheering when they passed it. I'm pretty sure she was. They have a broker registry, which we all know the data broker registries don't necessarily work the exact way we want them to work, but it puts a foundation in place, and you're going to get some of them, and they're going to go after the ones that are reported to them that are not registered. And then for exemptions and amendments, the governor signed an amendment to the primary data privacy act taking effect immediately. It now provides new exemptions for HIPAA-covered entities, insurance support organizations, and approved human subjects research. So there's a lot more to the data. If you want to know, absolutely, we can cover it now. But this is the most important thing is the data broker law. And that's what we have. And we're very glad to have seen that passed and very good to see how it's going to work over the next few months. And then by the end of the year, like we do every year, we will give you an overview of all the state data privacy laws, data broker laws, any biometric laws that are put into place. We're going to get a little bit broader here in the United States for what we cover, but we'll make sure to give you a rundown at the end of the year like we normally do. Although last year or the year before, we really didn't have a whole lot to cover on new state privacy laws in the U.S. U.S. seemed to be much more obsessed with other things and not obsessed with privacy laws. And so maybe they're getting back into the swing of things.

Ralph 10:58

Yeah, it seems like you jumped up this year. Seems like we're getting a few more states passing laws when I'm just quiet.

K 11:04

We're up to 21 states now. Yes, I count Florida. We're up to 21 states now, but I think it's the data broker parts that that are starting to take off because people are starting to realize how very dangerous that is, but how dangerous it is to also sell or lease. I love that they threw lease in there, sale or lease data to other companies for their use.

Ralph 11:27

Beautiful. Wonderful. And before I jump in with about five or six little things, Paul, as I understand it, we've got EDPB news as well. Yes, we do.

Paul 11:37

We've got the EDPB calling for an amendment in the GDPR, a legal basis for cross-regulatory information sharing. So this would mean that also in joint investigations, for example, between a data protection supervisor and a consumer and markets authority, that it would be possible to share investigatory data or even other regulators, mainly focused on the European Union. I know that outside the European Union or for intra-EU, non-EU cooperation, there's a lot of memoranda of understanding already in place. But here also the DPAs conclude there is a considerable rise in the number and complexity of complaints. We also discussed that last week with Commissioner Dufrein. And this is placing additional strain on already stretched resources. So they would like to have more possibilities when it comes to cross-border enforcement to partner between DPAs, also with other supervisory authorities to make sure that actually the work gets done.

Ralph 12:40

I think we already have that in the UK. Because one of the things you can do is add in additional legal basis for significant public interest in your national law. And in the schedules of the 2018 Data Protection Act, we've got things that talk about regulatory breaches and exchanging information between public authorities. So it's interesting to see the EU as looking at that as for the whole of the EU, not just for in national laws.

Paul 13:05

Yeah, I think this is also on the operational side. If I look at the press release, one of the things that they would like to do is for some DPAs to make resources available to lead supervisory authorities where useful. So that could, for example, mean that the CNEL could send one of their tech experts to join an investigation of a smaller DPA. I think that's also the intention already in the GDPR that such partnerships are possible, but in practice it doesn't seem to be happening a lot yet.

Ralph 13:35

Okay, that's really interesting. Yeah, it's really interesting. Whereas here in the UK it's all changed. And yeah. Oh, there is more from Brussels, Ralph. Oh, there's more from Brussels? I apologize.

Paul 13:44

There is more from Brussels because the Belgian DPA has actually received a slap on the wrist from the EDPB and from its members. This goes back to one of the many complaints that NGO Noib, none of your business, filed related to cookie banners. And one of the complaints filed was related to the cookie banner of the Belgian, or I should say the Flemish, public broadcasting organization, VRT. That cookie banner would not be compliant. It was filed with the Austrian DPA on behalf of an individual. And the Austrian DPA then, of course, had to forward the complaint to the Belgian DPA as lead supervisory authority for the Flanders Broadcasting Organization. The Belgian DPA had decided that they considered this complaint, also given the total volume of complaints that NoIP filed related to cookie banners as abuse of the right to file a complaint and therefore refused to process the complaint and deal with its merits. The Austrians objected. The Belgians still didn't agree, submitted the case to the European Data Protection Board that has now decided, based on the relevant and reasoned objections process, that indeed the Belgian DPA should investigate this case on the merits. It may not dismiss the complaint as abuse or vexatious or anything similar, and they really need to look at it in substance. And I think that's the first that we've seen that the EDPB actually tells a national supervisory authority, no, this is something that you should investigate. I'm aware of multiple cases where we've seen an EDPB overruling a national DPA in their investigation, in their findings, in their conclusions, in their sanctions even. But I don't believe I've seen before that the EDPB tells the DPA, go and investigate this, because you cannot just dismiss this complaint.

Ralph 15:39

That's really fascinating. I thought so too, yeah. Yeah. Do you think it's a bit of a personal opinion? Do you think that's the way it should be, or do you think that's an overreach on behalf of the centralized EU authorities?

Paul 15:53

No, I think this is how it should be, because this is exactly why the system is there. We have a lead supervisory authority, but that doesn't mean that the lead supervisory authority is the master of everything in their domain. It's still one single European law to rule them all. And that means that there also needs to be some sort of consistency in the interpretation and application of the legislation. So that is why also the whole consistency mechanism was created with the possibility for other DPAs to raise relevant and reasoned objections and in the end to take a majority decision that a national DPA is wrong in its interpretation of the law. So for me, this is exactly how the system should work. I'm probably more surprised that it's taken ten years for this to happen.

Ralph 16:43

Yeah, yeah, I would agree, actually. Yeah, no, I would agree. But we have seen BDPB binding decisions, of course, things like normally on the Irish when it comes to adjusting the amount of fines and penalties and the interested parties and all of that kind of stuff, but never what uh this case. Yeah, I think that's absolutely fascinating.

K 17:03

Yeah.

Ralph 17:04

So all change back here in the UK, as people may be aware, we have a new Prime Minister, Andy Burnham. Must be a Monday. And the constant revolving door of the poison chalice of the UK Premiership continues to roll. This Prime Minister does bring something a bit different. However, he is a big fan of sweeping changes, let's put it that way, including a little bit more devolved power to the regions. There's been a lot of talk of number 10 North as well as number 10 in London.

Paul 17:35

Sorry, sorry, just how I know this is this politics, but for the serious politics podcast, but number 10 North, how does that even work? How do you create a second Prime Minister's office? I don't know, what is it, 300 miles away from London? 400 miles?

Ralph 17:52

Yeah. We do have separate parliaments in Scotland and Wales and Northern Ireland.

Paul 17:57

So they each have their own responsibilities. They have their own foundational laws and things that they are responsible for. This would just be a second office, right?

Ralph 18:06

It's interesting because the ICO almost did the opposite. Under the former commissioner's tenure, the ICO was actually based in Wilmslow, just outside Manchester, mainly because that was where the first ICO lived. That's the history there. The first ICO lived in Wilmslow, so he made his office in Wilmslow. But but but uh actually under John Edwards they actually moved a lot of functions to the office in London so they could be closer to power. You've got some quite interesting. And now it's where power is apparently bouncing up north, so it's got to be a very interesting world. One of the most interesting fallouts is the removal of a government department. So Liz Kendall was the head of the department of science, innovation technology D SIT, which was kind of the independent ICO's sponsoring department. But that department no longer exists, and Liz Kendall is out of a job. So we have a new government department, the department for business, innovation, science and trade, which presumably the ICO is going to fall under. And there might be some quite interesting things going on there because obviously DCIT have got a number of consultations, a number of investigations into what happened at the ICO as well. So presumably they're going to be transferred to the new Department for Business, Innovation, Science and Trade. So data protection's kind of jumped about a lot in the UK. It was originally much like in the EU in the Department of Justice or the Ministry of Justice, and then it moved to the Department of Culture, Media and Sport, then to this DSIT a few years ago, and now it's back in business. So again, data protection is one of these areas that's moved around. And with the new ICO's mission to promote innovation and the economy, perhaps it's no surprise it's gone to business, innovation and trade rather than where it used to be for the culture, media and sport and the cabinet office. So DC has kind of been broken up. Some of it's gone to this Department for Business Innovation, Science and Trade, some of it's gone to DCMS, and some of it's gone to the Cabinet Office. So watch this space, I think. Watch this space. In the meantime, business as usual, probably the biggest news this week from the ICO is it's released its annual report for 24-25. Sorry, 2526. The headline in that is it's got 76,743 data protection complaints up from 42,315 the year before. So if you if you do the do do the math on that using the Americanism, you will actually work out that roughly it's almost doubled. The amount of complaints that the ICO received in this previous year, 25-26, has gone up by 1.81, 181%. That is a tremendous jump in complaints. A lot of this we reckon is down to a lot more subject access requests being put in, generated by AI and things like that. But of course, the ICO staff is doesn't traditionally change as well. Bearing in mind the enforcement statistics from the year before were something like you know, 67% no action, 33% informal action, 0.007% enforcement action. I don't expect those percentages to increase, I'll put it that way.

K 21:26

They have room to.

Ralph 21:28

They have room to as we transition from another the old ICO to the Information Commission with Paul Arnold as its as its chief. The recruitment has gone out as well for the new ICO.

K 21:39

A name in the ring.

Ralph 21:41

I expect my rejection letter very soon, although let's put it that way.

Paul 21:44

I was surprised when I saw the list of names of people who have been appointed as non-executive directors for the Information Commission, I must say.

Ralph 21:54

I was too. It feels like as a commission they've gone for people with board and leadership experience rather than subject matter expertise, let's put it that way.

Paul 22:05

There is nobody there with subject matter expertise if I saw the list. I would have expected at least one or two of the more experienced UK people in terms of privacy and data protection to be part of this board. People, the likes of Vivian Arts, who've been around for many years and who are also seen as business friendly. It's obvious that is the perspective of the UK government of what the new Information Commission should be. But there are quite a lot of quite a number of people also in the industry who can have that label of being business friendly while also being subject matter experts.

Ralph 22:46

Now, I'm not surprised, let's put it that way. Having read the job description for the new commission and the new commissioner, having read the the job description for those non-executive directors, the NEDs, I'm not surprised to see that. I am I do I am concerned that there's no one on there from anyone who would represent anything to do with civil society or the rights and freedoms of individuals or any subject matter expertise. But I do believe that is the pro-business agenda that we're seeing being pushed by the current government. At least by the previous government. Yes, true. And and yeah, I do wonder what that means for the future of rights and freedoms, of course. That's that that's a concern. I I personally don't think it's one or the other. I think good data protection will lead to good business and trusted innovation and the economy. But at the same time, I think one of the things we're supposed to have is an independent regulator. And with the government appointing the Commission, I do think that is a really interesting conversation to have. Now, we know the European Commission has already re-approved the UK for adequacy after the Data Use and Access Act. But so it is a question that popped up in my head whether the regulator can truly be said to be independent with these government appointments coming in at the top level.

K 24:04

And I'm laughing quietly because independent agency regulator, seriously, qualifications to lead a major agency here. I don't know, Department of Health and Human Services or the CDC. I wouldn't know what a qualified leader looks like.

Paul 24:18

Aaron Powell Federal Trade Commission, just the U.S. administration in general? We've already just got Trump versus Slaughter. Yeah. Yeah.

K 24:26

Well, let me throw something at you that we didn't really talk about much, but hot news came out earlier today. So y'all may have heard back in June that there was an executive order that went out that America's AI tech was not to be released outside the U.S., that foreign tech could not take advantage of the new clot or anthropic or anything like that. Apparently, this morning, our Secretary of State Rubio has asked diplomats to push back against talk of the kill switch, because apparently that that we're not going to share it didn't even last a month, right? There was so much pushback that it was stopped in its tracks. So Marco Rubio has asked diplomats to push back against talk of a kill switch, an American technology product following our short-lived decision to keep foreigners away from our most advanced AI tools.

Paul 25:16

So what does that mean? Does it mean that there cannot be a kill switch or that we cannot talk about it? But it is actually there.

K 25:23

Right. I'm trying to really figure this out. So this is how they declined to comment when they asked for more details. But let's see, the ban was lifted combined with the executive order that asked AI companies to voluntarily submit their models 30 days of cybersecurity, which we talked about and thought that sucked. European lawmaker Christoph Grudler said the episode showed the U.S. holds a real kill switch over essential technologies. And so apparently the pushback is to say we don't have a kill switch. We don't have it. Trevor Burrus, Jr.

Ralph 25:57

I saw something out of Ireland today about digital sovereignty and blocking a big Microsoft tender as well because they're concerned about US supremacy.

Paul 26:07

It's also part of the debate here in the Netherlands, yes.

K 26:11

He's pushing the diplomats to fight the digital sovereignty initiatives around the world, defined as efforts to restrict American tech firms' access to foreign markets. So the same thing we have talked about, Paul and Ralph, about restricting US tech over there to try to create with their own and how almost impossible that's going to be. Or to subject them to localization, charge them for network usage fees, or for force them to follow local rules around issues such as content moderators. You don't want them to follow local rules around issues such as content mods.

Paul 26:48

No, because we have American rules that apply worldwide.

K 26:52

We don't have rules. That's the problem. So Rubio had already instructed American diplomats to oppose similar data sovereignty measures earlier this year. So they're going back to push, push, push this because we do not want the rest of the world coming up with their own tech. So I found this on Reuters, but that's a pay site. This is available basically anywhere. Just Google Rubio telling diplomats to downplay the kill switch.

Paul 27:20

And probably if we don't, then we'll get additional tariffs.

K 27:24

Yeah. What popped up is a news story as we were doing the podcast, and I had heard about the executive order. I didn't figure that would last too long and it didn't.

Paul 27:32

No, it didn't. Claude Fable 5 is out in Europe.

K 27:35

This one's interesting. You don't need to follow content moderation local laws, American tech. Just shoosh.

Ralph 27:41

Just do that. Well they're they're unfair. If a different country passes content moderation, that's unfair on American technology, right? It's unfair for American freedom of speech.

K 27:51

Exactly. We have freedom of speech, although Well that that's the really strange thing.

Paul 27:57

You have freedom of speech for corporations. And that's not something that exists in Europe because freedom of speech is a fundamental human right. Right. And not something for corporations.

Ralph 28:08

Yeah, natural people, not legal people. Exactly.

Paul 28:12

While we are on the topic of AI, it might be good to remind people that on August 2nd, the next batch of provisions in the EU AI Act will enter into effect. Most importantly, all the requirements related to transparency.

K 28:26

Yes.

Paul 28:26

And that means that from the 2nd of August, you need to be clear if you are talking or interacting with an AI system. Companies need to also make sure that people are aware if they are using AI systems using emotion recognition or biometric classification. AI-generated content needs to be clearly marked. So also, for example, in advertising or in papers that are put out, if that has been AI generated or partially AI generated, that needs to be marked. And also deep fakes need to be clearly recognizable. There is a code of practice for AI that also includes certain EU-approved icons that can be freely used, a very basic text icon saying AI or AI generated or AI manner, AI modified. So don't expect anything exciting from those icons, basically just saying a stamp, this is AI.

K 29:22

I do expect now that these requests or polite requests from third world princes that ask me to invest my money in their service or to pay them for something will now be marked as a deep fake.

Ralph 29:35

It's really interesting. I have seen it, for example, on LinkedIn when you let's say post a story that says you've got the 300th episode of a podcast or something like that. There's now small marks appearing in the corner of the images that would say whether that image was AI generated. So I have started to see that stuff creep in. I've got one more small court case, and it's really fascinating before we finish. And it's one from the Court of Appeal in the UK, Vince versus Associated Newspapers. It's a green energy entrepreneur, Dale Vince, who actually put in a claim for unfair processing. Now, this is interesting because we talk about transparency, we talk about lawfulness, every other principle under the sun, but fairness doesn't often get talked about. It's not a principle that gets talked about to my full process enough. But this is a court case where it was really about defamation because Labour repays $100,000 to sex harassment donor above a photograph of him at a just stop oil protest. But however, he was mentioned far later in the fourth paragraph, and it wasn't actually him who was the sex harassment donor. He brought a data protection claim that was certified struck out because he wasn't the sex harassment donor and it was unduly detrimental and created a misleading impression. And the High Court kept it up, but the Court of Appeal reversed it and said that many readers don't read further than the headline and pictures, which is interesting. Inaccurate doesn't automatically read through for a claim too unfair, but that they decided it was in breach of the fairness principle, and the headline and images were inaccurate as well and misleading, and therefore the processing was unfair. The judgment pointed out it was a novel claim. No claim had ever, to any party's knowledge, succeeded before. So damages would be next, but it's a when damages we don't know yet. But it's really interesting to see fairness brought in at a criminal trial.

K 31:34

Interesting. Very interesting. And that's a good story to end on.

Paul 31:40

I would say so. Thank you all for listening. And until next week, goodbye. Goodbye.

K 31:47

Bye, y'all.

Tim 31:48

Now that was serious privacy. Please subscribe on your favorite podcast app and leave us a review. You can find us on LinkedIn, Instagram, and Blue Sky as Serious Privacy. Feel free to drop us a question or a comment. We'd love to hear from you.