Data Privacy Detective

Progress towards a U.S. federal data privacy code? Consider the APRA, a bipartisan congressional effort in that direction - and its hot spots and chances. Learn about the Maryland Online Data Privacy Act and how it challenges big tech's preferences. Discover what Max Schremms, AI, and birthdays have in common.

Episode 169 explores these topics from April 2024 in fifteen minutes. Join Yugo Nagashima of Frost Brown Todd LLP in conversation with the Data Privacy Detective for this monthly update on major data privacy developments.

Time stamps:

00:48 — APRA

07:58 — Maryland

15:41 — Schremms, AI, and birthdays

In April 2024 Colorado became the first U.S. state to declare neural data - what goes on in our brains - to be "sensitive data" subject to its Privacy Act. Neural data will be treated the same as medical and other sensitive data such as fingerprints and facial images. The law will permit individuals to access, delete and correct their neural data. It will require organizations collecting neural data to obtain prior consent and disclose what they will do with it .

https://leg.colorado.gov/sites/default/files/2024a_1058_signed.pdf

Explore why this pioneering data privacy act is timely and how it will be used. Consider why the Colorado legislature voted almost unanimously in favor, though opposition was strident, including from academia. Learn whether regulating neural data this way is enough to protect the privacy of our brains and whether Colorado's action is likely to be the start of a wave of brain data protection.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://bit.ly/49XRU2k), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

For about ten years, Estonia has pioneered a digital ID system for its 1.3 million citizens. Every Estonian receives a digital identity at birth or later. Estonians use this e-ID for a host of interactions with government and the private sector. The e-ID is not guarded zealously like a U.S. Social Security number. Instead, it is a kind of public key, with personal information about the individual held separately and securely.

Is Estonia's e-ID system helpful or hurtful to individual privacy? This Episode explores Estonia's ongoing experiment. We consider how the system works and how digital identities can be useful in protecting personal information, increasing convenience, and preventing cybercrime. Here's the government's site about its e-ID program - https://e-estonia.com/solutions/e-identity/id-card/ Analyses of Estonia's e-ID system can be found here:

https://privacyinternational.org/case-study/4737/id-systems-analysed-e-estonia;

https://digitalid.design/docs/CIS_DigitalID_EstoniaCaseStudy_2020.04.pdf

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://bit.ly/49XRU2k), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Our medical and health data are valuable - both to promote public health and to enrich data brokers selling our sensitive personal information without our consent. HIPAA is the U.S. federal statute intended to safeguard our medical information - but it does not cover many of the ways our information is released and shared, with unintended consequences and risks.

Episode 165 considers the difference between PI and PII and how organizations and individuals can safeguard our health information. Learn the de-identification process of organizations that aim for both HIPAA compliance and privacy-centric reputation. John Cook, President of Kingwood Data Privacy is our guest - https://www.johndcook.com/blog/expert-hipaa-deidentification/

John offers top tips about how our medical information can be protected, while sharing this essential information to battle disease and advance public health.

Time stamps:

01:00 — Who is covered by HIPAA?

03:00 — What are the risks we take on when we share our medical information?

06:19 — How do businesses securely handle medical data?

08:31 — Where might health data privacy be headed in the US in the future?

10:31 — Top tips for organizations dealing with sensitive medical data

11:22 — Top tips for individuals in keeping their medical data secure

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Episode 164 covers three March 2024 developments:

• Florida bans social media platform accounts of children under 14 - and more;
• Illinois modifies its pioneering biometrics laws; and
• President Biden and the House of Representatives act together about the sale of personal information to countries "of concern."

Consider how social media platforms are affected by Florida's new effort to limit social media use by most minors - and how this creates privacy risks in an unintended way. https://www.flsenate.gov/Session/Bill/2024/3/BillText/er/PDF

Explore how and why Illinois's legislature first-in-the-States code regulating biometrics is considering changes to limit class action recoveries for failure to get consent from those whose biometrics are used.

Learn how an Executive Order and the House of Representatives' unanimously passed act would stop data brokers from sharing personal information of U.S. persons with specified countries "of concern."

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://bit.ly/49XRU2k), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Time stamps:

01:00 — Illinois modifies biometrics laws

08:00 — Executive action and legislation targeting the sale of personal information to countries "of concern"

14:00 — Florida bans social media platform accounts for children under 14

Identity Orchestration - the difference between Identity and ID. Join Gerry Gebel, IT veteran, now Head of Standards at Strata Identity - https://strata.io. Gerry leads an effort to develop Identity Query Language, a policy orchestration standard. Strata Identity pioneered the concept of Identity Orchestration, which helps organizations integrate and control incompatible identity systems.

Consider the state of data privacy today in a dizzying world of information flows. Can separating credentials from identity create more secure, private ways for us to participate in the digital universe? Will passwords become an historical relic? Is anonymity possible? If not, what limits can we hope to set on how our personal information is collected and used?

Explore these intriguing questions in Episode 163.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://bit.ly/49XRU2k), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Time stamps:

01:34 — What is identity orchestration?

06:45 — Are we heading toward a passwordless future?

07:54 — Is anonymity possible?

From the day of birth, and perhaps even earlier, we become public data subjects. Without our express consent, our personal information is collected and poured out like salt from a shaker because of public records laws. There has been little federal attention to this for 50 years, and state laws vary. Tune in for an exploration of many ways in which we are data public beyond our personal control. Is it time to consider a change?

Whether it's to document major life events, property purchases, voting, and other things, laws require the collection and public release of vast amounts of personal information. While these laws have their reasons, in a digital age such information becomes the basis for unacceptable privacy invasions. Consider in Episode 162 whether there's a public data overreach that requires rethinking about what is collected and shared freely about us, regardless of our choice or our best interests.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Privacy - "freedom from unauthorized invasion," says Webster's Collegiate Dictionary, or "the quality or state of being apart from company or observation."

The Detective did not authorize an online onslaught. But every day my computer and phone are bombarded with unsolicited ads and messages. My digital space is invaded by demands for my attention. I'm forced constantly to declutter. I try to swat away these pests, like waving arms at mosquitoes in a smarmy jungle. Advertising, promotions, social media I don't belong to clamoring to connect me with friends I've never met, strangers grasping to claim my time and money. And this happens without my request or consent.

Were this torrent of messages a stream of phone calls, I'd claim rights under the Do Not Call list - or if it gets worse, turn off the phone. Were this a noxious stream of knocks on my door, I'd post a No Trespassing sign out front or call the police. But what can an individual do to avoid the onslaught that the digital age has spawned?

Consider how unwanted data has infected our world and invades our privacy. Ponder how digital ads and unwanted messages are more toxic than highway billboards or ads on TV or radio. Think about defenses to this increasing attack on our privacy and take action about what we can do, both as individuals and as a society.

The first 155 episodes of Data Privacy Detective can be found on the feed of the Frost Brown Todd Podcast. You can listen on Apple Podcasts (https://apple.co/3IrHUTg), Spotify (https://bit.ly/49XRU2k), or Soundcloud (https://bit.ly/3T8EWrw).

Join Yugo Nagashima, data privacy and technology attorney at Frost Brown Todd, as he and the Data Privacy Detective discusses two major topics from February 2024.

Learn how DoorDash and California settled a dispute under California's privacy law that raises important issues for business and consumers. DoorDash was accused of failing to inform customers about its providing their personal information to marketing co-operative members, which then sent targeted advertisements to the customers. California claimed that DoorDash did not inform its customers about this and treated the sharing as a sale of personal information banned under the CCPA. When DoorDash tried to cure the problem, its contracts did not provide for adequate corrective measures and the ability to track and monitor how its customers' personal information was used by third parties. In addition to paying a $375,000 fine in settlement, DoorDash agreed to change its privacy policy and post a clear and conspicuous notice about its selling or sharing information through the marketing co-operative. And perhaps even more important, DoorDash will need to revise its data sharing agreements so that it can track, monitor, audit, and control what happens to its downstream sharing of personal information.

On February 23, the Florida legislature sent to the Governor a bill about social media and minors, with major privacy implications. Going beyond what several other states enacted in 2023, Florida could outright ban social media uses by people under age 16, require deletion of personal information of those minors on their request or that of their parents, and require age verification measures before allowing social media to sign them up as subscribers. The enacted bill would call for "anonymous" age verification methods to augment other common means of asking about someone's age. This would require sharing of personal information about the minors in order to increase the reliability of age verification. Consider the privacy implications of social media' and its impact on youth. Whose privacy is at stake? Whose data is it that would be protected? And who will control decisions about these matters - youngsters, parents and guardians, or the state?

Time stamps:

00:45 — California/DoorDash privacy dispute

08:27 — Florida's social media legislation

Who doesn't like cookies? When a website posts a notice about cookies, that sounds like a free offer for something good. But cookies on the internet are not good or bad. They aren't cookies at all in any real sense. They are simply embedded technology that attract and use information about us and what we do on a website. Aside from software that enables a website to function, many "cookies" - let's change their name right now to "Collectors" - grab, share, sell, and use our personal information. This leads to an invasion of our time and space - an invasion of our privacy.

Tune in to Episode 159 to explore how Collectors pose a threat to our privacy and how we as individuals should have a true and ready choice about how our personal information is collected, used, shared, and sold without our conscious awareness or approval. Consider the recent history of Avast, a leading anti-virus software provider, as we learn how "Collectors" work and how each of us can choose to avoid Collectors if we wish to have a more private, calm existence in a digital world.