Data Privacy Detective

Data Privacy Detective

By Joe Dehner - Global Data Privacy LawyerNewsTechnologyTech News
Download on the App Store

Data Privacy Detective episodes

  • Episode 80 - Backup and Privacy
    Backup – what does it have to do with protecting data privacy? And how does a backup service work? What should businesses and individuals know about backing up their digital data? On one hand, a backup of data provides a second target for data thieves. Not properly handled, backups can increase privacy risks. But without a backup of data, it can be lost and subject to exfiltration by thieves who steal or freeze the data held by businesses and government, the prime targets of ransomware criminals.
    This podcast explores the world of backup with W. Curtis Preston, sometimes referred to as Mr. Backup. Host of the podcast series “Restore It All,” author of books, veteran of the data backup business, and Chief Technical Evangelist for Druva (www.druva.com), our guest will take you on a tour of a business and service little understood but vital for protecting and recovering data in case of loss.
    Learn the meaning and importance in tech field lingo of “regular expressions” and “immutability.” Consider how backup services can inform businesses about protecting sensitive data better, beyond their role in resiliency and providing prompt access to data streams that are lost or stolen. And get tips about how individuals can consider the role of backup for their own personal data.
    If you have ideas for more interviews or stories, please email [email protected].
    23 min
  • Episode 79 - Data Localization - The Case of Taiwan
    Taiwan occupies a unique geopolitical position – with a substantial population and robust economy, it lacks formal diplomatic recognition by most countries and is considered by the People’s Republic to be rightfully part of it. Taiwan has its own system and laws. How does it approach personal data flows beyond its borders?
    Taiwan has a comprehensive personal data privacy law with a GDPR-similar approach. It provides more flexibility than the EU in how Taiwanese personal information is collected and processed. There is no express extraterritorial reach to its law. But Taiwan businesses must comply with rules on handling data they collect and can be held criminally and civilly liable for exporting data that infringes Taiwan principles.
    There are statutory exceptions to the relatively free ability for cross-border sharing and processing of personal data. Taiwan’s financial regulator requires financial institutions to obtain consent for the export of personal financial data. Taiwan prohibits its telecommunications and broadcast companies from storing subscriber data in the People’s Republic of China. Taiwan uses sectoral exceptions to address particularly sensitive security concerns.
    This podcast episode explores the unique position of Taiwan on our continuing global tour with Yugo Nagashima about how data localization is practiced.
    If you have ideas for more interviews or stories, please email [email protected].
    14 min
  • Episode 78 - Data Localization - The Case of Turkey
    Turkey is the first 2022 stop on our global tour about data localization. What is Turkey’s approach to cross-border transfers of personal data about its citizens and residents?
    Turkey’s Law on Protection of Personal Data is comprehensive and like the European Union’s former Data Protection Directive, though it differs in some respects. Data localization is not part of this existing Turkish law. Instead, Turkey takes a sectoral approach to cross-border collection and processing of personal data of its residents. Turkish banks must collect and store Turkish customer data within Turkey. Data localizations requirements apply to payment and electronic money institutions, forcing companies like Paypal or Venmo to locate a payment system within Turkey and to comply with Turkish data privacy regulations. Social media providers must register with and report every six months to Turkish authorities about Turkish social media users.
    In August 2021, the Turkish Data Protection Authority (KVKK) proposed to amend Turkish law to permit cross-border data transfers if it issues an adequacy decision about another country. But unlike GDPR, the amendment would require the foreign country to be reciprocal in its data privacy laws, a unique approach that extends beyond adequacy. If adopted, the KVKK approach would encourage multinational companies to use Turkish-based servers and a Turkish subsidiary to have broad access to the Turkish market but would allow flexibility through binding corporate rules and notifying the Turkish authorities of a standard undertaking.
    Tune in to Episode 78 to learn how and why Turkey may be aligning with evolving European standards instead of more authoritarian and protectionist rules evident in China, Russia, and India.
    If you have ideas for more interviews or stories, please email [email protected].
    17 min
  • Episode 77 - Data Localization - The Case of Singapore
    The Data Privacy Detectives turns his data localization spotlight on the island nation of Singapore. With a per capita income of 64% higher than the United Kingdom’s and a free-market economy that depends on global trade and commerce, Singapore takes a very different approach from China, Russia, India, and other countries that strive to localize their residents’ personal information.
    Singapore’s Personal Data Protection Act (2012) provides a comprehensive set of rules protecting the personal information of its residents. Like GDPR in scope, it differs in its flexible approach to balancing privacy and national security protections. In 2020 Singapore’s Monetary Authority and the U.S. Treasury issued a joint statement opposing data localization requirements, calling them a risk to cybersecurity and economic growth. They called instead for data mobility in financial services as a spur to innovative services and economic growth and as a more effective approach to risk management and cross-border compliance.
    Singapore's broad privacy protection rules allow flexibility for businesses to comply, a model that U.S. regulators may wish to study as alternatives to data fencing or rigid regulation. In February 2021 Singapore’s Privacy Data Protection Commission published a guide of model clauses for processors to follow, regardless of where they are based and not requiring that a Singapore server be the data custodian. The island’s embrace of regional multinational compacts (Asia Pacific Cooperation Cross-Border Privacy Rules and Asia Pacific Economic Cooperation Privacy Recognition for Processors) offers a regional model different from China’s data nationalism.
    If you have ideas for more interviews or stories, please email [email protected].
    16 min
  • Episode 76 - Data Localization - The Case of Australia
    Our prior podcast episodes detailed how China, Russia, and to a lesser extent India have created barriers to the free flow of personal information across borders. Data localization, sometimes called data nationalization, is the practice of governments to restrict or regulate closely how personal information of their citizens can be collected or shared outside a country.
    This podcast episode looks at how Australia, a free-market country, is handling personal data transfers. Australia has no broad data localization requirements. But it restricts the export of medical information about its residents. Electronic health records with personally identifiable information cannot be transferred or processed outside Australia.
    Australia’s Privacy Act, an early national data privacy law (1988), is comprehensive and different from GDPR. Collecting personal information is possible only if “reasonably necessary,” so does not require express consent. But Australia is protective of its citizens’ privacy interests. A 2021 order of Australia’s regulator against Clearview ordered it to cease collection of facial biometrics and destroy existing images of Australian citizens. Clearview argued with no success that the images were publicly available (and so did not constitute personally protected data) and that Clearview is a U.S. company with no establishment in Australia.
    If a free-market oriented country like Australia engages in data localization and the extraterritorial reach of its laws, what does this mean for the internet, global data business, and the privacy of people? Tune into this discussion in our fourth episode about data localization.
    If you have ideas for more interviews or stories, please email [email protected].
    13 min
  • Episode 75 - Data Localization - The Case of Russia
    We turn to Russia in our data localization series. Russia’s 2015 personal data protection law requires “data operators” to collect and keep information about Russian residents within Russia. It forces them to keep personal data about its citizens on a Russian located server, which must at all times keep at least as much data as is kept on a company’s servers outside Russia. This law resulted in LinkedIn’s being blocked from the Russian internet in 2016 for failing to do this.
    In 2019 Russia expanded the authority of its regulator, Roskomnadzor, to levy fines instead of being limited to blocking for violations. While the fines are modest in amount, this lets regulators allow popular sites into Russia while insisting on data localization Russian style. In July 2021, Russia began requiring giant social media companies to establish a Russian presence to connect with Russian citizens.
    It’s believed that more than 600 foreign companies have registered with Russian authorities to participate in the Russian market and comply with Russian data laws. These include giants such as Microsoft, Apple, and Samsung. If they fail to comply with Russian law regarding the data of Russian citizens, they can face advertising bans or blocking of access.
    Russia’s approach lies between the stricter regimen of China and the globally open approach of the United States. Russia’s Government would argue that its laws are there to protect Russian citizens from data abuse by foreign companies. But tech protectionism and Russian sovereignty over its citizens’ internet use are also at work. Podcast Episode 75 asks what Russia’s data localization means for the original internet dream of communications and commerce across borders. Tune in for the conversation.
    If you have ideas for more interviews or stories, please email [email protected].
    12 min
  • Episode 74 - Data Localization - The Case of India
    In this second podcast episode about data localization, we spotlight India. Since 1993 the world’s largest democracy has enacted data localization laws aiming to keep certain personal records within India or otherwise restrict data transfers of Indians’ personal data. When in 2017 the Indian Supreme Court found personal privacy to be a fundamental constitutional right, a Personal Data Protection Bill (PDPB) was promptly drafted. It has since been percolating towards adoption. The draft bill defines certain personal data as “critical” and so must be stored only within India. Other data is called “sensitive,” and may be processed outside of India with a copy kept within India. A third category of “regular” data could be transferred abroad, pursuant to data transfer rules.
    Unlike China, reviewed in the last podcast episode (episode 73,) India has a robust tech industry heavily involved in processing foreign data. India processes more personal data than any other country, so that parochial data laws would stand in stark contrast to this essential industry of India. Yet, Amazon, Facebook, Google and other global businesses dominate the Indian home markets, unlike their absence from China. Protectionist forces within India are calling for strict data controls, purportedly to protect the privacy of Indian residents while also favoring the interests of local tech and other firms. Indian businesses such as Reliance talk of “data colonization,” the idea that foreign companies control too much of the data of Indian residents and are plundering the wealth of India as measured by the data of its 1.3 billion people.
    Indian sources expect the PDPB to be enacted in the winter session of 2021-22. The enacted version will reveal whether India adopts a protectionist approach to data or embraces a more global approach to how personal data is collected and processed. This in turn will affect how other nations will respond. The outcome will affect how data privacy is enhanced or diminished as the rules governing data evolve country by country.
    If you have ideas for more interviews or stories, please email [email protected].
    12 min
  • Episode 73 - Data Localization - The Case of China
    The internet and the worldwide web – the words envision a global communications system that transcends national borders. But the reality differs. Is it increasingly the splinternet? Is www really a series of webs that don’t connect globally? And how is our privacy affected by data fences and controls erected by nations?
    In this first of a series, we explore how China deals with personal information of its residents. China collects a vast array of personal information about its people – financial, judicial, commercial, societal, and governmental. These are the five pillars of China’s Social Credit System, which aims to reward loyal and trustworthy citizens and penalize others, based on information collected about Chinese residents. Individuals are white-listed or black-listed to be rewarded or penalized, based on personal data collected, analyzed, and applied by the Government to encourage a socially proper citizenry.
    China has an extensive and evolving set of laws, including recent changes to its Data Security Law, Cybersecurity Law, and the forthcoming Personal Information Protection Law, which aim to keep within China’s borders “personal information” and “important data.” This allows China to prevent transfers of these two types of data to other countries. But the definitions of “personal” and “important” data are left to a vast array of sectoral ministries and regulators and to other national, regional, and local organizations, which may issue categories or lists to define and apply these broad terms.
    By contrast, China is free to import personal information of non-Chinese residents. Take TikTok, for example. Over twenty million U.S. persons use TikTok, owned by a Chinese company. It is not clear whether the personal information TikTok collects is made available to the Chinese Government, pursuant to PRC laws and procedures. If Chinese companies and Government can collect personal information about U.S. citizens but U.S. companies and Government cannot collect and utilize personal information about Chinese citizens, this creates an imbalance of trade and business opportunities. Is this a path to a data trade war? And if our personal information can be shared beyond our country’s borders, will this change what data we post and share within our borders? This podcast explores how China affects personal privacy and the future of the internet.
    If you have ideas for more interviews or stories, please email [email protected].
    20 min
  • Episode 72 - Personal Privacy Within Your Home
    Home is our private place. But in the digital age, how private are our homes? And what can we do to protect our privacy from home invaders? 66% of us rate our highest privacy concern as being viewed through cameras in our own homes, according to a safehome.org June 2021 survey. Explore in this podcast how home devices are watching, listening, collecting, and sharing our personal data and steps we can take to limit unwanted intrusions.
    Terry Rankhorn, a 22-year FBI veteran and founder of Rankhorn & Associates, conducts home and business sweeps to protect clients’ personal data and safety. Computers, televisions, smart thermostats, Alexa and Siri, even dog bowls collect and broadcast our personal data in unimagined ways, jeopardizing our privacy and security. Mr. Rankhorn explains the first step to increase home privacy is to know what devices we have and which ones collect and broadcast our data. We can delete devices we don’t need or want and use privacy setting choices and common-sense steps to limit sharing. We can adjust our smart thermostats when away for an extended time, to prevent hackers from knowing from thermostat data when our homes are vacant and so are ripe burglary targets.
    We can protect our personal data from devices we literally live with. This podcast episode offers practical advice about how to do that.
    If you have ideas for more interviews or stories, please email [email protected].
    20 min
  • Episode 71 - Doxing and Kentucky’s Pioneering Anti-Doxing Statute
    Kentucky is perhaps the first state to adopt a comprehensive anti-doxing statute that creates a civil tort of doxing, as well as providing explicit criminal penalties for defined doxing conduct. It allows Kentucky residents to sue someone for intentionally disseminating their personal identifying information (PII) with an intent to intimidate, abuse, threaten, harass, or frighten a person or immediate family or household member.
    In this podcast episode, Justin Fowles, an attorney in Frost Brown Todd LLC's Louisville, Kentucky office, shares key insights on what the new law contains and could mean for individuals' and businesses' online behavior.
    What is doxxing – or is it doxing? This word entered the Merriam-Webster Dictionary in the 21st century. It defines “dox” as a verb – “to publicly identify or publish private information about (someone) especially as a form of punishment or revenge.”
    Today it connotes cyberbullying or troll harassment by posting personal information about a targeted person or organization, urging others to take action intended to shame or expose the target. Doxxing has had tragic ends. Doxed individuals have had surprise visits by SWAT teams breaking down doors to targets’ homes based on the doxer’s false message that a kidnapping or domestic violence was occurring there. Death and more commonly emotional stress arise from doxing attacks.
    A federal anti-stalking statute includes the language “interactive computer service or electronic communication service” within it. If a person uses such services with intent to kill, harass or otherwise target persons in specific ways that puts them in reasonable fear, causes substantial emotional distress, or otherwise causes them to suffer specified harm, a doxer can be criminally prosecuted. But federal prosecutions are rare, and no U.S. statute was designed specifically to combat doxing.
    Enter the states. Kentucky's anti-doxing statute creates a civil tort of doxing, as well as providing explicit criminal penalties for defined doxing conduct. Effective June 29, 2021, the Kentucky statute was passed by a Republic legislature with Democratic support and signed by a Democratic governor. It allows Kentucky residents to sue someone for intentionally disseminating their personal identifying information (PII) with an intent to intimidate, abuse, threaten, harass, or frighten a person or immediate family or household member. The spread of PII must be such that a reasonable person would be in fear of physical injury to the targeted person or an immediate family or household member. Intent is measured by what would cause a reasonable person to be in fear of physical injury personally or to a family or household member, rather than requiring express proof of the doxer’s actual intent.
    Organizations should consider how best to avoid being either a doxing victim or a doxing perpetrator. Organizations could face civil and criminal challenges under Kentucky’s statute as to their use of personal information if communicated within the scope of the statute’s reach. Businesses and other organizations should review the personal information they hold and how it is shared or communicated, to avoid being charged with a doxing tort or prosecution. Organizations can likewise review defenses to being doxxed. The anti-doxing statute could suggest responses and provide recourse to unfair personal attacks on company personnel.
    If you have ideas for more interviews or stories, please email [email protected].
    19 min

About Data Privacy Detective

From the publisher's feed

The internet in its blooming evolution makes personal data big business – for government, the private sector and denizens of the dark alike. The Data Privacy Detective explores how governments balance the interests of personal privacy with competing needs for public security, public health and other communal goods. It scans the globe for champions, villains, protectors and invaders of personal privacy and for the tools and technology used by individuals, business and government in the great competition between personal privacy and societal good order.