Data Privacy Provisions

⚖️ After reviewing the final reasoning of today's CJEU decision on the scope of personal data, the following applies: ✅ opinions and assessments can constitute personal data due to the wide scope of definition of personal data (Rec. 54) ✅ it is not necessary to examine the content, purpose or effects of comments, since they are necessarily closely linked to that person (Rec. 58, 60) ✅ pseudonymisation is not part of the definition of ‘personal data’, but refers to the establishment of technical and organisational measures to reduce the risk of a data set being correlated with the identity of data subjects (Rec. 72) ✅ data that have undergone pseudonymisation cannot be regarded, in all cases, as anonymous data (Rec. 73) ✅ pseudonymised data are not personal for third parties if (1) that party is not in a position to lift those pseudonymisation measures during any processing which is carried out under its control and (2) re-identification by recourse to other means of identification such as cross-checking with other factors is not possible (Rec. 77) ✅ where the risk of identification appears in reality to be insignificant (eg is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour), pseudonymised data must not be regarded as constituting, in all cases and for every person, personal data for the purposes of the application of GDPR (Rec. 82, 86) ✅ if, however, re-identification is possible, the data subject must be regarded as identifiable as regards both that transfer and any subsequent processing of those data by third parties (Rec. 85) ✅ pseudonymisation may, depending on the circumstances of the case, effectively prevent persons other than the controller from identifying the data subject in such a way that, for them, the data subject is not or is no longer identifiable (Rec. 86) ✅ a broad meaning to the concept of ‘personal data’ is not unlimited since that provision requires, inter alia, that the data subject be identified or identifiable (Re. 88) ✅ it is not required that all the information enabling the identification of the data subject must be in the hands of one person (Rec. 99) ✅ whether the data subject is identifiable depends, in essence, on the circumstances of the processing of the data in each individual case (Rec. 100) ✅ the identifiable nature of the data subject must be assessed at the time of collection of the data and from the point of view of the controller (Rec. 111)

Incorporating Data Privacy Clauses in NDAs 🔐 As someone deeply involved in data protection, I have seen firsthand how critical it is to protect sensitive information in our collaborations. In today’s landscape, integrating robust data privacy clauses into Non-Disclosure Agreements (NDAs) is no longer optional—it's essential. Why This Matters: 1. Regulatory Compliance: With regulations like GDPR and CCPA shaping our practices, we must ensure our NDAs reflect these legal requirements. I've witnessed the repercussions of non-compliance, and it's not something any organization can afford. 2. Data Classification: Clearly defining what sensitive data looks like is crucial. For example, specifying categories like PII or financial data helps everyone understand what’s at stake. 3. Access Controls: Establishing who can access sensitive information—and under what conditions—helps uphold the principle of least privilege. I’ve found that clarity here builds trust among all parties involved. 4. Breach Notification: It’s vital to have a breach notification protocol outlined in the NDA. Knowing how to respond swiftly can make all the difference in minimizing damage. 5. Data Transfer: In our globalized world, addressing cross-border data transfers in NDAs ensures we remain compliant with international standards. By embedding these technical aspects into our NDAs, we reinforce our commitment to data integrity and privacy. It’s not just about legal compliance; it’s about cultivating trust in every partnership. Let’s prioritize data privacy in our agreements and foster a culture of accountability in our industry. #DataPrivacy #NDA #LegalCompliance #DataSecurity #RiskManagement #cybersecurity #dataprotection

🇪🇺🇪🇺In #GDPR We Trust. Today, the European Commission published the Digital Simplification Package, presenting a proposal to amend several core provisions of the GDPR. The initiative is part of a broader strategy to streamline the EU digital acquis and support the development and operation of #AI systems. The proposal introduces a clarification that information is not personal data for a controller if that controller cannot identify the individual with means reasonably likely to be used. It adds new definitions, including terminal equipment, web browser, media service, media service provider, online interface and scientific research. The purpose-limitation principle is modified so that further processing for archiving, scientific, historical or statistical purposes is always considered compatible with the initial purpose. Changes relevant to AI development include a new ground under Article 9(2)(k) GDPR allowing processing of special categories of data in the context of developing or operating an AI system or AI model, subject to additional safeguards in Article 9(5). Controllers will be required to implement organisational and technical measures to avoid collecting or otherwise processing special categories of data in training, testing or validation datasets. If such data are still identified, they must be removed, or, where removal would require disproportionate effort, protected from influencing outputs or being disclosed. Article 88c introduces a specific framework for processing personal data for the development and operation of AI systems under Article 6(1)(f), subject to the balancing test and an unconditional right to object. This processing must also include safeguards such as data-minimisation during source selection and training, protection against disclosure of residually retained data, and enhanced transparency towards data subjects. The proposal also adjusts Article 12 by allowing controllers to refuse under Article 15 because the data subject abuses the rights conferred by this GDPR for purposes other than the protection of their data,, modifies Article 13 by introducing exemptions from privacy notices in circumscribed, not data-intensive relationships or for research (no need for privacy notices if prociding info is likely to render impossible or seriously impair the achievement of the objectives of the research) Personal-data breach notifications move to a 96-hour deadline and will later be channelled through the NIS2 single entry point. The EDPB should prepare EU-wide templates for DPIAs, data-breach notifications and lists of processing operations requiring or exempt from DPIAs. New Articles 88a and 88b introduce rules for storing and accessing data on terminal equipment, consent management and machine-readable signals that controllers and browser providers must support within set timelines.

October comes next week, and so do new privacy requirements in three states. Here's a recap and what to check ⤵️ 1️⃣ Colorado Privacy Act amendments related to minors' personal data will: 🔸impose obligations where a controller knows or willfully disregards that a user is a minor; 🔸require opt-in consent to sell or use a minor's personal data for targeted advertising, or to use system design features to increase engagement; 🔸limit how precise geolocation data of minors can be processed; and 🔸mandate data protection assessments in additional contexts. Rulemaking is underway to provide further clarity on these new requirements, including to specify when a data controller "willfully disregards" that a user is a minor and what system design features increase engagement. See the draft regulations here: https://lnkd.in/gcBtzyTi 2️⃣ Montana privacy law amendments that: 🔸lower the law's threshold for applicability; 🔸remove the general non-profit exemption; 🔸add privacy policy content requirements; 🔸require sale and targeted advertising opt-out links outside the privacy policy; and 🔸remove the right to cure violations. 3️⃣Maryland's Online Data Privacy Act takes effect. It has a low bar for applicability, and unique or less common requirements like: 🔸prohibiting processing of sensitive personal data unless it is strictly necessary to provide or maintain a consumer-requested product or service; 🔸forbidding collection of personal data unless it is reasonably necessary and proportionate to provide or maintain a consumer-requested product or service; 🔸banning sales of personal data of minors, and processing of their personal data for #TargetedAdvertising; 🔸broad data deletion right unless retention is required by law (though other provisions may give some flexibility); 🔸privacy policy requirements including to disclose the type of, business model of, or processing conducted by each third party to which personal data is disclosed; and 🔸consumer health data requirements.   If you haven't already, identify which of these laws apply to your organization, and see if your current privacy practices address what's required. Consider especially: ✔️ How your organization identifies accounts, profiles, and personal data of minors, and treats them in line with Colorado's, Maryland's, and other states' increasingly complex requirements 💡 Validate that there are processes to address parental reports, app store provided age information, and other reports and signals that a data subject is a minor; ✔️ Data collection and use limits to address Maryland's strict data minimization requirements, particularly for sensitive personal data 💡 Updates may be appropriate in #privacy impact assessment processes, organizational policies, and organizational privacy training; ✔️ Confirming your organization's privacy policy has the third party details required under the Maryland law.

🔐 Digital Personal Data Protection Act, 2023 (India) – Explained Simply 🇮🇳 India has taken a major step toward strengthening data privacy with the Digital Personal Data Protection Act, 2023 (DPDP Act). This law empowers individuals and holds organizations accountable for how personal data is handled. Let’s break it down 👇 --- 🎯 Purpose of the Act ✔ Protect individuals’ personal data ✔ Ensure responsible and transparent data usage ✔ Give citizens control over their own data --- 📌 What is Personal Data? Personal data includes any information that can identify an individual: Name, phone number, email Aadhaar, PAN details Location, photos, IP address, and more --- ⚖️ Key Principles of the DPDP Act ✔ Consent First – Clear, informed, and revocable consent is mandatory ✔ Purpose Limitation – Data must be used only for the intended purpose ✔ Data Minimization – Collect only what is necessary ✔ Data Security – Protect data from breaches and misuse --- 👤 Rights of Individuals (Data Principals) ✔ Access & Correction – View and update your personal data ✔ Right to Erasure – Request deletion of your data ✔ Withdraw Consent – Opt out anytime ✔ File Complaints – Report misuse or mishandling --- 🏢 Duties of Organizations (Data Fiduciaries) ✔ Ensure lawful data processing ✔ Implement strong security safeguards ✔ Maintain transparency in data usage ✔ Respond to user requests promptly --- ⚠️ Penalties for Non-Compliance 💰 Fines up to ₹250 crore (or more) for serious violations --- 👶 Special Protection for Children ✔ Parental consent is mandatory ✔ Restrictions on targeted advertising for children --- 💡 Why This Matters? The DPDP Act marks a shift toward privacy-first digital governance, aligning India with global standards and building trust in the digital ecosystem. --- 📌 Key Takeaway: 👉 Your data, your rights 👉 Organizations must be accountable 👉 Privacy is now a legal priority in India --- #DPDPAct #DataProtection #Privacy #CyberSecurity #GRC #Compliance #IndiaTech #InformationSecurity #DataPrivacy #DigitalIndia

📢 New Jersey Just Raised the Bar on Data Privacy — Here's Why It Matters On the heels of the NJ Data Privacy Act (NJDPA), the NJ Division of Consumer Affairs has released a sweeping set of proposed rules (N.J.A.C. 13:45L). If finalized, these rules will likely reshape how in-scope organizations design, disclose, and operationalize consumer privacy. What privacy lawyers and compliance teams need to know: 🔍 No more vague disclosures Under N.J.A.C. 13:45L-6.1, privacy notices must clearly define each processing purpose. Broad or future-facing justifications are expressly prohibited. 🔁 Purpose drift triggers consent N.J.A.C. 13:45L-6.2 borrows from California’s CPRA, requiring new consent if you’re processing data in ways that aren't "reasonably compatible" with previously disclosed purposes. Compatibility must be evaluated using specific statutory factors. 🧹Real data minimization and deletion Under N.J.A.C. 13:45L-6.3 and 7.6, controllers must limit collection to what’s necessary and delete sensitive data within 15 days (❗❗) of a consumer withdrawing consent. A data inventory and lifecycle tracking are now baseline compliance needs. ⏳ Dormant users = expired consent N.J.A.C. 13:45L-7.7 mandates that consent to process sensitive data must be refreshed if there has been no consumer interaction for 24 months. ⚠️ Risk assessments with teeth Under N.J.A.C. 13:45L-8.1, assessments must include the technology used, the potential for psychological harm, and an analysis of whether the processing’s benefits outweigh its risks. Profiling and AI-based decision-making are squarely in scope. 💡Why this matters: While California, Colorado, and Virginia helped pioneer U.S. privacy laws, New Jersey is now taking the lead on enforcement-ready specificity. These rules don't just say what to do — they say how to build it. NJ goes further than most other states on dark patterns (N.J.A.C. 13:45L-1.5), universal opt-out mechanisms (N.J.A.C. 13:45L-5.2), and profiling transparency (N.J.A.C. 13:45L-2.2). If adopted, these proposed rules could become the new gold standard for consumer data privacy protection — or potentially the next template for federal reform. 📅Comment period closes August 1, 2025 🔗Read the full proposal here: https://lnkd.in/gg5bqv4g 👇 What do you think? Which provision will be hardest for your org or your clients to operationalize? Will you need to redesign your consent flow, privacy notices, or data retention practices? #DataPrivacy #NJDPA #PrivacyLaw #DarkPatterns #AICompliance #UniversalOptOut #RiskAssessment #InHouseCounsel #Cybersecurity #LinkedInLegal #CCPA #DataProtection #ConsumerProtection

Excited to share a quick summary of the newly notified Digital Personal Data Protection Rules, 2025! These rules operationalize the DPDPA, 2023, and bring clarity on consent management, breach notification, data retention, and rights for data principals. Key highlights: ✅ Consent Managers must be transparent, secure, and maintain records ✅ Clear notice and verifiable consent required, especially for children and persons with disabilities ✅ Mandatory data breach notification to affected individuals and the Data Protection Board ✅ Data must be erased after purpose is served (unless retention is legally required) ✅ Significant data fiduciaries must conduct annual audits and impact assessments ✅ Enhanced rights for data principals: access, correction, deletion, and nomination ✅ Special exemptions for healthcare, education, and safety-related processing of children’s data ✅ Digital hearings and appeals for the Data Protection Board and Appellate Tribunal These rules are a major step forward in strengthening India’s data protection ecosystem. What are your thoughts on the practical implications for enterprises and compliance teams? Grant Thornton Bharat LLP | ISACA New Delhi Chapter | Manav Rachna University #DataPrivacy #DPDPA #DigitalPersonalDataProtection #Compliance #GRC #India #Cybersecurity #DataProtection #PrivacyRules

🔒 Digital Personal Data Protection Rules, 2025 — A New Era of Trust, Transparency & User Rights The Government of India has officially notified the Digital Personal Data Protection Rules, 2025, marking a major milestone in strengthening India’s digital governance framework under the DPDP Act, 2023. These rules bring clarity, accountability, and a citizen-first approach to how personal data is processed, protected, and preserved across digital platforms. Here are the key highlights shaping the future of data protection in India: 🔹 Clear, Transparent Notices Data Fiduciaries must issue simple, independent, easy-to-understand notices explaining what data is collected and why. 🔹 Stronger Security Safeguards Mandatory use of encryption, tokenisation, access control, monitoring logs, and 1-year minimum data retention for breach investigation. 🔹 Data Breach Reporting Quick communication to affected individuals and mandatory 72-hour reporting to the Data Protection Board. 🔹 Consent Managers Framework India introduces a unique interoperable consent ecosystem with stringent eligibility, transparency requirements, and conflict-of-interest checks. 🔹 Child & Disability Data Protection Strict verification of parental consent, lawful guardian validation, and exemptions only for health, education, and safety-related use cases. 🔹 Right to Erasure & Inactivity-Based Deletion Large platforms (e-commerce, social media, gaming) must erase data after 3 years of user inactivity, with mandatory 48-hour advance notice. 🔹 Significant Data Fiduciaries (SDFs) Annual DPIA, audits, algorithmic due diligence, and restrictions on offshore transfer of sensitive data. 🔹 Government Services & Public Funds For subsidies, benefits, certificates, and services, processing must follow strict standards under the Second Schedule. 🔹 Digital-First Governance Both the Data Protection Board and the Appellate Tribunal will function as digital offices, enabling swift, paperless, tech-enabled adjudication. The DPDP Rules, 2025 reinforce India’s commitment to a secure, trusted, accountable digital economy—empowering citizens while enabling innovation. As we move toward deeper digitalisation, these rules provide a robust foundation for responsible data handling and a safer digital future for all. #DPDP2025 #DigitalIndia #DataProtection #Governance #CyberSecurity #PrivacyByDesign #TechPolicy #DigitalTransformation