Data Policy Briefing

The newsletter for the Data Policy Network
September 2021

Welcome!

Welcome to the eighth edition of the Data Policy Briefing. Looking forward to seeing you at our Data Policy Network event on 29 Sept on fairness in AI systems. The return to in-person events is very welcome!

As always, this newsletter highlights developments in data policy, shares views from the Network, and helps you to stay plugged in to the conversation. Let us know about recent publications we should feature.

What's got our attention

President Biden nominated privacy advocate Professor Alvaro Bedoya, founding director of Georgetown Law’s Center on Privacy & Technology, to serve as an FTC commissioner. Meanwhile, the U.S. House Energy and Commerce Committee has approved an additional $1bn in funding for the FTC to set up a bureau dedicated to improving data privacy and security. But funding on its own may not be enough to change practices in the US. Without a new legal framework or rule-making powers, the FTC may not have the authority to act against many current perceived privacy violations.

China joins the EU, Japan, and UK as a major economy with strong privacy laws. China’s new Personal Information Protection Law (PIPL) has both similarities with the GDPR, such as a potential 5% of revenue fine, breach reporting, legal basis for processing, risk assessments, and more, there are also significant differences. For example, PIPL does not apply to the Chinese state’s processing of data, doesn’t have a legitimate interest equivalent, and includes data localisation requirements. Although only passed last month, the law will come into effect November 21st.

The EDPB published its binding decision in the Irish DPC’s action against Whatsapp. The headlines focus on the fine - €225 million - but the decision also reveals significant debate between regulators on anonymisation. The Irish DPC took a different view to the majority (including French, German, Portuguese and others). The EDPB overruled the Irish DPC and restated the three-part test based on singling out, linkability and inferences.

All change in the UK. Nadine Dorries will replace Oliver Dowden at DCMS, while John Edwards is confirmed as Elizabeth Denham’s replacement at the ICO. Meanwhile DCMS announced wide-ranging proposals to reform the UK’s data protection regime. These include a public consultation on changes to the UK GDPR, a new governance structure for the ICO (to mirror governance arrangements at other regulators like the CMA and FCA), and changes to “help ensure that organisations can better understand and mitigate the risk of bias in their algorithmic systems”.

What we've been up to

Marcus reviewed data policy developments in Europe for his 2021 landscape review webinar. He highlighted the push to share data and examined the proposals intended to support organisations - from new governance models to pending guidance on anonymisation.

Sticking with anonymisation, we published a blog busting four common anonymisation myths. There’s much more detail in our Introduction to Anonymisation paper, co-authored with Bristows.

What you've been up to

The ICO launched a consultation on their draft international data transfer agreement and guidance, which would replace SCCs for transfers under UK GDPR. The consultation closes on 7 October. Osborne Clarke’s excellent webinar analysing the proposals is available on demand.

Following their review of online targeting, the CDEI worked with the Behavioural Insights Team (BIT) to find ways to empower people to make ‘active’ online choices about their privacy and personalisation settings. The final report includes the results of BIT’s experiments. Empowering users is a key part of digital regulation.

Azeem Azhar’s new book, Exponential, is out. We’re avid Exponential View readers, and look forward to sitting down with the book.

Dates for the diary

27th September 2021, 12:00 UK
The ODI’s next in-person Canalside Chat event asks whether the pandemic has changed our minds about data sharing. Cori Crider of Foxglove and Dr. Wen Hwa Lee of AAAMD, the charity working on macular degeneration, will discuss collecting, sharing and using data in a post-pandemic world. Register here.

29 September 2021, 17:30 UK
Our Data Policy Network convenes in person (for the first time in over a year!) to discuss fairness in AI systems. Guest speakers from UCL and AstraZeneca will set the scene with academic and industry perspectives. Register here.

2 November 2021, 09:20 CET
Privitar Product Manager Samira Raj joins an impressive lineup for the Chief Data & Analytics Officer Europe conference. Other confirmed speakers include data leaders from a huge range of organisations from Ebay to Condé Nast, WPP and the Crown Estate.

16 November 2021, 18:30 UK
Baroness Bakewell will chair Bristow’s Life Sciences Summit “Trust me, I am an algorithm. Is AI the future of healthcare?”. A panel of experts from the AI Council, NHS X, MHRA and the University of Bristol will consider the moral, commercial and regulatory implications of AI-driven healthcare. Register here.

The next edition will issue at the end of November

Email Marcus or Guy if you’d like us to feature your work, collaborate or subscribe to the newsletter if it’s been forwarded to you.

Don't want to receive the newsletter? Just click on the Unsubscribe button below and select No from the Newsletter drop-down.

Unsubscribe

Our cookie policy provides more detail on email tracking.