app_store_button

google_play_button

Copy of Device Banner Block 894x1036 3

Descubre un mundo infinito de historias

Escucha y lee

Frost Brown Todd

The laws governing legal advertising in some states require the following statements in any publication of this kind:

"THIS IS AN ADVERTISEMENT."

Frost Brown Todd Podcast

Episode 155 considers three important developments as 2024 opens: 

-How the European Union’s pending AI Act blazes a new trail 
-How umbrella insurance may or may not apply to claims involving biometrics
-How Quebec’s 2023 data privacy act will reshape privacy notices throughout North America.

Yugo Nagashima and Brion St. Amour, attorneys with the coast-to-coast U.S. law firm Frost Brown Todd LLP, team with the Data Privacy Detective to cover these three essential matters.

On December 9, the European Union published a preliminary agreement on the Artificial Intelligence Act, a pioneering law that provides a framework for sale and use of AI in the EU. We consider what the AI Act covers and the four-levels-of-risk approach the EU will take for regulating AI.

We then jump into discussion of a class action lawsuit against Krispy Kreme Doughnut Corp. The suit claims a violation of the Illinois Biometric Information Privacy Act (BIPA). Does Krispy Kreme’s insurance coverage apply? We consider the distinction between the lawsuit's claims and the company’s umbrella policy. The insurer declared that Krispy Kreme is not entitled to an insurance paid defense, based on a policy exclusion.

The Quebec Act for protection of personal information in the private sector became law in September 2023. December 18, 2023 Guidance from Quebec’s Commission covers what must be in privacy notices, including that they be in clear, simple language (in French and English). https://www.cai.gouv.qc.ca/politiques-de-confidentialite/ What is “clear and simple”? The Guidance offers a checklist of what organizations should say in their website privacy postings, and is certain to force changes in websites of digital businesses that cover U.S. and Canadian markets.

Time stamps:
01:16 — EU’s pending AI Act
10:11 — Umbrella insurance and biometrics
17:08 — Quebec’s 2023 data privacy act

Episode 155 — Data Privacy News From December 2023

Why do businesses create cookies for their websites – and what choices can visitors make when a popup asks us to choose? Can chatbots write privacy policies for businesses? How can we determine if a website shares personal information we provide to it – and if so, for what purposes?

Donata Stroink-Skillrud, President and Legal Engineer of Termageddon (https://www.termageddon.com), addresses these questions. As data privacy laws and regulations spread, data privacy technology and policies must adapt. As website visitors, we should understand our choices when deciding what to click on cookie popups and should know whether a website business is gathering our personal information for limited and proper purposes. Learn a trick about how to know if a business shares personal information. Businesses wishing to be privacy compliant and earn a privacy-centric reputation should consider top tips. For individuals, hear advice for how we can protect our personal information in a world of growing threats to our privacy.

Time stamps:
01:00 — Cookies, explained
06:21 — Chatbots, explained
10:56 — How can we find out if a business is sharing our personal information?
14:21 — Tips for businesses that want to focus on user privacy
15:24 — Tips for individuals who want to protect their privacy

Episode 154 — Online Privacy - Cookies, Chatbots, And Data Sharing

When we visit websites, we increasingly see popups. Why is this? How does consent affect online advertising? And what’s changing in 2024?

Mate Prgin, founder/CEO of Enzuzo (https://www.enzuzo.com) explains how Google’s 2024 standards force online retailers to obtain express consent from customers for collecting and sharing personal information. Bolstered by the recent Quebec Law 25 (first in North America to adopt GDPR-style consent standards) and spreading U.S. state laws led by California, North American online sellers are driven to change their website technology and practices to give consumers the choice of allowing or refusing their personal information to be shared and used for personalized advertising. The meaning of “consent” and how it is provided in practice become essential for internet commerce in 2024. Understand how internet retailers can comply with law and private sector standards, how individuals will be empowered to exercise choices when shopping online about how their personal information will be used and shared.

Time stamps:

01:30 — What do you see in 2023 about data privacy compliance
04:23 — Google’s 2024 standards, explained
10:48 — Top tips for businesses in setting up their websites with privacy for users in mind
11:58 — Top tips for individuals who want to protect their privacy

Episode 153 — Online Advertising, Consent, and Data Privacy: Big Changes looming for 2024

Data clutter – we keep our homes tidy, at least some of us do. But what about digital data? It accumulates and grows over time. Unlike hard copy files, which can be pitched or sent to long-term (expensive) storage, data is silent and unobservable (except perhaps to IT personnel).
Explore how organizations amass vast amounts of data containing personal information, some highly sensitive. There it resides, posing serious risks to organizations and individuals.

In Episode 152 Jason Cassidy, CEO of Shinydocs (https://shinydocs.com ), takes us on a tour of data clutter. Learn the vast amounts of unintended data gathered and kept by businesses that don’t need it, how this can be managed, how personal privacy can be more secure through state-of-the-art data management. Consider how data can be auto-classified on creation, how files can be better located with data breach risk minimized. Hear an industry expert’s top tips about data management for organizations and individuals. Make it a new year’s resolution to de-clutter, to data-minimize, to control fileshares, to design privacy-centric creation, retention, and storage of digital data. 

Time stamps:

01:10 — What info do organizations typically store in their databases?
07:20 — What risks to our personal privacy are posed by data clutter? 
14:48 — Tops tips to organizations for dealing with data clutter
16:53 — Tops tips to individuals for dealing with data clutter

Episode 152 — Data Clutter & Data Privacy: Databases and the privacy risks they entail

Major data privacy news from November - the meaning beneath the headlines:
California issues proposed rules on ADTs – Automated Decision-making Technology. Applying California’s principal data privacy statute, the California Privacy Protection Agency proposes opt-out requirements, pre-use notices, and other measures for AI and related organizations. A New Landmark for Consumer Control Over their Personal Information: CPPA Proposes Regulatory Framework for Automated Decisionmaking Technology (ca.gov).
The TSA is using biometrics at U.S. airports with little notice or disclosure. Some U.S. Senators have called “time-out.” What’s going on with biometrics at airports? BUR23A41 (senate.gov). 
The influential Data & Trust Alliance proposes eight cross-border Data Provenance Standards. Learn how international standards are being set by the private sector to increase transparency, reliability, and use of datasets essential for AI. Will data become labeled and tracked like food and art? How does private standard setting lay the groundwork for privacy conscious laws and regulations? Consider the immediate opportunity to provide your comments about AI and personal data privacy. The Data & Trust Alliance (dataandtrustalliance.org).
Tune in to Episode 151 for analysis, as the world of data privacy spins toward 2024.

Time stamps:
00:59 — ADTs
09:02 — The TSA is using biometrics
13:47 — Data & Trust Alliance proposed Data Provenance Standards

Episode 151 — Top November 2023 Data Privacy News

Perry Johnson & Associates (PJ&A) provides medical transcription services to healthcare organizations. Its website states that it offers “secure HIT solutions,” using “multiple U.S. based, secure data centers for documentation storage and disaster recovery.” But in November 2023, PJ&A began informing about nine million people by individually sent letters that “between March 27, 2023 and May 2, 2023, PJ&A learned that an unauthorized party gained access” to its network and “acquired copies of certain files from PJ&A systems.”
A November 2023 TechRadar report summarizes the background:
“A total of 8.95 million individuals are affected, with the stolen data including full names, birth dates, postal addresses, medical records, and hospital account numbers. Furthermore, the hackers took admission diagnoses, as well as dates and times of service. In some cases, the hackers also stole Social Security Numbers (SSN), insurance and clinical information from medical transcription files, and names of healthcare providers - all of which would be more than enough to stage highly convincing social engineering attacks (phishing, identity theft, etc.) and could result in many class-action lawsuits.”
How did a leading MedTech company respond to this cybersecurity incident? Tune in to learn how one podcast listener was informed by letter about the wrongful release of the individual’s medical information and sought details with no success. Consider how society must prepare better to address the aftermath of data breaches and what we can do collectively and individually to protect our most sensitive information.

Episode 150 — Nine Million Medical Records Leaked - How can victims find out what happened?

Blockchain technology. Can it be a solution to privacy risks inherent in traditional IT? How is it different from cryptocurrency? What can it do to allow both individuals and organizations to limit and protect personal information exchanged in daily life?

Explore these questions in Episode 149, with Zenobia Godschalk, head of communications for Swirlds Labs (https://swirldslabs.com). Take a brisk tour of an open-source approach that applies blockchain technology to our evolving web. Learn about Hedera – an open source, leaderless proof-of-stake network. Consider how an individual need not share a lot of personal information when a transaction requires only proof of one thing – such as whether the individual is an adult or whether a person actually is a bank account holder.

Listen for top tips to organizations and individuals about how open-source blockchain technology can minimize risks to personal information and identity theft. Hear how public ledgers for decentralized economies are changing our digital existence and can be a means of protecting personal privacy without disrupting our digital world.

Time stamps:

01:02 — What is blockchain technology, and how is it different from cryptocurrency?

07:30 — What is tokenization?

12:42 — Is blockchain 100% effective?

14:44 — Top tips for organizations in considering blockchain technology as a replacement for traditional IT

18:52 — Top tips for individuals in considering blockchain

Episode 149 - Privacy & blockchain: an open source approach to privacy by design

Post-Quantum Data Privacy – what is it? What does it mean for organizations and individuals? That is this episode’s focus. Tune in to learn how one company offers privacy-protect ive messaging and cryptocurrency services in the age of Web 3.0 and quantum computing. JB Benjamin, the founder of UK-based Kryotech Ltd. (Kryotech Group), provides a tour of Vox Messenger and Vox Wallet. These services employ privacy-centric technology. Explore how our personal information is collected, used, and shared often without our knowledge or approval. Consider how technology beyond passwords is essential to deter unwanted use of our personal information and to minimize rising theft of our financial resources and even our identities.

Quantum computing means an exponentially increased power that can be used to break through lengthy passwords and otherwise hack and misuse data, both personal and organizational. Defenses are also evolving. Post-quantum privacy entails use of double-ratchet encryption, message immolation, sophisticated use of public and private keys, and other techniques. Individuals can be empowered to make choices about the value of their digital information and identities, which otherwise are swept up and used by businesses without payment. Understanding post-quantum data privacy is essential to empowering each individual to decide how to exercise choices about use of personal data.

Time stamps:

01:08 — How is our personal info used by companies to make a profit?
04:51 — What does Kryotech do to enhance privacy?
12:54 — What is Vox Crypto and how does it enhance privacy
18:03 — Top tips for businesses who want to focus more on privacy
20:10 — Top tips for individuals who want to protect their privacy

Episode 148 — Post-Quantum Data Privacy: Learnings from a Pioneer

How small and mid-sized organizations can afford privacy by design: Making data privacy and security affordable and scalable
Tech giants have vast budgets for cybersecurity and data privacy. But most organizations are small or mid-sized enterprises (SMEs) and can’t afford expensive in-house talent, hardware, and software to combat data piracy or prevent data breaches. How do startups, SMEs, and MSPs create a privacy responsible foundation as they start and grow? How can they make privacy part of their offering to customers? How can they maintain first-class cybersecurity and data privacy as they scale and grow on an affordable budget?
Darren Gallop, co-founder and CEO of Carbide (Company | Carbide (carbidesecure.com), provides advice on these and other topics in this Episode. With an overview of how secure personal information is today, Darren explains the benefits of starting with a secure privacy-centric foundation on an outsourced basis, then adding essential tools as an organization grows. Listen for top tips on how organizations and individuals can protect sensitive personal information on an affordable basis.

Time stamps:
01:59 — How secure is personal info these days?
06:10 — On a limited budget, how can small and mid-sized businesses invest in data protection?
12:02 — How does an SME maintain first-class data privacy practices?
17:19 — Top privacy tips for individuals

Episode 147 — How small and mid-sized organizations can afford privacy by design

October 2023 was a busy month for data privacy. Join our monthly podcast of three major developments in the world of personal information and technology. Our picks are these:
1. On October 30, President Biden issued an Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence (AI). Noteworthy to Data Privacy was his call for Congress to pass bipartisan data privacy legislation, especially for children, which would be a significant step towards a federal data privacy law. In addition to national security and other features, the EO prioritizes federal support for accelerating privacy-preserving techniques, strengthening privacy-preserving research and technologies, evaluating how agencies collect and use commercially available information, and developing guidelines for federal agencies to evaluate the effectiveness of privacy-preserving techniques. Explore what the Executive can do in the absence of Congressional action on data privacy. FACT SHEET: President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence | The White House.
2. The Federal Trade Commission amended its Safeguards Rule to require non-banking financial institutions to report certain data breaches to the FTC. Learn which businesses are covered and what the rule requires of them. Explore how the new reporting requirements will force a wide range of businesses to report data breaches in detail to the FTC, and how this could affect data privacy.
FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches | Federal Trade Commission.
3. A United Kingdom court rules on October 17 that Clearview AI was not liable to the UK’s Information Commissioner for scraping the photos of UK residents from the internet and offering its services to foreign law enforcement agencies. ukftt_grc_2023_819.pdf (nationalarchives.gov.uk). Learn why the extraterritorial reach of GDPR principles does not extend as many thought it might, how UK residents who have not consented to Clearview’s use of their images have no remedy, and what this means for any regulation of what people post on the internet.

Time stamps:
00:25 — Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence
05:53 — FTC amends Safeguard Rules
11:16 — UK Court rules in favor of Clearview AI

Episode 146 — October Data Privacy Highlights

Spell-jacking: a new word emerging from the tech world. Learn its meaning and what can be done to protect personal data privacy. We use convenient third-party features on websites that can expose highly sensitive information about us without our even suspecting this is happening.

When we use spellcheck on a website, this can send the entire form we are working on to “the cloud.” The information is in flight and can be shared (or hacked) in unexpected ways. A September 2022 study by otto-js, a JavaScript security firm, found that the vast majority of enterprise websites send data with Personal Identifying Information (PII) back to Google or Microsoft when users access Chrome Enhanced Spellcheck or Microsoft Edge Editor. This can release passwords, Social Security numbers, and other personal information users would not approve. Through enabled features that are convenient for users (such as spellcheck or “show my password”), personal data is being shared in ways individuals did not expressly approve and would avoid if they could.

Otto-js co-founders Maggie Louie and Josh Summitt tell how this problem was discovered and share how risks can be mitigated. While legitimate enterprises have no interest in releasing PII to mal-actors, spell-jacking as such is currently unregulated or under-regulated. Learn how industry and regulators are addressing this issue – and what consumers can do about it to protect their own personal privacy. Helpful guides for developers and consumers are available on the otto-js website.

If you have ideas for more interviews or stories, please email info@thedataprivacydetective.com.

Episode 100 - Spell-Jacking: Addressing a threat to personal data privacy

Escucha y lee

Otros podcasts que te pueden gustar...