Privacy Roundup: Top 10 Stories of August 2023

From the EU Digital Services Act, and Swiss FADP to Quebec’s Law 25, a number of privacy regulations and amendments are coming into force. Also in the news, is a spate of gigantic regulatory fines in the EU for Big Tech, including Meta’s 1M krone Norwegian fine and an evolving $5B lawsuit against Google.

The EU Digital Services Act regulations governing “very large online platforms” and “very large online search engines” are in effect from August 25, 2023. Bif tech such as Meta’s Facebook and Instagram, Apple’s online App Store, and Google, Amazon will be subject to new obligations such as curbing the dissemination of harmful content, and hate speech. The obligations include restricting or prohibiting specific user-targeting practices and disclosing internal data to regulators. Read more

Meta has announced its intention to obtain user consent for targeted advertising in the European Union. This proposal comes in the wake of evolving regulatory demands in the EU and a previous order issued by Ireland’s Data Protection Commissioner, who serves as Meta’s primary regulatory authority in the EU. The Irish DPC had asked the social media company to reassess their legal basis for targeted ads. Read more

As of September 1, 2023, Switzerland has enacted an updated version of its 1992 Swiss Federal Act on Data Protection (FADP). The revised act aims to bring Switzerland’s data protection laws into closer alignment with the European Union’s General Data Protection Regulation (GDPR). The act introduces stricter obligations for foreign companies operating in Switzerland and requires them to designate a Swiss representative. Read more

Google announced improved privacy control features to give users more control over their personal information in Google search results. Google will soon begin notifying users whenever their personal information, such as phone number, address, or email, appears on the search results page. Users can access this tool in the Google app by clicking on their Google account photo and selecting ‘Results about you’ or by going to goo.gle/resultsaboutyou. Read more

The Indian parliament passed the Digital Personal Data Protection Bill 2023 (DPDP), a legislation designed to oversee how technology firms manage user data while also granting the government greater oversight over data processing activities. On August 11, the bill received the President of India’s formal endorsement to become law. Read more

The main provisions of Law 25, Quebec’s privacy legislation, are set to become effective from September 22, 2023. Law 25, formerly Bill 64 was enacted by Quebec’s Parliament in September 2021, updating its existing data protection laws and introducing a series of new responsibilities for businesses operating in the province. Learn more

Norway’s Data Protection Authority fines Facebook owner Meta, to the tune of 1 million Norwegian Kroner ($98,500) every day starting on August 14 for privacy violations. On July 17th, the regulator, Datatilsynet, warned that the company could face fines if it failed to address the privacy violations it had identified. Norway also temporarily banned behavioural ads on Facebook and Instagram over privacy concerns. Read more

The European Data Protection Board has issued a binding decision on TikTok’s handling of children’s data. This verdict stems from a 2021 investigation conducted by the Irish Data Protection Authority, examining TikTok’s compliance with the EU’s General Data Protection Regulation (GDPR) and its treatment of data belonging to children aged 13 to 17. The announcement of the fines is expected within the next four weeks. Read more

Following a massive data breach, Discord.io, a platform that enabled users to generate custom links for their Discord channels, is shutting down its operations. According to reports, a hacker shared data of 760,000 users on Breached Forums, presumably with the intention of selling it. As a response to the breach, the discord.io website has temporarily shut down all operations. Read more

A class action lawsuit filed in the United States alleges that Google Chrome allows websites to collect personal information on users even after users activated Incognito mode on Chrome or other similar features like Safari’s private browsing.  A federal US judge denied Google’s request for a summary judgment, ruling that “Google did not notify users that Google engages in the alleged data collection while the user is in private browsing mode.” Read more