Internet privacy laws around the world that effect you and how

08:49 PM

https://piwik.pro/privacy .. -around-globe/

GDPR was a breakthrough in data privacy – the new golden standard among data protection regulations. Here are the most important principles GDPR introduced according the report “Global convergence of data privacy standards and laws”:

Enabling data protection authorities (DPAs) to make binding decisions and issue administrative sanctions including fines
The right to object to processing based on controller’s or public interests
An obligation to notify DPAs and data subjects about data breach
Stronger consent requirements
Including biometric and/or genetic data in the definition of sensitive data
Introducing data protection officers (DPOs) as a mandatory role in organizations that process personal data

California Consumer Privacy Act (CCPA)

Many people believe that GDPR is the spiritual progenitor of the CCPA (California Consumer Privacy Act). The law gives residents of California the right to know the types of personal information businesses collect about them and to object to the sale of their personal data to other parties. But unlike the European regulation, CCPA is largely concerned with the sale of data, not the collection and processing of data as such.

Vermont Act 171 of 2018 Data Broker Regulation

The new law from the New England regulates the activities of brokerage companies. Data brokers must now register themselves with the Vermont Secretary of State on an annual basis, comply with a long list of security requirements and provide customers with a way to opt-out from the sale of their personal information. It’s the first law of its kind in the US.

Virginia Consumer Data Protection Act (CDPA)

Virginia’s Consumer Data Protection Act (CDPA) was adopted on March 2, 2021, and is the second-biggest shift in the US privacy framework after California’s CPPA. It gives Virginia residents more control over how companies use and sell their data. CDPA is a so-called “opt-out law”, which means that under the act consumers need to take action to object to the collection of their data.

Canada’s Consumer Privacy Protection Act (CPPA)

Bill C-11, the Consumer Privacy Protection Act (CPPA) was introduced on November 17th, 2020. The law will amend the Personal Information Protection and Electronic Documents Act (PIPEDA) and give Canadian residents more control over how companies handle their personal information, including the right of private action. It will also more serious consequences for non-compliance.

New Zealand Privacy Act

New Zealand’s new Privacy Bill has replaced the outdated Privacy Act. The new bill implements recommendations from the Law Commission issued in 2011. Among other things, it clarifies how companies dealing with data of NZ residents should handle off-shore data transfers and report data breaches.

Brazilian General Data Protection Law (LGPD)

The Brazilian General Data Protection Law (LGPD) creates a new legal framework for the use of personal data in Brazil, online and offline, in the private and public sector. Many privacy experts compare it to GDPR as both are based on very similar concepts, including consent and robust data subject rights.

India Personal Data Protection Bill

India’s new privacy law is one of the more controversial ones. Experts accuse the draft of many shortcomings and disputable clauses. Among other things, the bill allows the processing of personal data in the interests of the security of the state. It also permits the processing of personal data for prevention, detection, investigation and prosecution of any offense or any other contravention of law.

Singapore’s Personal Data Protection Act (PDPA)

Singapore’s Personal Data Protection Act (PDPA) came into force in 2014. In 2020, the law was updated to include a more robust consent framework and more defined rules around off-shore data transfers. These changes made it one of the strictest data protection acts in Southeast Asia.

Thailand’s Personal Data Protection Act 2019 (PDPA)

The law requires asking for user consent for cookies and other means of tracking based on unique identifiers. You also need to comply with the following principles:

Consent has to be freely given and obtained in written form (e.g. through ticking a box on a consent pop-up)
Users need to be informed about the purpose of data collection (e.g. remarketing, A/B testing or analytics)
The request must be expressed in clear and plain language
Records of consents need to be stored for five years
You can process personal data from before June 1, 2021, if you use it for the same purpose you initially collected it for. However, you have to provide users with a way to withdraw their consents. And if you decide to use or disclose the gathered data beyond the original purpose, you need to get a valid user consent.

ePrivacy Regulation

The ePrivacy Regulation is a law that complements and elaborates the General Data Protection Regulation also known as GDPR. It gives detailed instructions on how to deal with cookies, IoT devices, email marketing and other digital communication channels. At the same time, it replaces Directive 2002/58/EC (also known as ePrivacy Directive).