This Week in Data Privacy

This Week in Data Privacy, we're covering a variety of topics, including...

?? Biden's AI Executive Order

?? Google Chrome's IP Address Protection Initiative Impacting Marketers

??? EDPB's Decision Banning Meta's Targeted Advertising Practices

?? U.S. Service Members' Data for Sale Online

?? Ireland DPC's GDPR Decision on TikTok and Children's Data

?? Safeguarding Your E-Commerce Site from Malicious Threats

and...

?? Our latest episode of She Said Privacy/He Said Security, featuring Al Raymond of ZoomInfo !

From the White House: Biden signs, publishes full AI executive order

U.S. President Joe Biden has issued an executive order addressing various aspects of artificial intelligence (AI), including privacy, security, and non-discrimination. The order emphasizes the need to safeguard privacy in AI applications, calls on Congress to pass comprehensive privacy legislation, and requires federal agencies to develop techniques for balancing data accessibility and security. It also seeks to strengthen cryptography protections to enhance privacy and national security. The order mandates that developers share safety test results with the government and sets standards for AI testing, especially in critical infrastructure. Furthermore, it aims to reduce discrimination in AI use, protect workers' rights, and promote competition in the AI sector. While ambitious, the order acknowledges the need for congressional action, as other countries are also advancing AI regulations and standards. Read more.

Challenges Anew: Google Chrome's IP Address Protection Initiative Impacting Marketers

Google is planning to introduce a new feature in Chrome that allows users to hide their IP addresses through proxy servers, a move aimed at enhancing online privacy. This feature, which will initially be opt-in like Apple's "Ask App Not to Track," is designed to address concerns about IP addresses being used for tracking online activity and creating user profiles. While IP address protection is not new and other browsers like Firefox and Safari already offer some protection, Chrome's significant market dominance will make this move impactful, particularly in the realm of marketing.

Despite the accelerating loss of identity signals due to factors like the decline of cookies, industry experts do not foresee major new impacts on marketers. They suggest that marketers have adapted to these changes by finding alternatives to traditional tracking methods. However, Chrome's decision to implement IP address protection will disrupt some solutions that have emerged as alternatives to cookie-based identity resolution.

For the B2B sector, this move may affect account-based marketing (ABM), which has historically relied on matching IP addresses to target accounts. The effectiveness of this approach has faced challenges in recent years due to the changing behavior of business users working from home and using various IP addresses. While the move towards IP protection may provide enhanced privacy, it could also potentially impact personalization, targeted advertising, and other functions offered by ABM providers.

Overall, the move towards IP address protection is expected to make personalization more challenging for marketers. As more users opt for enhanced privacy measures, such as IP protection, marketers will need to find new strategies for reaching their target audiences while respecting user privacy. Read more.

EDPB Issues Decision Banning Meta's Targeted Advertising Practices

The European Data Protection Board (EDPB) has issued an urgent binding decision to ban Meta's data processing for behavioral advertising across its Facebook and Instagram platforms in EU member states and European Economic Area countries. This decision follows a request from Norway's data protection authority to extend a previously issued interim ban across all of Europe. Meta had been found non-compliant with privacy regulations and had faced fines and binding orders. To comply with European data protection rules, Meta had announced a subscription model for ad-free services in the EU but is facing resistance from regulators who doubt the validity of this approach. The fate of Meta's business model has raised concerns in the entire adtech ecosystem in Europe. Privacy experts are closely monitoring this situation with ongoing discussion about the validity of subscription-based consent for data processing in adtech. It's uncertain whether Meta will pursue alternative revenue models or challenge the decision further. Read more.

U.S. Service Members' Data for Sale Online

A disturbing revelation has come to light recently. A Duke University study reveals that personal information about active-duty U.S. service members is readily available for purchase through data brokers, including data like names, phone numbers, addresses, and even details like children's names, marital status, net worth, and credit ratings. Researchers purchased records of nearly 50,000 service members for around $10,000, raising concerns about national security.

Senators highlighted the need for regulatory action to address this vulnerability, with fears that the data broker industry poses a serious threat to national security, as it can be used by foreign spies to identify individuals with access to state secrets. While privacy regulations have focused on consumer privacy, the national security aspect demands attention and regulation. Read more.

Ireland DPC's GDPR Decision on TikTok and Children's Data

Ireland's Data Protection Commission (DPC) issued a final decision against TikTok Technology Limited for its processing of children's personal data, similar to a previous decision regarding Instagram. The DPC found issues with transparency, such as the use of unclear terms like "everyone" and "anyone" in describing who could see a user's account. The DPC also noted that making children's accounts public by default violated the EU General Data Protection Regulation's data protection principles. This case marks the first examination of age-verification measures under the GDPR, showing a focus on children's data and the expectation of risk assessment by organizations processing such data. TikTok was fined 345 million euros, primarily due to the transparency infringement, and the decision is seen as a significant development in the regulation of children's data. TikTok has appealed the decision. Read more.

Cracking The Code: Safeguarding Your E-Commerce Site from Malicious Threats

Businesses collect more personal data than ever before. Hackers have more techniques than ever before to get into your system.

Common threats to e-commerce businesses include:

• Bad bots: Bad bots are software applications that complete automated tasks with the intent to complete criminal activities such as fraud or theft.
• Cross-site scripting: Cross-site scripting (XSS) attacks are a big concern for e-commerce sites when it comes to payment processing. XSS attacks inject malicious code into web pages, which can result in data theft, account hijacking, identity fraud, account hijacking, and other issues.
• Customer journey hijacking: Customer journey hijacking occurs through malware on a user’s device or malicious browser extensions. It causes unauthorized ads to pop up on your website, typically redirecting the customer to another website.
• SQL injection: SQL injection (SQLI) uses malicious SQL code to manipulate a site’s backend database to gain access to stored data, such as sensitive company data or customer data. If successful, an SQLI may result in data breaches or even a hacker gaining administrative access to your database.

The online ecosystem is evolving daily, and businesses must keep up with changes or risk being run aground. However, adapting to e-commerce security needs is a priority; 66% of CIOs plan to increase their investments in cybersecurity. To safeguard your e-commerce site from potential security threats, consider implementing the following strategies:

• Practice Defense in Depth (DiD)
• Scan for Malware
• Use SSL Certificates
• Validate User Input
• Use Web Application Firewalls (WAF)
• Employ a Content Security Policy (CSP)
• Track Site Activity
• Update Data Security Regularly

By implementing these strategies, you can enhance the security of your e-commerce site and reduce the risk of security breaches and cyberattacks. Read more.

?? Listen Up: ZoomInfo’s Al Raymond on B2B Privacy Programs and Third-Party Privacy Risk Management

In this episode of the She Said Privacy/He Said Security Podcast, Jodi and Justin Daniels welcome Al Raymond, Privacy Compliance Officer at ZoomInfo Technologies, to discuss B2B privacy programs and third-party risk management. Al explains privacy laws and data protection in B2B marketing, the challenges in building and maintaining a privacy program, and privacy policies and contracts for data usage.

Here’s a glimpse of what you’ll learn:

• Al Raymond discusses his career path in privacy
• Privacy laws and data protection in B2B marketing
• Challenges in building and maintaining a B2B privacy program
• The difference between B2B and B2C privacy programs
• Privacy policies and contracts for data usage
• Al offers his best privacy and security tips

Listen here.