FPF in 2023: A Year in Review

As 2023 comes to an end, we want to reflect on a year that saw the Future of Privacy Forum (FPF) continue to expand its presence globally and domestically while organizing engaging events, publishing thought-provoking analysis, providing the latest expert updates, and more. FPF continues to convene industry experts, academics, consumer advocates, and other experts to explore the challenging issues in the data protection and privacy field.

The AI Impact

2023 was the year of AI. We saw AI technologies catapulted into the mainstream with Generative AI tools such as ChatGPT, Google Bard, and others. AI continues to have countries worldwide working to regulate the technology and companies scrambling to figure out how to navigate AI amongst their employees and their products and services.

To respond to the demand for understanding in AI, FPF worked with stakeholders on best practices, provided in-depth training on AI-related topics, and discussed the evolving impact of this technology with many of you at roundtable discussions, expert panels, and more.

Here are some of FPF’s biggest AI moments of 2023:

• Released the Generative AI Internal Policy Checklist, guiding organizations using or developing new generative AI internal policies. 
• Offered practical recommendations focused on responsibility and ethics influenced by leading policy frameworks in our Best Practices for AI and Workplace Assessment Technologies.
• Hosted our first-ever Japan Privacy Symposium where Data Protection and Privacy Commissioners of the G7 DPAs discussed their approaches to regulating AI. 
• Published a step-by-step guide on Conformity Assessments Under the proposed EU AI Act, along with an accompanying infographic in collaboration with OneTrust.
• Discussed alternative solutions for processing of (personal) data with Machine Learning at CPDP Brussels and generative AI systems in Asia-Pacific during Singapore’s PDP Week.
• Participated in a Capitol Hill briefing hosted by the Wilson Center and Seed AI in conjunction with the Congressional Artificial Intelligence Caucus “AI Primer: AI in the Workplace,” highlighting FPF’s Best Practices.
• Provided testimony on the responsible use and adoption of AI technologies in New York City classrooms.
• Published insightful op-eds in WIRED discussing the intersection of AI and immersive technologies and The Hill on generative AI and elections.
• Tracked AI legislation, guidelines, and initiatives in the United States, the European Union, Brazil, and China and highlighted the many DPA investigations into generative AI.
• Held stakeholder workshops on the current regulation of generative AI throughout the APAC region.
• Organized a session at the Global Privacy Assembly on the use of public information for LLM training.
• Relaunched the FPF Training program, providing in-depth expert sessions on topics such as the EU AI Act, the fundamentals of AI and machine learning, and more.

Continuing FPF’s Global Reach

In 2023, FPF closely followed and advised upon significant developments in Asia, the European Union, Africa, and Latin America. We also discussed privacy and data protection with many of you at key conferences and events across the globe, including in Washington, DC, Brussels, Tokyo, Singapore, Bermuda, and Tel Aviv.

As India’s Digital Personal Data Protection Act sprinted through its final stages in August after several years of debates, postponements, and negotiations, FPF provided an in-depth, comprehensive explainer of its important aspects and key provisions, as well as discussed its extraterritorial effects in a LinkedIn Live conversation. The Act also focused on protections for the processing of personal data of children and introduced the concept of “verifiably safe” measures and, FPF in partnership with The Dialogue released a Brief containing a Catalog of Measures for “Verifiably Safe” Processing of Children’s Personal Data Under India’s Digital Personal Data Protection Act (DPDPA) 2023. In partnership with NASSCOM, FPF also hosted a webinar series on the consent regime under India’s new Digital Personal Data Protection Act of 2023.

FPF saw its presence in Asia continue to grow as the FPF Asia-Pacific office entered its third year. FPF and S&K Brussels hosted the first-ever Japan Privacy Symposium in Tokyo, providing insight into the regulatory priorities of the G7 DPAs and global thought leadership on the interaction of data protection and privacy laws with AI. During Singapore’s PDP Week, our Asia-Pacific team held a roundtable on the governance implications of generative AI systems, spoke at the Asia Privacy Forum, and hosted an in-person training on the EU AI Act.

FPF remains consistently active in the European Union, with several engaging events bringing together the European data privacy community and numerous thought-provoking blogs, reports, and analyses published in 2023. FPF launched its in-depth report on enforcement of the EU’s GDPR Data Protection by Design and by Default obligations and hosted our 7th Annual Brussels Privacy Symposium with the Brussels Privacy Hub of Vrije Universiteit Brussel, which included opening remarks by European Commissioner for Justice Didier Reynders and European Data Protection Supervisor Wojciech Wiewiórowski. We also analyzed the regulatory strategies of European DPAs for 2023 and beyond in our continuing series.

We were honored to see our team, FPF VP for Global Privacy Dr. Gabriela Zanfir-Fortuna, Senior Counsel for Global Privacy Katerina Demetzou, and former Senior Counsel for Global Privacy Sebastião Barros Vale, receive the prestigious Stefano Rodotà Award for their paper, “The Thin Red Line: Refocusing Data Protection Law on ADM, A Global Perspective with Lessons from Case-Law.”

In addition, our global experts provided analysis on privacy and data protection developments in Vietnam, Nigeria, Australia, Tanzania, and the African Union and published an overview comparing three regional model contractual frameworks for cross-border data transfers.

U.S. Legislative Activity

In 2023, FPF played a key role in informing regulatory agencies and state legislatures on privacy in various emerging technologies, such as AI. Our experts testified before state legislatures, provided informative analysis, submitted regulatory comments, and more.

We provided recommendations and filed comments with the:

• U.S. Department of Health and Human Services Office for Civil Rights regarding the Notice of Proposed Rulemaking on extending additional protections to reproductive health care data under the Health Insurance Portability and Accountability Act.
• U.S. Federal Trade Commission regarding the Notice of Proposed Rulemaking to clarify the scope and application of the Health Breach Notification Rule, and again regarding the use of “Privacy-Protective Facial Age Estimation” as a potential mechanism for verifiable parental consent under the Children’s Online Privacy Protection Act Rule.
• California Privacy Protection Agency to inform the Agency’s rulemaking to implement the California Privacy Rights Act amendments to the California Consumer Privacy Act’s provisions on cybersecurity audits, risk assessments, and automated decision-making.
• National Telecommunications and Information Administration in response to their request for comment on privacy, equity, and civil rights, and again in response to their request for comment on Kids Online Health and Safety as part of the Biden-Harris Administration’s Interagency Task Force on Kids Online Health & Safety.
• Consumer Financial Protection Bureau in response to their request for comment regarding data portability for financial products and services, and again in response to their Request for Information (RFI) Regarding Data Brokers and Other Business Practices Involving the Collection and Sale of Consumer Information.

2023 also saw developments in various U.S. state commercial privacy laws. We found that the number of state laws increased from five to twelve (or, arguably, thirteen), and in response, provided timely analysis in Iowa, Indiana, Montana, Tennessee, Florida, Texas, Connecticut, Oregon, Utah, and Delaware. In addition, Washington and Nevada became the first to pass broad-based consumer health data privacy legislation. Earlier this month, our Director for U.S. Legislation Keir Lamont took a look ahead at the state privacy landscape in 2024.

For the 13th year, FPF recognized leading privacy research and analytical work with the Privacy Papers for Policymakers Award held on Capitol Hill. The winners spoke about their research in front of an audience of academic, industry, and policy professionals in the field. The event featured keynote speaker FTC Commissioner Alvaro Bedoya.

Youth & Education Privacy

Federal and state policymakers turned to the protection of children online, with President Biden notably mentioning it for a second year in a row during this year’s State of the Union address. 

In partnership with LGBT Tech, we outlined recommendations for schools and districts to balance inclusion and student safety in technology use. Our analysis builds on thorough research, including interviews with recent high school graduates who identify as LGBTQ+, to gather firsthand accounts of how student monitoring impacted their feelings of privacy and safety at school.

Over the summer, we published one of our popular infographics examining age assurance technologies. The infographic’s authors unpacked the risks and potential harms associated with attempting to discern someone’s age online and potential mitigation tools in this LinkedIn Live conversation. 

Privacy by design for kids and teens also expanded globally in 2023. As policymakers, advocates, and companies grapple with the ever-changing landscape of youth privacy regulation, we hosted a well-attended webinar with a wide range of global experts discussing the current state of kids’ and teens’ privacy policy.

The Rise of Emerging Technologies, Examining the Open Banking Ecosystem, & Analysis on Research Data Sharing

As stakeholders became increasingly interested in immersive technologies, notably AR/VR/MR, we responded by releasing the Risk Framework for Body-Related Data in Immersive Technologies, which assists organizations in safely and responsibly handling body-related data. Our team also held a series of webinars exploring the intersection of immersive technology with topics like AI, advertising, education, and more.

In March, we published an infographic breaking down the complex U.S. open banking ecosystem, supported by over a year of meetings and outreach with leaders in banking, credit management, financial data aggregators, and solution providers to comprehensively understand the developing industry of open banking, with the infographic’s authors discussing its privacy implications in a LinkedIn Live conversation.

In 2023, we continued to examine privacy and research data sharing by producing Data Sharing for Research: A Compendium of Case Studies, Analysis, and Recommendations, demonstrating how, for many organizations, data-sharing partnerships are transitioning from being considered an experimental business activity to an expected business competency. We also held the 3rd Annual Award for Research Data Stewardship, honoring representatives from Optum and the Mayo Clinic for their outstanding corporate-academic research data-sharing partnership. During this virtual event, we opened with a keynote address by U.S. Congresswoman Lori Trahan.

Bringing Together Leaders in Privacy and Data Protection

On a different track, FPF also built out a wide range of peer-to-peer meetings and calls for the senior executives working on data protection compliance issues. We hosted virtual meetings on key topics of interest on an every other month basis, smaller meetings for specific sector leaders, and in-person meetings in multiple cities.

• The “Current State of Global Opt-Out Technology” event in March provided members with insights into regulator discussions, along with a vendor showcase featuring solution demonstrations.     
• Hosted 50+ in-person and virtual peer-to-peer meetings across the globe for intimate discussions among privacy executives focused on their top-of-mind issues. 
• Launched Privacy Metrics 2.0 to help advance industry OKRs and the underlying metrics, provide privacy leaders with the tools they need to have effective conversations with their boards, and provide useful information for ESG reporting and investor communications. 

This is by no means a comprehensive list of all of FPF’s important and engaging work in 2023, but we hope it gives you a sense of our work’s impact on the privacy community and society at large. We believe our success is due to deep engagement with privacy experts in industry, academia, civil society, and government and our belief that collaborating across sectors and disciplines is needed to advance practical safeguards needed for data uses that benefit society. Keep updated on FPF’s work by subscribing to our monthly briefing and following us on LinkedIn, Twitter/X, and Instagram.

On behalf of the FPF team, we wish you a very Happy New Year and look forward to celebrating 15 years of FPF in 2024!