Search results

[…] of certain types of personal data. Under the amendments, a controller cannot disclose the following types of data in response to a consumer access request: social security number; government-issued identification number (including driver’s license number); financial account number; health insurance or medical identification number; account password, security question or answer; and biometric data. Instead, […]

[…] data minimization paradigm embodied in MODPA, MHMD, and the NYCPA, the collection of data itself is prohibited unless it is deemed necessary for providing a product or service requested by the consumer. In this regard it is closely related to purpose specification. In a substantive model, collection and use is tied to the nature […]

[…] BOARD MEETING June 11–13, 2025 • Washington, D.C. Sovereignty, Localization, and Related Challenges to Effective Cybersecurity Discussion Leads: John Verdi and Jocelyn Aqua SESSION DESCRIPTION An increasing number of regulations seek to restrict or limit organizations’ ability to process data in certain countries or outside of specific jurisdictions. These restrictions are creating significant challenges […]

[…] to tie the collection of personal data, and the processing of sensitive data to what is ” strictly necessary” to provide or maintain a specific product or service requested by the consumer. As we approach that law’s effective date , how are you thinking about compliance? Do you see Maryland’s standard as meaningfully different? […]

[…] hospital protocols and support decision-making in the healthcare sector. Finally, Banco do Brasil is developing a Large Language Model (LLM) to assist employees in providing better customer service experiences. The study also highlights the increasing popularity of commercially available generative AI systems such as OpenAI’s ChatGPT and Google’s Gemini among Brazilian users.  In this […]

[…] process to issue these rules, and engaged with numerous stakeholders and closely monitored market developments to promote consumer interests, innovation, and competition. Ms. Strickland’s testimony lists a number of valuable aspects to the rule, including its treatment of consumer controls, screen scraping, security obligations, and industry standards. Her testimony also highlights five areas of […]

[…] Given the rule’s breadth and depth, many stakeholders weighed in. In response to the proposed rule, over 11,000 comments were submitted. In ad dition to the sheer number of comments, the depth and content of the feedback is noteworthy as well. Many comments delved deeply into several corners of the rule, and were lengthy […]

[…] that is currently law in Maryland and several sectoral laws); and reasonable expectations (the approach taken by California). This rise of substantive data minimization rules raises a number of challenges and unresolved questions, which are explored in Part II. Some of these questions include the role of consent, what is a “requested” product or […]

[…] Age-Appropriate Design Code Act (S.69). Download the Chart Two visions of scope Each AADC’s scope turns on two key provisions – business thresholds tied to revenue and number of affected users, and an applicability standard based on either audience composition or “knowedge” of minor users on the service. Business thresholds Both the Nebraska and […]

phone,,college,and,network,with,hands,on,campus,for,social