Major Privacy News in September

Here is a quick summary of some recent major privacy related events around the world in September

A bad month for Big Tech on Privacy Law violations 

        Tiktok is currently facing a potential 27M GBP fine from the UK Information Commissioner's Office for violation of data protection laws regarding the processing of minors' data, unlawful processing of special category data, and insufficient transparency. This comes soon after Instagram was fined 405M Euros by Ireland's Data Protection Commission earlier this month for breaching the GDPR's laws regarding children's privacy, the second largest fine ever under the GDPR. Moreover, Meta (the parent company of Instagram) was also sued by iOS users for bypassing Apple's privacy settings and tracking users' activity on third party websites. Adding in South Korea's $22M fine on Meta (as well as $50M fine on Google) for privacy law violations regarding both companies' collection and use of behavioural information for targeted advertising on Sept 14, it has clearly been a very bad month for big corporations regarding privacy law compliance. These fines also indicate that many countries around the world are starting to crack down on Big Tech's privacy law violations to protect their citizens' privacy.  

More developments in privacy legislation around the world

        In Canada, ew obligations for businesses under Quebec's Bill 64 is now in effect; they include mandatory privacy officer appointments, breach notification, and user consent exceptions. 

        In the US, the American Data Privacy and Protection Act (ADPPA) is under much debate, with supporters in the Congress seeking it pushed forwards for the sake of women's reproductive health privacy after Roe v Wade was reversed by the US Supreme Court. However, House Speaker Pelosi stated she would not hold a vote for the current state of the ADPPA, indicating she wishes to ensure the ADPPA will not hinder California's privacy legislation which is considered the most progressive in the US. Her refusal makes it unlikely that the ADPPA will be passed this year, although it does not mean the bill itself will fail. Children's privacy rights were also strengthened in the US, with the California Age-Appropriate Design Code Act signed into law. This act greatly strengthens children's' data protection rights by making obligating online platforms to consider child users' best interests and setting default privacy settings that protect their mental and physical health and wellbeing. 

        On Sept 20, Indonesia (the fourth most populous nation in the world) passed a new Data Protection bill that includes fines up to 2% of annual revenue, asset confiscation, and potential imprisonment.