New State Laws, New Spin on Requirements

Among the four newly passed comprehensive privacy laws signed in April and May–Kentucky, Maryland, Minnesota, and Nebraska—there are new takes on some common requirements from the existing laws and some entirely new requirements. New Takes on Recent Trends Right to a list of specific third ...

Selling Privacy to Executives

Every organization regularly has to consider budgets. It’s simply a fact of life that companies must determine how best to allocate resources. Privacy professionals know this all too well. Asking for more budget for basic operations, let alone any special projects or new initiatives that need to ...

Some old, some new requirements in NH and NJ laws

Two new US state laws have been approved for New Jersey and New Hampshire already this year. As part of our commitment to keeping up with the latest law requirements, we have pulled out a few takeaways. Quick Overviews The essence of the New Jersey and New Hampshire privacy laws, otherwise referr...

Balancing user convenience and consent in system updates

Over Thanksgiving, a Facebook post from a local community police department caught my attention, warning about an automatic feature called NameDrop in the Apple iOS17 update. Once I returned to work, I decided to delve into the issue surrounding this automatic feature. It also reminded me that th...

Privacy Ref and CyberDefenses Bring Privacy and Security Together

There is a saying that you can have security without privacy, but you cannot have privacy without security. While privacy and security are both concerned with the protection of information held by an organization, security provides the means to meet the business requirements identified to meet pr...

Privacy Impact Assessments: Organization-specific or Generic PIAs

I recently had a conversation with a colleague about privacy impact assessments, PIAs, and the tools available to administer them. We quickly became philosophical, trying to weigh whether a generic tool would work or if something that is organization specific is necessary.

Safe Harbor Found “Invalid”, Now What?

Transferring personal information from the EU to the US has been a challenge. Today it may have become more difficult with the EU Court of Justice finding that Safe Harbor is invalid. For those 4,000 or so businesses that use Safe Harbor for data transfers the question  is how to go ahead.

Tom Brady, Joe Namath, and Privacy

Like many Americans I grew up idolizing football players, quarterbacks in particular. Joe Namath and Tom Brady are among those I have enjoyed watching play. Who would of thought that these two men who played in different eras would provide examples for a privacy discussion for business.

Crisis Communication Plans and Data Breaches

Think of a data breach as not only a possibility, but also a likely crisis scenario for your company. A breach will cost your company not only money but can deeply damage its reputation. When was the last time your company reviewed its crisis communication scenarios and, most importantly, added d...

“It’s only an email address!”

Facebook, Ubisoft, and Morningstar are all recent examples of data breaches that involved the unauthorized release of email addresses. In one of several conversations I have had about these events some people could not understand why others were upset about the release; after all, they are only e...