Time for a Newsroom summarizing everything that’s happened in our usual areas of focus, although we are dropping the last two (Zero-Party Data and Future of media) this time around.  ePrivacy & Regulatory Updates Enforcement On September 5th, the CNIL fined CEGEDIM SANTÉ 800,000 euros for processing health data without authorization. The healthcare software provider collected sensitive personal information, assigning a unique identifier for each patient of the same doctor. This method...

The EDPB has finally adopted its much feared Guidelines on the scope of article 5.3 of the ePrivacy Directive, but consent may still be avoided in some cases not specifically covered by an exemption (e.g., analytics). Absent such an exception, and in light of dismal consent rates, publishers and platforms have embraced highly controversial “Consent or Pay” models. Plan C? Server-side processing (Conversion APIs, Enhanced Conversions, Data Clean Rooms…), not without its own challenges. We...

Dr Lukasz Olejnik (@lukOlejnik), LL.M, is an independent cybersecurity, privacy and data protection researcher and consultant. Senior Visiting Research Fellow of the Department of War Studies, King’s College London. He holds a Computer Science PhD at INRIA (French Institute for Research in Digital Science and Technology), and LL.M. from University of Edinburgh. He worked at CERN (European Organisation for Nuclear Research), and was a research associate at University College London. He was...

Can we leverage AI-generated synthetic data as a privacy-enhancing or data anonymization solution? How compatible is it with Data Clean Rooms? Will there be a path to effectively anonymize unstructured data? Ben Winokur is the co-founder and CEO of Subsalt, the leading platform for anonymous synthetic data. Prior to Subsalt, Ben worked in a variety of legal, product, and operational roles at Passport, where he first encountered the problem Subsalt solves: privacy and security risks have made...

Monica Meiterman-Rodriguez is a Partner at Tueoris, an international privacy and security consulting firm, currently residing in Barcelona. She utilizes her US law degree and her experience in data protection and privacy to assist global clients in developing, maintaining, or growing their privacy programs. She has experience supporting compliance across global regulations including US state and federal requirements, EU/UK GDPR, PIPEDA, LGPD, etc. in addition to advising on specialized...

Simon Hania is Global Data Protection Officer at Uber, heading the team that independently advises on and monitors Ubers compliance with data protection laws. In the past Simon held the position of VP Privacy & Security at TomTom and before that various positions in IT service management. Simon is a trained engineer who has learned to love the law. References: Simon Hania on LinkedIn Masters of Privacy Summer Newsroom, covering Uber’s $290 EUR fine in The Netherlands Glovo (food...

The IAPP’s annual “Privacy. Security. Risk.” event took place in Los Angeles last week. Both Celine Takatsuno and Sergio Maldonado attended, took some notes, and now share their experiences and takeaways.  References: Sergio Maldonado (Medium): PSR 2024 Takeaway (DPAs, Vendor Audits, MHMD Act) Mike Hintze: Blog post series on Washington State’s My Health My Data Act IAPP: Agenda and speakers at PSR 2024.  

Jonathan Mendez has been a founder and leader in Adtech and Martech for two decades, with a focus on building first-party data products to optimize media performance.  He is the founder and CEO at Neuralift AI, having prior to that been Chief Digital Officer at a major cruise line, and having also spent five years building composable CDPs (Customer Data Platform) for global retail brands and telcos. He was also the Founder and CEO of Yieldbot, which in 2016 was the fourth largest Digital...

What extra steps should data processors and controllers worry about now that every cloud-based tool is somehow AI-powered?  A basic transparency principle is common across FIPPs, governance frameworks and existing AI regulations (EU, Colorado), but even that can sometimes become a luxury.  Attorney Heidi Saas (CIPP/US) has over eighteen years of experience in consumer rights, six years in data privacy, and three years of ethical AI and governance experience. Her projects currently involve...

This is our second interview analyzing the impact of Google’s decision not to deprecate third-party cookies on its Chrome browser. Daniel Jaye is a seasoned technology industry executive and currently is CEO and founder of Aqfer, a Marketing Data Platform on top of which businesses can build their own MarTech and AdTech solutions.  Daniel has provided strategic, tactical and technology advisory services to a wide range of marketing technology and big data companies. Clients have included...

Earlier this summer, Google announced that its Chrome browser would after all keep third party cookies. This interview with Robin de Wouters is the first of two episodes exploring the consequences of that update from the point of view of our usual stakeholders (DPOs, CMOs, CDOs).  Robin de Wouters is the Director General for the Federation of European Data & Marketing (FEDMA), in Brussels. He has a strong background in communication and public relations across the private, non-profit and...

Ok, the summer is nearly over, which means it is time for a Newsroom summarizing everything that’s happened in the last two months at the intersection of marketing, data, privacy and technology.  California and the FTC have more specific weight on our list this time around - perhaps because much of Europe, including regulators and hackers, was OOO during the entire month of August. So, expect to hear about: A CDP (Segment) being sued for its data collection practices Uber’s Catch-22 The...

Jay Averitt is currently a Senior Privacy Product Manager at Microsoft, where he manages technical privacy reviews involving Microsoft365 products including CoPilot, GPT, and other LLM products. He was previously a Privacy Engineer at Twitter, where he managed technical privacy reviews across the platform. He’s been working in privacy for over a decade as both a privacy technologist and a privacy attorney. Before switching to technical privacy, he worked as a technology counsel at SAP, SAS,...

Nick Manning is a commentator, author and speaker on advertising, with a specialization in media. He co-founded Manning Gottlieb Media in 1990, and following its purchase by Omnicom he became CEO of the OMD UK Group.  He also co-founded OPera, the media negotiation arm for OMD and PHD. In 2007 Nick joined Ebiquity as Chief Operating Officer before becoming responsible for Ebiquity’s non-UK based operations and Chief Strategy Officer. At Ebiquity he led the team that produced the...

Tony Fish is an investor, author and self-confessed maverick. He has been building digital businesses since 1990, with a first exit in 1995 and many businesses founded, co-founded, sold and listed after that. He thrives in complex, groundbreaking and uncertain environments, being currently focused on rethinking corporate governance models, ethics and AI, data policy and evidence-based decision making in volatile situations. He is a speaker and author of four books, as well as a visiting...

We are closing this season with a Spring Newsroom before we officially kick off the summer, summarizing everything that’s happened in the past quarter across our usual five sections: ePrivacy (enforcement, regulatory updates), MarTech/ AdTech, AI/ Competition/ Digital Markets, PETs/ Zero-Party Data, Future of media.  This includes: EDPB’s ChatGPT Task Force report EU Digital Wallets Privacy Sandbox news EU Commission vs. Apple’s App Store LLM updates (Llama3, GPT 4o, Gemini, Apple...

John Cavanaugh is a founding member of the Plunk Foundation, a non-profit dedicated to empowering individuals and communities so they have autonomy over their digital identities and protect their sensitive information. John is helping promote digital data privacy for women, children, veterans, and marginalized communities. Our mission today: exploring a grassroots approach to privacy or data protection. References: Plunk Foundation John Cavanaugh on LinkedIn Doctor Ruha Benjamin, Race...

Adrian Doerk is co-founder of Lissi GmbH and co-coordinator of the IDunion research project. He has extensive experience in the rollout of digital wallets, specializing in the European digital identity wallet (EUDI-Wallet) under the eIDAS 2.0 Regulation.  Adrian has helped us answer a few important questions on this topic: How much of our lives will soon be intermediated through digital wallets or digital identities? What is “selective disclosure”? What are the privacy risks? What are the...

Does the inclusion of both a private right of action and a general preemption of overlapping state laws (not limited to privacy, but also including AI or confidential information) condemn the APRA to the fire? Brian Focht is a cybersecurity and data privacy attorney practicing in Charlotte, North Carolina. His legal practice is focused on helping clients ranging from individuals to international corporations, and involves nearly every aspect of law that touches on cybersecurity and data...

Can Google overcome competition and performance concerns to make the Privacy Sandbox a reality? Does it really matter in terms of privacy compliance, in the face of the EU ePrivacy Directive? How would Universal Opt-Outs affect the Topics API in the US? Alan Chapell is outside privacy and AI counsel for dozens of AdTech and Mart¿Tech companies. He started his career in the digital space in 1997 at Jupiter Research and is now the principal analyst at The Chapell Report, which is a monthly...

“There is a UK AI Regulation - It is called the UK GDPR” (John Edwards, February 2024). Stephen Almond is Executive Director for Regulatory Risk at the UK’s Information Commissioner’s Office (ICO), leading the teams charged with engineering information rights into the fabric of new ideas, technologies and business models as part of our dynamic digital economy, including through the Digital Regulation Cooperation Forum. Prior to joining the ICO, Stephen led a World Economic Forum initiative...

Amy Worley is Managing Director at BRG, a global leader in data protection, information security, and AI governance. A licensed attorney, certified privacy professional, and certified information systems security professional, Amy formerly served as the Chief Privacy Officer for a billion-dollar pharmaceutical and medical device company and now serves as a fractional Data Protection Officer for several multinational companies.  Amy’s consulting practice is focused on helping clients...

Luke Mulks is VP of Business Operations at Brave Software, makers of the Brave browser. He has previously worked in AdTech and print publishing, and he has also founded a few businesses. He is in charge of new business initiatives and strategic revenue growth and oversees the BAT community.  Our wide-range conversation has encompassed new business models for media owners, privacy-preserving ads, putting a price on personal data, the manner in which Apple’s bottleneck asphyxiates bolder or...

What is Homomorphic Encryption? Can it be leveraged in the context of cross-vertical challenges? Dr. Ellison Anne Williams is the Founder and CEO of Enveil, the pioneering data security startup protecting Data in Use. She has more than a decade of experience spearheading avant-garde efforts in the areas of large scale analytics, information security and privacy, computer network exploitation, and network modeling at the National Security Agency and the Johns Hopkins University Applied...