Data Privacy Day 2024 – Key Global Developments in Data Privacy and Cybersecurity in 2023 and What to Expect in 2024

* * *

Key 2023 Developments

1. Legislative and Regulatory Developments: While the past year saw fewer new data protection laws introduced than in recent years, many African nations took steps to develop and strengthen their existing data protection frameworks. Some notable developments include:
   • Some African nations have introduced new data protection laws. For example, on December 7, 2023, Malawi introduced Bill No. 22 for the Data Protection Act, 2023, which seeks to provide a comprehensive legal framework for the regulation of personal data.
   • Several data protection laws have come into force. For example, Tanzania’s Personal Data Protection Act came into force on May 1, 2023. Another example is the Nigerian Data Protection Act, which came into force on June 12, 2023, and which applies in parallel with the Data Protection Regulations of 2019. In the event of a conflict between the Data Protection Act of 2023 and the Data Protection Regulations of 2019, the former prevails.
   • Several data protection authorities have issued guidance papers for interpreting their data protection laws. For example, in the last quarter of 2023, Kanya’s Office of the Data Protection Commission issued sector-specific guidelines for the education sector, the communications sector, digital credit providers, and the processing of health data. They cover topics such as the standard of consent, data protection impact assessments, and the registration of controllers and processors. Another example is provided by the Mauritius Data Protection Office, which on November 15, 2023 issued draft guidelines on how financial institutions can comply with the Mauritius Data Protection Act.
2. Malabo Convention: The Malabo Convention entered into force on June 8, 2023. The Convention includes a commitment by African Union member states to adopt data protection and cybersecurity legislation that is consistent with the Convention. The goal is to ensure a certain level of harmonization of laws. The Convention has been ratified by 15 African nations.
3. The Impact of AI on Existing Privacy Frameworks: Radical developments in various AI models are rapidly outpacing Africa’s existing regulatory frameworks, resources, and capabilities. Most African regulators appear to have adopted a wait-and-see approach, closely following developments in Europe and the United States. However, some African nations are launching some initiatives in the field of AI. For example, on December 4, 2023, Côte d'Ivoire's Telecommunications/ICT Regulatory Authority announced that it is conducting a study on the impact of “advanced technologies on the protection of personal data”, in light of the 2013 Law on the Protection of Personal Data. The study will cover, among other things, the development of AI and its professional and private use. As another example, on 9 October 2023, the Media Council of Kenya announced that it had established a task force to develop media guidelines on the use of AI, amongst others.
4. Regulatory Enforcement and Monitoring: There was a significant increase in regulatory scrutiny and enforcement actions across Africa. For example, on July 3, 2023, the South African Information Regulator issued its first administrative fine to the Department of Justice and Constitutional Development for breaching the Protection of Personal Information Act, 2013. The fine amounted to ZAR 5 million (approximately USD 266,000). As another example, the Senegal Data Protection Authority’s third quarterly report for 2023 mentions that the Authority processed 66 files, including 37 declarations and 29 authorization requests, in areas such as video surveillance, website collection, access control, and biometric attendance systems. The report also mentions that the Authority conducted six on-site inspections to verify compliance with the simplified standards that apply to notifications.

What To Expect in 2024

1. Increased Enforcement Actions: The sharp increase in enforcement actions over the past year is likely to continue and increase in the short to medium term. Data protection authorities across the continent are likely to follow the enforcement trends, with a potentially high contagion effect given the fundamental similarities between the various data protection laws across the continent. Enforcement efforts are also likely to increase as a result of partnerships and collaboration between government agencies (e.g., the establishment of a joint enforcement desk for Nigeria's data protection authority and competition authority in 2023).
2. Convergence of Privacy with Competition and Consumer Protection: With African markets critical to the continued expansion of all industries, and with non-US growth likely to outpace US growth in percentage terms for the foreseeable future, there is likely to be increased scrutiny of the impact of technology on consumers and competition, with African regulators questioning whether privacy is one of the many non-price dimensions of competition, such as innovation, quality, variety, service, and advertising. Acquisitions in Africa by large multinational companies are likely to be plagued by legal challenges, where the implications of data accumulation, transparency and control in the digital age have the potential to create new competition law issues. African competition/antitrust authorities are likely to closely follow and seek to emulate recent legal challenges initiated by their counterparts in the EU and the US. Clarity on the boundaries between privacy and competition law will be needed going forward to avoid overlap in enforcement.
3. AI Regulation: In 2024, Africa is likely to follow global trends and mirror developments in Europe and the US, which aim for more comprehensive and nuanced regulation to ensure the ethical use, privacy, and security of AI.
4. Content Moderation: African countries are likely to adopt legislation similar to the EU's Digital Services Act, which requires certain covered intermediary service providers, such as online platforms, to engage in content moderation.

Key 2023 Developments

1. China’s Cross-Border Data Transfer Regime Fully Implemented: China’s cross-border data transfer regime was fully implemented. Companies had until the end of February 2023 to conduct security assessments for data transfers. China also adopted the Measures on the Standard Contract for the Cross-Border Transfer of Personal Information, which became effective at the end of November. However, there is a draft regulation – called “the Provisions on Standardizing and Promoting Cross-Border Data Flows” ─ which, if adopted, will mean that companies will have to implement transfer mechanisms less frequently than they do now. For example, it may not require the implementation of transfer mechanisms if the transfer is for the performance of a contract or for human resources management.
2. China Strengthens Supervision of Generative AI: China issued its first comprehensive generative AI regulation, the Interim Administrative Measures for Generative Artificial Intelligence Services, which took effect in August 2023 and applies to generative AI services provided to the public in China. The measures include requirements on a wide range of topics, including training data, tagging and labeling, data protection, and user rights. Supporting national standards are also underway to implement and specify security requirements related to the supervision of generative AI.
3. The Term “Important Data” Was Further Clarified: The term “important data” has been vaguely defined for some time. In addition to the significant changes proposed to the current data transfer rules, the Regulations on Standardizing and Promoting Cross-Border Data Flows indicate that the identification of important data may be largely a government-led process. Unless a company is informed by a regulator or public notice that the data it processes is important data, the company does not have to consider itself to be an important data processing entity.
4. New Rules and Standards Proposed to Implement the Personal Information Protection Law (“PIPL”): In 2023, China issued several draft regulations and national standards to implement the requirements of the PIPL, including the requirements related to data breach notification, personal information protection audit, and processing of sensitive personal information.

What To Expect in 2024

1. Easing of China’s Cross-Border Data Transfer Regime: China’s cross-border data transfer regulations evolved rapidly in 2023, and we expect the focus on international data flows to continue in 2024. Once the new draft provisions regulating cross-border data flows are finalized and implemented, the thresholds for companies to adopt a transfer mechanism will be raised, so fewer companies will be subject to the requirements to submit a security assessment or adopt the Standard Contract. It remains to be seen how certain exemptions provided in the new rules (e.g., human resources management and contract necessity) will be applied in practice.
2. Further Clarify on Generative AI Rules: Given that China's first generative AI regulation will be finalized in 2023, we expect China to issue more implementing rules and standards related to generative AI services in 2024.
3. Implementation of New Rules and Standards: We expect draft regulations and national standards implementing the requirements of the PIPL to be finalized and implemented in 2024.

Key 2023 Developments

1. Artificial Intelligence Legislative Developments and Enforcement: On December 9, the EU reached a political agreement on the EU Artificial Intelligence Act. This agreement caps an intense year in which AI received significant attention from regulators. In particular, the Italian, Spanish, and Dutch data protection authorities raised concerns about the GDPR compliance of certain generative AI tools, including the legal basis for processing data to train AI. At the EU level, the European Data Protection Board established a task force to monitor developments in this area.
2. New Mechanism for International Data Transfers to the US: On July 10, 2023, the European Commission adopted the EU-US data protection framework (“DPF”), which concludes that the United States ensures an adequate level of protection for personal data transferred from the EEA to US companies certified to the DPF. The US Department of Commerce has confirmed that organizations that have maintained their self-certification to the EU-US Privacy Shield do not need to re-certify to the DPF in order to rely on it, provided they comply with the DPF Principles.
3. Targeted Advertising as Part of a “Pay or Consent” Business Model: On July 4, 2023, the European Court of Justice ruled the personalized advertising with which an online social network finances its activity cannot, in the absence of the data subject's consent, justify the processing of the data in question as a legitimate interest (C-252/21). As a result, companies in the EU are adopting a “pay or consent” business model, which consists of offering two versions of the same service: (i) free but with targeted advertising (and subject to the individual’s consent), or (ii) paid but without targeted advertising. The EDPB is assessing the legality of this model. Some EU data protection authorities have issued guidance on the conditions for relying on the “pay or consent” model.
4. New Cybersecurity Rules: EU institutions have focused their attention on the development and implementation of new cybersecurity initiatives, including (i) the entry into force of the Directive on Measures for a High Common Level of Cybersecurity Across the Union (“NIS2”) and the Digital Operational Resilience Act (“DORA”) on January 16, 2023, which must be implemented by EU Member States by October 17, 2024 and January 17, 2025, respectively; (ii) political agreement on the Cyber Resilience Act (“CRA”), which introduces new cybersecurity obligations for a range of digital products sold in the European Union and is expected to be finalized in the first quarter of 2024; and (iii) open discussions on the Cybersecurity Certification Schemes (“ECCS”), which are currently ongoing and will have an impact on the implementation of NIS2 (e. g., EU Member States may require companies to use products certified under the ECCS), the CRA (e.g., the European Commission may require manufacturers of certain “highly critical” products to be certified under the ECCS), and the Cybersecurity Scheme for Cloud Providers (e.g., covers cloud services instead of IT products; this regulation is still under discussion).
5. Increased Focus on Children’s Privacy: EU regulators to focus on children's privacy initiatives, particularly in the area of enforcement actions. This shift towards enforcement was also motivated in part by the adoption of the Digital Services Act (“DSA”), which imposes obligations related to the protection of children, such as (i) ensuring that covered services provide a high level of privacy, security and safety for minors (e.g., adopting special privacy and security settings by default, as well as setting up parental controls, age verification and other tools to protect children); and (ii) prohibiting the use of targeted advertising and dark patterns in relation to children; among others.
6. Court of Justice of the EU (“CJEU”) Clarification of Key GDPR Doctrines: 2023 has been an active year for CJEU cases, involving judgments that clarify GDPR doctrines relating to non-material damages, right to compensation, right of access to personal, and the right to obtain a copy of personal data under the GDPR. For instance, the CJEU ruled that: (i) the mere infringement of the GDPR is not sufficient to award damages to a data subject (C-300/21); (ii) providing extracts of documents or databases or even entire documents may be necessary to fulfil data subject access requests (C-487/21); and third party data recipients must be specifically named in the information provided in response to an access request, unless providing this information proves impossible or the request is manifestly unfounded or excessive (C-154/21). Importantly for some jurisdictions, such as Germany, the Court ruled that: (i) the imposition of a GDPR fine is possible without concrete evidence of fault on the part of a specific individual (C-807/21); and (ii) a provision in the Hessian Data Protection and Information Act regarding the processing of employee data (which is similar to a provision in the German Federal Data Protection Act) is likely to be invalid (C-34/21).
7. Increased Convergence of Privacy with Competition and Consumer Protection: 2023 has been marked by the adoption and implementation of key EU regulations, including the DSA and the Digital Markets Act (“DMA”), which aim to address growing concerns regarding competition, consumer protection and digital platforms in the online space. The DMA focuses primarily on promoting a fair and competitive digital marketplace, while the DSA addresses the EU's concerns about the growing influence of online platforms in political discussions, disinformation campaigns, the spread of fake news in the run-up to elections, and the societal impact of hate speech. Each operate alongside the GDPR, and this will give rise to some challenging legal questions in the years ahead. In addition, the CJEU has had to consider the competency of EU competition authorities to consider GDPR-related matters. On July 4, 2023, the CJEU ruled that Member State's competition authorities have the power to investigate and determine that a GDPR breach has occurred, where this is necessary to determine that a company has abused its dominant market position (C-252/21). Another example is the joint declaration of the French CNIL and the French Competition Authority to deepen their cooperation, dated December 12, 2024.

What To Expect in 2024

1. Increased Pan-European Cooperation and Enforcement: We are likely to see regulators enforcing the DSA and DMA, as well as more cooperation between regulators on privacy, competition and consumer protection. The European Commission will continue to work with national authorities to improve enforcement of key EU laws, such as the DSA or the Artificial Intelligence Act. With regards to the DSA, for example, on December 19, 2023, the European Commission signed an administrative arrangement with the Dutch Competition and Consumer Protection authority to support the Commission's supervisory and enforcement powers under the DSA, in particular with regard to very large online platforms. This cooperation will focus on practical exchanges of information, data, best practices, methodologies, technical systems and tools with the Dutch authority, and similar arrangements have been signed with other countries such as France, Ireland and Italy. In addition, the European Commission may adopt the GDPR Procedural Aspects Regulation this year, which will streamline the procedural aspects of data protection investigations and is expected to make the GDPR's “one-stop shop” mechanism more effective.
2. EU Privacy Class Actions Uptick: The EU Directive on Representative Actions required many Member States to amend their procedural laws to facilitate collective redress. The Directive is likely to further accelerate the momentum towards collective redress in the EU. The CJEU's recent cases on non-material damages (on which we are drafting a blog post), and in particular its decision confirming that there is no threshold of seriousness for non-pecuniary damage in order to claim compensation under the GDPR, are likely to lead to an uptake of collective redress claims. A number of privacy cases are already pending. For example, in September 2023, two nonprofit organizations filed a class-action lawsuit against Google in the Netherlands, accusing the company of violating European privacy laws, demanding that Google stop tracking and profiling consumers, and also seeks compensation for what it calls “large-scale privacy violations” of the European Union's data protection regime. Since December 2023, a global technology company has been facing a mass privacy lawsuit in the Netherlands over allegations that it illegally placed cookies and shared data. A non-profit organization filed a lawsuit on behalf of 7 million internet users in the country, seeking compensation and demanding that said company delete the data it illegally collected from those users.
3. Further CJEU Clarification on the Interpretation of Key GDPR Doctrines: In 2024, we expect several judgments and cases from the CJEU related to the GDPR. There are currently more than 50 data protection cases pending before the Court. Some of these cases concern: (i) whether individuals whose personal data have been unlawfully onward transferred by a controller have the right to obtain a prohibitory injunction against the controller prohibiting further unlawful onward transfers if the individuals do not request the controller to erase the data (C-655/23); and (ii) what “meaningful” information about profiling must be disclosed by a data controller in response to an access request (C-203/22). In addition, we expect a wave of new privacy-related cases on the implementation of other key pieces of legislation, such as the Data Act, the Digital Services Act, the Digital Markets Act or even the AI Act.
4. Further Guidance and Enforcement Concerning Key Privacy Topics, Such as AI, Children’s Privacy and Cookies: The European Data Protection Board’s (“EDPB”) 2023-2024 work program states that the EDPB plans to publish guidance on: (i) children's data; (ii) processing of data for medical and scientific research purposes; and (iii) blockchain. The data protection authorities will continue to be active on the enforcement front, as seen in 2023 with the increased use of urgent binding procedures by several EU Member States in the area of targeted advertising. The coming into force of the DSA, DMA, Data Act and AI Act may pave the way for increased enforcement actions where personal data is involved. With respect to AI, the EDPB established AI task forces as early as 2023, such as the ChatGPT Task Force, to keep AI chatbots and future AI-related technologies in check. At the national level, EU Member States have issued guidance on specific AI topics, such as generative AI (see France, Germany, Luxembourg, Spain, among others), to ensure the trustworthy development and use of AI systems ahead of the adoption and implementation of the AI Act in the EU. And further guidance and enforcement on AI is expected in 2024.

Key 2023 Developments

1. Regional Legislative and Regulatory Developments: 2023 saw the introduction and coming into force of new data protection laws in the Middle East. We also saw the uptake of some regulators’ enforcement. Notable developments include:
   • Saudi Arabia‘s amended Privacy and Data Protection Law, Implementing Regulations, and Regulations on Personal Data Transfers came into force. Saudi reissued its amended Privacy Data Protection Law and issued implementing regulations, both of which came into force on September 14, 2023. The revised law is more commercially friendly than the previous iteration, and contains many provisions similar to the GDPR. Important differences remain, and there are still areas that need to be clarified by the regulator. The law includes criminal penalties and broad investigative and enforcement powers. Controllers have until September 14, 2024 to ensure processing activities are compliant.
   • Oman’s Personal Data Protection Law came into effect on February 13, 2023. It allows for the transfer of personal data outside the country only in accordance with the controls and measures to be specified in the implementing regulations. The scope of law is more narrow than other regional laws as it applies to a narrower set of personal data.
   • Jordan issued Law No. 24 of 2023 Regarding Personal Data Protection on September 17, 2023, and the law will take effect from March 17, 2024. Implementing regulations will be issued on aspects of the law including: license and permitting requirements, procedures for obtaining consent, and data sharing and disclosure, among other things. All businesses operating in Jordan will need to assess their activities in order to comply with the law. 
   • Algeria’s Law 18-07 on the Protection of Individuals in the Processing of Personal Data started applying from August 2023. The National Authority for the Protection of Personal Data published all the forms and guides such that the law is now fully applicable. Controllers, both foreign and local, have obligations under the law.
   • Qatar’s data protection regulator, the National Cyber Governance and Assurance Affairs (NCGAA), is active in enforcing the Law No. (13) of 2016 Concerning Personal Data Protection. Late in 2023, the regulator launched a privacy by Design assessment tool. Moreover, since all controllers must apply for permission to process sensitive data from the NCGAA, the regulator is now actively fielding submissions and granting the relevant permits.
2. Generative AI Publications: The United Arab Emirates and Saudi Arabia have taken the lead in the region by issuing generative AI guides regarding use cases and ethical principles. Most recently, the Saudi Data and Artificial Intelligences Authority (“SDAIA”) published generative AI guidelines that address the responsible and effective development and use of generative AI and are aimed at developers, users, and other stakeholders. The guidelines incorporate AI ethics principles, but also highlight the risks of AI, including deepfakes and misrepresentation, public safety threats, “hallucination”, data breaches, certification fraud, intellectual property infringement, and the variability of outputs. Several risk mitigation strategies are set out. Jordan has also been recently active in this space, having announced steps for government institutions’ AI readiness.
3. Cross-Border Transfers: The Dubai International Financial Center (“DIFC”) announced in early 2023 that it had issued a first-of-its-kind adequacy decision with respect to the California Consumer Privacy Act of 2018 (as amended). The decision facilitates the transfer of personal data between the DIFC and California-based entities, without the need for additional contractual measures. It is the first time a US state has been found adequate, which could pave the way for other states to be found adequate. Then, in December 2023, the DIFC amended its data protection regulations by adding what's now known as Regulation 10. Regulation 10 is the first regulation in the region to address the processing of personal data by autonomous and semi-autonomous systems, such as AI or generative machine learning technology. Companies operating in the DIFC using AI systems or machine learning models must comply with the requirements of Regulation 10.

What To Expect in 2024

1. Introduction of Implementing Regulations: In 2024, we expect to see implementing regulations for Jordan and Oman. In the UAE and Egypt, we also expect to see developments in implementing regulations and DPA activity. For Saudi Arabia, the SDAIA will provide further guidance on DPO requirements and adequacy to further complete Saudi Arabia's comprehensive data protection framework. The above will provide important clarifications, particularly with respect to international data flow requirements, which companies will need to navigate carefully given the varying obligations across the region.
2. Issuance of Cyber Legislation and Regulations: Now that many data privacy frameworks have been issued, we also expect that 2024 will see an increasing focus on the issuance and implementation of national cyber frameworks and security.
3. More Generative AI Publications: We also expect the region to see more guidelines and standards being issued in relation to generative AI.

Key 2023 Developments

1. The UK's Evolving Approach to AI Regulation: The UK government confirmed in its March 2023 white paper, entitled “A Pro-Innovation Approach to AI regulation”, that it does not intend to pass comprehensive AI legislation and will instead regulate AI through non-binding principles and codes of conduct. Michelle Donelan, the Minister of State for Technology, stated in the UK Parliament on November 9, 2023 that passing a “copycat of EU legislation” (i.e., the EU Artificial Intelligence Act) would put her country behind the pace of development of AI systems. Meanwhile, the UK hosted the first AI Safety Summit at Bletchley Park, which brought together government and industry leaders to discuss the risks of AI and how to mitigate them through internationally coordinated action, resulting in the Bletchley Declaration.
2. Increased ICO Enforcement, Specifically on Artificial Intelligence and Cookies: On November 21, 2023, the UK's data protection authority (the ICO) warned some of the UK's most popular websites that they will face enforcement action unless they make it as easy for users to “Reject All” advertising cookies as it is to “Accept All”. In addition, the ICO sanctioned a generative AI chatbot in October for failure to identify and assess the privacy risks to millions of users, including children.
3. Updates To The UK Cyber Security Framework: On September 14, 2023, The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023 (“PSTI Regulations”) were passed into UK law, which create new security requirements for connectable products (i.e., devices that connect directly to the internet, and other Internet of Things devices). The PSTI Regulations are similar to the EU's proposed Cyber Resilience Act, and introduce a limited set of baseline security requirements on all in-scope products which will apply from April 29, 2024. Notably, the UK has not yet provided any update on its proposed revisions to the NIS Regulations.
4. Clearview Wins Appeal Against ICO Decision: On October 17, 2023, the UK’s first-tier tribunal allowed Clearview AI’s appeal against the ICO’s May 2022 fine of £7.5m, finding that Clearview’s processing of UK individuals’ images to provide facial recognition services to foreign law enforcement agencies fell outside the scope of the UK GDPR. While the decision is specific to the facts, it is an rare instance of a narrow interpretation of the territorial reach of European data protection law. On November 17, John Edwards, the UK’s Information Commissioner, announced the ICO's intention to appeal the first-tier tribunal’s decision.
5. The Online Safety Act Passes into Law: On October 26, 2023, the UK’s Online Safety Bill received Royal Assent, becoming the Online Safety Act (“OSA”). The OSA imposes various obligations on tech companies to prevent the uploading of, and rapidly remove, illegal user content—such as terrorist content, revenge pornography, and child sexual exploitation material—from their services, and also to take steps to reduce the risk that users will encounter such material.
6. ICO Targets Dark Patterns: On August 9, 2023, the ICO and the UK's competition regulator published a joint paper setting out concerns and expectations relating to “dark patterns”—techniques designed to mislead or deceive users of online services—which the regulators refer to as “harmful online choice architectures”. The joint paper complements the ICO's Age Appropriate Design Code, which includes explicit obligations in relation to certain dark patterns, such as “nudge” techniques, while processing children's data.

What To Expect in 2024

1. UK Seeks to Diverge from GDPR Through the DPDI Bill: The UK government announced on November 7, 2023, in the King's Speech, that it intends to take the first steps towards diverging from the GDPR by passing the Data Protection and Digital Information No. 2 Bill (“DPDI No. 2 Bill”) before the next general election, which must take place before January 28, 2025. The DPDI No. 2 Bill (which is the government's second attempt to reform the UK GDPR) will include structural reforms to the ICO, updates to expand the scope of data processing for scientific and technological research, and changes to the cookies rules.
2. Automated Vehicles Take Center Stage: The King's Speech also announced the government's intention to progress the Automated Vehicles Bill (the “AV Bill”). The AV Bill implements the recommendations of a 4-year review of regulation for automated vehicles, which received responses from industry stakeholders including original equipment manufacturers, developers of automated driving systems and fleet operators. If passed, the UK could have a broad regulatory regime for automated vehicles before other significant jurisdictions, such as the US and China.
3. ICO Gears Up Enforcement: The ICO increased its enforcement footprint across several areas in 2023, including AI, dark patterns and cookies. We expect this trend to continue in 2024. In particular, we may see enforcement of the cookie rules following the ICO's warning to websites in November 2023. The ICO is also likely to continue its focus on children's data. On 18 January 2024, the ICO published a revised opinion on age assurance under the Age-Appropriate Design Code, responding to developments in UK law—in particular, the Online Safety Act—and technological developments, such as AI.
4. AI Continues to be a Focal Point For Regulators: On January 15, 2024, the ICO announced the launch of a consultation series on how elements of data protection law apply to the development and use of generative AI models. The ICO as also initiated an investigation of bias from the use of AI recruitment tools by employers. Other regulators, such as the CMA, also are reviewing this area, including in relation to foundation models.
5. Online Safety Act Will Bare its Teeth: 2024 will see Ofcom, the UK communications regulator, publish a series of codes of conduct that will assist tech companies in complying with the Online Safety Act. Responses to the first set of draft guidance and codes are due by February 23, 2024. Ofcom intends to finalize its codes of practice by early 2025 at the latest.
6. Updated ICO Guidance: We expect the ICO to publish updated guidance on biometrics, employment data, and data transfer risk assessments to the US following public consultations on these topics in 2023.

United States

Key 2023 Developments

1. New State Privacy Legislation: States continue to lead the charge on privacy legislation in the U.S. Seven states passed comprehensive privacy laws in 2023, and at least 20 others introduced and considered similar legislation. Montana, Texas, Florida, and Oregon laws come into effect in 2024, while other states’ laws become effective in subsequent years. Generally, these state privacy laws contain robust privacy notice requirements, data subject rights, heightened protections for sensitive data, and opt-out requirements for the sale of personal data or the processing of personal data for targeted advertising. During 2023, California also enacted the Delete Act, expected to go into effect in August 2026, which implements enhanced reporting requirements and requires the California Privacy Protection Agency to establish a centralized mechanist to request deletion of personal data from data brokers – that is, businesses that “knowingly collect and sell to third parties the personal information of a consumer with whom the business does not have a direct relationship.”
2. Increased Web Tracking Litigation: 2023 brought a wave of private litigants making claims against businesses based on use of various web services and analytics technologies, including pixels, chat features, and session-replay tools. Litigants have pursued recovery under a variety of theories, including privacy torts and state and federal wiretap laws. While defendants should have a variety of defenses to these types of claims, plaintiffs’ lawyers aggressively pursued these types of claims and had some successes in withstanding motions to dismiss.
3. New Laws Protecting Consumer Health Data: Washington state and Nevada have enacted laws to protect consumer health data that will come into effect in 2024, and Connecticut has amended its comprehensive privacy law to add additional protections for consumer health data. A number of states, including Montana, Virginia, Texas, and Tennessee, have passed genetic privacy laws in 2023 that seem targeted to direct-to-consumer genetic testing companies, although the Montana law is broader in scope.
4. Strengthening Laws on Children’s Data: In addition to being considered a component of sensitive data in some state privacy legislation, the use and disclosure of data from kids under 13 years of age is the focus of proposed enhancements at both the federal and state level. At the federal level, the Federal Trade Commission (“FTC”) has issued a notice of proposed rulemaking under its Children’s Online Privacy Protection Act rules to require children-directed sites and services to turn off targeted advertising by default, establish written protocols for safeguarding minor’s data, and refrain from requiring minors to provide their information in exchange for a service. The Children and Teens Online Privacy Protection Act (“COPPA 2.0”) was placed on the Senate’s Legislative Calendar in mid-December 2023 – if enacted, it would expand existing protections to include minors between the ages of 13 and 16 years, ban targeted advertising to this demographic, and limit the personal information companies can collect and retain. At the state level, several states introduced social media regulations for minors in 2023, following California’s 2022 Age Appropriate Design Code Act (“AADC”). Among these, Utah, Arkansas, and Texas enacted laws requiring express parental or guardian consent before social media companies provide accounts to minors. Additionally, Utah enacted a law that creates liability for social media companies that create services that are addictive to minors. The Utah laws are scheduled to take effect in March 2024. The Texas law is scheduled to take effect in September 2024. Federal courts blocked the Arkansas and California laws and the California law is pending appeal.
5. More Enforcement on Biometric Privacy: There have been developments in biometric privacy enforcement at both the federal and state levels. On May 18, 2023, the Federal Trade Commission released a policy statement addressing risks to consumers stemming from misuse of consumers’ biometric information and highlighting practices that it deemed unfair or deceptive. In December, the Commission filed a complaint against Rite Aid based on the company’s use of facial recognition technology to identify and deter potential shoplifters, alleging in part that Rite Aid’s failure to address risks to consumers resulting from Rite Aid’s use of such technology constituted an unfair practice. Additionally, the Illinois Supreme Court held in Cothron v. White Castle that claims under the state’s Biometric Information Privacy Act accrue with each collection of protected data in absence of prior informed consent. This ruling has magnified damages that private litigants can pursue under the law. Note also that biometric data is regulated under the consumer health data laws discussed above.
6. New Artificial Intelligence Legislation: Although not all within the privacy law context, and some with narrow applications, fifteen states and Puerto Rico enacted legislation or adopted resolutions addressing various aspects of AI, including assessment mandates, overseeing AI development and deployment, and prohibiting AI from having legal personhood. The California Privacy Protection Agency proposed draft rules that would give consumers the ability to obtain more information about the use of AI technology and to opt out of allowing companies to develop AI using consumers’ personal information and. On the international plane, the U.S. and U.K cybersecurity officials, with the support of agencies from more than 15 countries, announced guidelines with the goal of ensuring the secure development and deployment of AI technologies.
7. New Cybersecurity Requirements. The U.S.’s sector-specific approach to cybersecurity and breach notification requirements continued to evolve during 2023, imposing broader (and quicker) breach notification requirements as well as more specific data security requirements across a number of industry sectors. Following the release of the updated National Cybersecurity Strategy in March that called for federal agencies to exert their authorities to regulate cybersecurity practices within their respective sectors, numerous regulators, including the FCC (for telecommunications providers) and the FTC (for certain health data, financial data, and children’s data), proposed or finalized updates to sector-specific cybersecurity requirements or breach notification standards, while CISA released detailed guidance on key cybersecurity topics such as security by design and supply chain security. The FTC’s proposed updates to its Health Breach Notification Rule and COPPA Rule, as well as finalized updates to its GLBA Safeguards Rule, come on the heels of FTC enforcement actions in many of these industry sectors that focused on breach notification and data security issues. Other regulators were active in both enforcement and rulemaking efforts, including the U.S. Securities and Exchange Commission, which released its long-anticipated cybersecurity disclosure and reporting rules for publicly-traded companies in addition to pursuing high-profile cyber-focused enforcement actions in 2023. In addition, the New York Department of Financial Services finalized amendments to its cybersecurity regulations, which will require licensed finance and insurance companies to comply with additional cybersecurity governance and reporting obligations.

What To Expect in 2024

1. More State Legislation and Regulation: The New Jersey legislature became the first state body to pass a comprehensive privacy law in 2024 when it approved SB 332 on January 8, 2024. The bill, signed by Governor Murphy on January 16, 2024 and expected to go into effect in January 2025, will apply to those businesses that control or process the personal data of at least 100,000 New Jersey consumers or those businesses that control or process the personal data of at least 25,000 New Jersey consumers and “derive[ ] revenue, or receive[ ] a discount on the price of any goods or services, from the sale of personal data.” Additionally, the California Privacy Protection Agency continues to consider new rules that would address profiling and automated decision making and privacy risk assessments. We also are watching to see how those states that already have privacy laws in effect approach enforcement.
2. Laws Protecting Consumer Health Data Come into Force: Businesses are preparing to comply with new consumer health data laws in Washington and Nevada that come into effect as of March 31, 2024. For example, the Washington My Health My Data Act (“MHMD”) imposes several privacy obligations on regulated entities, including opt-in consent for the collection of consumer health data, separate consent for the sharing of consumer health data, and consumer health data privacy policy requirements. MHMD includes a private right of action. It’s also possible that we will continue to see FTC enforcement and additional legislative activity focused on consumer health data.
3. Enforcement of Artificial Intelligence: In 2023, the FTC moved to approve a new process to facilitate its investigations over AI-related products and services, and opened investigations into use of personal data in the AI context. It is likely that they will continue to pursue such actions leveraging the processes they have initiated in the previous year. Furthermore, federal policy developments currently focused on the public sector could influence best practices for AI governance in the private sector. President Joe Biden issued an executive order and the Office of Management and Budget released a proposed memorandum – both of which focus on developing AI usage standards and governance to manage the risks associated with the use of AI.
4. New Cybersecurity Requirements Come into Force: Following the wave of new and proposed cybersecurity regulations in 2023, many of these new requirements will enter into force during 2024, creating an increasingly complex web of cybersecurity and incident notification requirements that entities must be prepared to comply with. Several of these regulators, including the SEC and FTC, have demonstrated a continued interest in cybersecurity-related enforcement actions, which may continue in 2024 as regulated entities are required to report an increasing number of incidents to regulators. Additionally, pursuant to the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”), the Cybersecurity and Infrastructure Security Agency (“CISA”) is expected to publish a notice of proposed rulemaking by March 15, 2024 that will propose reporting requirements for critical infrastructure entities to report certain types of cybersecurity incidents and ransomware payments. To the extent that CISA rules duplicate existing incident reporting requirements, including the FCC rules, 2024 may signal changes in incident reporting requirements as agencies attempt to coordinate information sharing mechanisms and harmonize sector-specific cybersecurity requirements.
5. Privacy Laws Shaped by Web Tracking Rulings: The 2023 wave of private claims against businesses based on the use of various web services and analytics technologies will likely result in rulings in 2024 that will continue to pave the development of privacy law. The anticipated rulings will illustrate how courts will respond to standing and other specific threshold issues.

If you have any questions concerning the material discussed in this client alert, please contact the members of our Data Privacy and Cybersecurity practice.