After the recent Court of Justice of the European Union decision on sensitive inferences that can be drawn from the name of your spouse, it is fair to ask: Is everything sensitive data (special category data)?
Katie Hewson of Stephenson Harwood and I were duly skeptical earlier this month at the 7th annual INPLP Annual Conference in Vienna, Austria.
But…
- It IS a CJEU decision
- The definition of sensitive information under the new US privacy laws is Article 9 GDPR, plus more
- Sensitive inferences are a point of focus for the Federal Trade Commission and at issue in the new FTC Kochava case
- Sensitive inferences take on a new significance in the wake of the Dobbs decision
- Inferences are personal information and should be included in your response to CA access requests, along with, according to the California Attorney general, a detailed explanation of how the inferences were made (algorithmic transparency)
- Sensitive inferences are addressed in the draft Colorado CPA rules
- The NAI recently addressed them in a guidance regarding the advertising context.
And as a bonus:
- Sensitive inferences could be part of the new CPRA right to limit use of sensitive information, and in the Colorado CPA required opt in.
[View source.]
