As anticipated in our 2024 privacy round up, 2025 has proven to be a defining year for data privacy and the broader digital landscape. Significant developments in AI regulation and cybersecurity have emerged, with legislative...more
Welcome to your monthly rundown of all things cyber, privacy, and technology, where we highlight all the happenings you may have missed....more
On October 9, 2025, the European Data Protection Board ("EDPB") and the European Commission issued (for public consultation) joint guidelines clarifying how the EU’s Digital Markets Act ("DMA") and General Data Protection...more
After a three-week trial, on Sept. 3, a California federal jury found Google liable for two California law-based claims in invasion of privacy and common-law inclusion upon seclusion. The class action, Rodriguez v. Google...more
The CJEU rules that personal data can be pseudonymous in the hands of one party and anonymous in the hands of another....more
The Single Resolution Board ("SRB") transferred pseudonymized comments from data subjects to Deloitte without informing them. The European Data Protection Supervisor ("EDPS") found a violation of information duties applicable...more
On 1 August 2025, the Privacy Commissioner for Personal Data, Hong Kong (“PCPD”), and the Personal Data Protection Bureau, Macao (“PDPB”), in collaboration with seven other privacy and data protection authorities across...more
The Italian Data Protection Authority’s recent decision provided guidance on the true meaning of personal data anonymization and the crucial distinction between the DPO as a monitor – not an executor. In a world driven by AI...more
What new guidance on anonymisation from the UK Information Commissioner’s Office (ICO) means for healthcare and life sciences companies....more
Recently, the European Data Protection Board (EDPB) adopted an opinion addressing key data protection concerns arising from the use of Artificial Intelligence (AI) models. The opinion specifically focuses on how GDPR...more
The Federal Trade Commission (FTC) reiterated its long-held view that hashing or pseudonymizing identifiers does not render data anonymous, in a post to its Technology Blog on July 24, 2024....more
The Federal Trade Commission (FTC) has a long-standing habit of creating legal obligations through blog posts. Recent communications from the FTC by way of its Office of Technology Blog evidence an aggressive expectation...more
Learning Objectives: - Understand the methods for de-identification - Learn about the differences between anonymization, de-identification, and pseudonymization - Understand what “potential for re-identification”...more
In Frank Curry and FOIABuddy v. South Western School District, AP 2024-1311, a school district (“District”) received a request for records related to IT operations, contracts, staff, and IT budget from Frank Curry and...more
On January 30, 2024, the Brazilian Data Protection Authority ("ANPD") released its guide on data anonymization and pseudonymization, including a preliminary studies on the topic (the “Preliminary Study”), for public...more
As we’ve written about before, the question of anonymization can be tricky. When is something “anonymized” or merely “de-identified” or “pseudonymous” — and when does it matter? This is a particularly fraught issue under...more
For deidentification under the traditional laws like HIPAA, removal of identifiers qualifies. That was a key facet of what I discussed last week on an anonymization panel during the IAPP Europe Data Protection Congress...more
Areas of interest include anonymisation, “recognised legitimate interests”, and the ICO’s role. The UK Data Protection and Digital Information Bill (the Bill) sets out the government’s proposals for reforming the current...more
The UK government set out its detailed proposals for data protection reform on 18 July 2022 in the form of the Data Protection and Digital Information Bill. Compared with some of the radical ideas in the 2021 public...more
On July 8, 2022, following the Supreme Court’s decision in Dobbs, the president signed an executive order that called on a number of federal agencies to take steps to protect reproductive rights. He specifically asked the...more
What does the United Kingdom's Information Commissioner's Office's draft guidance say about governance and anonymization? Why is it important for GDPR and for the host of new US Privacy laws, including CPRA, CDPA and CPA? ...more
The UK’s Information Commissioner’s Office (ICO) has issued guidance on pseudonymisation. Here are some key points: What is it? At a basic level, pseudonymisation starts with a single input (the original data) and...more
On November 1, 2021, the Personal Information Protection Law of the People’s Republic of China (the “PRC”) (the “Personal Information Protection Law”) went into effect, two months after the Data Security Law of the PRC (the...more
This article is the second in a multi-part series covering concepts that can be applied to your company’s process for managing privacy rights requests, as required by various modern privacy laws. The first article in this...more
The United Kingdom’s Information Commissioner’s Office has released the second chapter in its anonymization guide for public comment. Here are some key points: An effective anonymization process seeks to reduce the...more