Metaverse Law – Page 2 – Metaverse Law

20 May

Does GDPR Apply to US Citizens?

The General Data Protection Regulation (GDPR) is the most detailed data privacy legislation that Europe has ever passed. It took effect on May 25, 2018, and flipped the digital landscape.

In this legislation, all individuals and institutions in Europe are bound to GDPR compliance in protecting the personal information of its clients. The European Union created this regulation to ensure that the personal privacy rights of European citizens are protected at the EU level GDPR requirements create a uniform system of rules for data processing activities.

This article will further discuss the scopes and limitations of GDPR as it is applied to the US and its citizens.

United States (US) Inclusion to GDPR

While it is based on European Union (EU) legislation, this ground-breaking data security and privacy regulation extends significantly beyond the EU’s and the European Economic Area’s geographical borders (EEA). In some areas, it encompasses the United States of America, the EU’s second largest trade partner.

The GDPR’s entire purpose is to safeguard the personal data of EU citizens and residents. As a result, the legislation extends to entities that manage certain data regardless of whether they are in the EU, a concept recognized as an “extra-territorial effect.”

As specified in Article 3 of the GDPR, the law’s geographical reach is not limited to businesses in the EU/EEA. The legislation extends the GDPR’s processing rules to businesses based outside of the

EU/EEA if the following two requirements are met:

Provides goods or services to EU/EEA citizens (even in the absence of commercial transactions); or
Controls or tracks the activities of consumers inside the EU/EEA.

Therefore, organizations in the USA and other countries worldwide are covered under this regulation as long as they meet one of the above-mentioned conditions.

If a US business is required to comply with the GDPR requirements, it has the same stringent conditions as businesses based in the EU.

The GDPR regulates personal data processing activities in a variety of ways. Personal data can include identities, contact numbers, computer details (e.g., IP addresses, position data), biometric data, images, and videos.

US Citizens Inclusion to GDPR

Does GDPR apply to US residents? It’s perplexing to think about what occurs when Americans enter a country in the European Union considering the EU’s General Data Protection Regulation (GDPR). Does this legislation cover them?

Since the GDPR is a European Union law, it is easy to think that it just refers to all citizens of the Union. That is not entirely the case. Citizenship has little bearing on the GDPR’s geographical scope, and the GDPR never uses the terms “citizens” or “residents.” Instead, the GDPR simply refers to data subjects “in the Union,” with data subjects defined as “an identified or identifiable natural person.”

GDPR is not expressly concerned with an individual’s status as an EU resident. GDPR protects someone who lives in or visits an EU region. If an American travels to France, make a transaction in a shop, and are asked to include their name and address on an invoice, the shop must protect their information per GDPR requirements. They must be granted the same GDPR privileges and freedoms as all EU residents.

Individuals are granted certain privileges and liberties under the GDPR. The legislation imposes some restrictions on how businesses can use the personal details. It makes no difference where the business is located or has an office in any EU country. The regulations of GDPR exist whether a company collects or handles the personal data in the Union.

There is currently no law in the United States that protects the privacy of all citizens, only select categories of people, or industries. The Health Insurance Portability and Accountability Act (HIPAA), for example, establishes security measures to safeguard the privacy of patients and health plan members. It is applicable only with confidential health information gathered, processed, used, or transmitted by a HIPAA-covered body.

GDPR compliance will be easier for HIPAA-covered organizations if they apply the same standards in protecting all concerned individuals and their records. Adopting a more holistic approach to data security is more important to meet the GDPR requirements.

Relationship Between Location and Citizenship

The GDPR is location-based, not citizenship-based. The distinction between citizenship and place exists when we discuss non-EU people residing in the EU versus EU citizens residing beyond the EU, or when the good or service is provided inside or outside the boundaries of the EU.

Recital 14 of the GDPR notes that “This Regulation shall extend to all natural persons, regardless of their ethnicity or place of residence, concerning the collection of their personal details.” Below are example scenarios where GDPR can be applied:

Scenario 1:

A US citizen is on holiday in Germany. He places an online order for dinner from a Berlin restaurant and delivers it to the hotel where he is staying.

The GDPR legislation applies to this scenario since the ‘data subject’ (US citizen) is in an EU country and is supplying personal data for a good or service in the EU. The citizenry of the data subject is not significant.

Scenario 2:

A US citizen residing in Spain visits the website of a US clothing retailer and places an order for a dress, specifying her EU delivery address. The US clothing retailer advertises that it sells to Spain and offers the dress for sale in Euros.

The GDPR applies since the (i) data subject is currently residing in the EU, (ii) orders using an EU address and (iii) the US clothing retailer offers its goods to individuals in the EU. In this scenario, both the citizenship of the data subject and the store’s location are not significant.

Conclusion

GDPR plays an important role because it strengthens the security of European data subjects’ rights and clarifies the obligations of businesses who handle personal data to respect these rights.

The GDPR requirements center on the data processing activities, not citizenship, it includes personal data and information gathered from any EU country and includes either an EU or non-EU resident who is living or visiting an EU.

Any US business or company serving customers in the EU/EEA — or tracks their behaviour within this region — should consider GDPR compliance. The legislation protects US citizens who use their information abroad in the EU.

GDPR compliance comes with strict measures to penalize non-compliant businesses and organization if they fail to meet the GDPR requirements. giving this legislation a fang to regulate and protect EU data privacy values against violators.

16 Mar

The Importance of Data Privacy For Protecting Business and Client Information

Metaverse Law

Privacy Law

If you own a business that demands you to understand what data privacy is and how it affects you, then now is the time for you to get informed. It has much to do with maintaining an acceptable level of trust between organizations and clients. Data privacy compliance has a framework involving a set of guidelines that require business institutions to integrate into their security system as per several state and federal laws on varying levels.

What Is Data Privacy?

Data privacy is a general concept that governs the handling, storage, access, and preservation of sensitive information or data. It is also referred to as information security or information control.

In technical terms, it is a system designed to govern the handling, processing, distribution, safety management, and ownership of valuable digital information. This information may include personal details, such as credit card numbers, financial transaction details, and other facts accessible through digital systems that privately belong to individuals or organizations.

Data safety protocols and processes are imposed by the privacy protection laws in different countries. These laws ensure the legality of the use of sensitive personal information and provide guidelines for proper handling, storage, and transmission of such information. This ensures that the benefits derived from the various programs implemented by the organizations are legit and are not being abused to serve selfish ends. The process of implementation varies from each country or region and thus, different laws are governing data privacy issues in different parts of the world.

Data Security

Protecting Business and Client Information

Data security is the practice of protecting data and maintaining the privacy of information, which obligates an organization to secure data at its source or to ensure the privacy of data in transit and throughout its lifecycle. This practice protects confidential information whether it is transmitted over the internet or through private networks. It also governs how organizations can safeguard corporate assets against corruption and unauthorized access. These have become more important with the growth of sophisticated data encryption technologies, which have made the transmission of sensitive corporate information more secure.

There are certain conditions recognized by countries across the world and are enforced by each government. They include the responsibilities of service providers to take reasonable measures to ensure the confidentiality of communications and related data, protection against data leaks and interference, and protection against the abuse of personal information. Aside from these, several laws address the rights of businesses to protect their clients’ private information. These include the right to secure network systems, secure the confidentiality of information, and providing clients with the right to access and see the documents that have been sent to them.

Data Compliance

Data compliance ensures the correct practice of data privacy along with legal and governmental regulations. If organizations are not complying with the regulations stated by the federal or state government, then they are going to find themselves out of compliance, and the clients, customers, and employees might also be bound to some legal stipulations.

Companies that fail to comply with the legal conditions of data privacy may be sanctioned, which may include fines or other penalties. There are many legal defenses available to business owners who are accused of not being able to guarantee the confidentiality of their data. For example, a business owner may use a server that is situated abroad to facilitate trade for his company. Similarly, a person who has concerns about how a product or service obtained by purchasing online could use data protection tools and safeguard his privacy.

Businesses need to stay abreast of any changes to data protection laws and the only way for a business to satisfy data compliance is to adhere to the latest privacy law of a particular state.

Why Is Data Privacy Important?

For starters, data privacy equips an organization to responsibly handle and protect the information of an entity or individual. Therefore, it implies the accountability of the responsible party, whether the organization, government, or a private entity, to protect any information that may be related to all transactions from unauthorized use, mishandling, and/or disclosure.

How Does One Understand and Appreciate The Need For Privacy?

A company’s data privacy can be interpreted as the confidence towards the organization in communicating sensitive data or information to its customers and partners. As such, companies that want to be considered most trustworthy will have to be reliable enough and have the integrity to follow data privacy protocols. This way, consumers can be reassured that their data is taken care of while they are using the company’s services. Secondly, data privacy also has to do with keeping suppliers and other business operations well within the law by ensuring compliance with regulatory requirements.

Data Privacy For Businesses and Organizations

A business or organization must establish certain rules governing the use of private data for marketing, product research, customer contact, and evaluation, etc. For instance, when these valuable data are stored in company computer systems, the company and its employees are bound to respect the privacy set by data protection laws and make it impossible for anyone to commit unethical and illegal breaches.

Whether you are a business or a consumer, how do you ensure your data is protected?

You can guarantee security for your data through a security program installed into the organization’s computer and network system. There are many companies providing data security services to keep private information private and safe and ensure that the protocols follow state or federal laws. An organization’s IT department should be able to maintain the data privacy protocols regularly. This will keep the system running as smoothly as possible without the constant imminent threat of a data breach.

Summary

Data privacy compliance is highly necessary for organizations to avoid breaking the law or risking their businesses and their clients’ personal information. Users are advised to follow basic personal data protection like using passwords whenever they transfer personal information online and use safety protocols when using public networks. It is up to the user to implement data privacy into the system and follow professional data security advice.

Find out which privacy laws impact your business. Metaverse Law specializes in privacy, data protection, and cybersecurity law to assist startups and multinationals across the country in the high-tech, digital marketing, healthcare, and e-commerce industries with their privacy and data security obligations. Visit us here today to learn more!

14 Apr

China’s 2020 Cryptography Law in the Context of China’s Burgeoning Data Privacy and Security Regime

Metaverse Law

China Privacy Law, Cybersecurity, Privacy Law China CSL, China Encryption Laws, Chinese Privacy Laws, Network Operators, Personal Information Security Specification

[Originally published as a Feature Article: China’s 2020 Cryptography Law in the Context of China’s Burgeoning Data Privacy and Security Regime, by Carolyn K. Luong, in Orange County Lawyer Magazine, April 2020, Vol. 62 No.4, page 31.]

By Carolyn Luong

U.S.-China relations have been a trending topic throughout the past year due to several conflicts involving the alleged encroachment upon free speech principles and perceived threats to U.S. national security. The NBA and Activision-Blizzard, both U.S.-based organizations, fielded criticisms in October of 2019 for supposed political censorship motivated by the fear of losing Chinese customers. Furthermore, as the U.S. races to build out its 5G infrastructure, the U.S. government has explicitly restricted U.S. corporations from conducting business with Chinese technology manufacturer Huawei upon apprehension that Huawei equipment may contain backdoors to enable surveillance by the Chinese government.[1]

Dr. Christopher Ford, Assistant Secretary of the U.S. State Department’s Bureau of International Security and Nonproliferation remarked in September that, “Firms such as Huawei, Tencent, ZTE, Alibaba, and Baidu have no meaningful ability to tell the Chinese Communist Party ‘no’ if officials decide to ask for their assistance—e.g., in the form of access to foreign technologies, access to foreign networks, useful information about foreign commercial counterparties . . . .”[2] These Chinese firms in response firmly deny any allegations of contemplated or actual instances of required cooperation with the Chinese government to compromise user information or equipment.

11 Oct

California Attorney General Releases Proposed CCPA Regulations

Metaverse Law

California Privacy Law, Privacy Law ADA Website Compliance, American Disabilities Act, California Consumer Privacy Act, CCPA, CCPA Regulations, CCPA Rulemaking

Image Credit: 3D Animation Production Company from Pixabay

California Attorney Xavier Becerra unveiled highly-awaited regulations on October 10, 2019 to enforce the California Consumer Privacy Act, a sweeping new privacy law set to take effect on January 1, 2020.

The text of the CCPA proposed regulation is available here. As a few highlights, the proposed regulation:

Defines “categories of sources” and “categories of third parties” to include consumer data resellers, among other types of entities. This shows the Attorney General’s increased scrutiny on data brokers.
Requires privacy notices to “[b]e accessible to consumers with disabilities” and “[a]t a minimum, provide information on how a consumer with a disability may access the notice in an alternative format.” This is consistent with recent trends towards ADA website compliance.
Requires businesses to either (1) notify consumers of the sale of their data, if they collected the data from third party sources, or (2) confirm or receive signed attestations from the source describing how they provided a notice of collection.
Requires greater offline rights to notice and opt-outs of sale, for businesses that substantially interact with consumers offline.
Contemplates a button or logo opt-out in a modified version of the regulation.
Recognizes the security risks of providing specific pieces of information in response to a request, with requirements around verification of identity and security of transmission.

Individuals and businesses interested in shaping the final CCPA regulations can attend public hearings or send comments by mail or email to the following:

Email: PrivacyRegulations@doj.ca.gov
Privacy Regulations Coordinator
California Office of the Attorney General
300 South Spring Street, First Floor
Los Angeles, CA 90013

The public hearing dates and locations are as follows:

Public Hearing Dates	Locations
Sacramento December 2, 2019 10:00 a.m.	CalEPA Building Coastal Room, 2nd Floor 1001 I Street Sacramento, CA 95814
Los Angeles December 3, 2019 10:00 a.m.	Ronald Reagan Building Auditorium, 1st Floor 300 S. Spring Street Los Angeles, CA 90013
San Francisco December 4, 2019 10:00 a.m.	Milton Marks Conference Center Lower Level 455 Golden Gate Ave. San Francisco, CA 94102
Fresno December 5, 2019 10:00 a.m.	Fresno Hugh Burns Building Assembly Room #1036 2550 Mariposa Mall Fresno, CA 93721

More information about the public hearings and proposed CCPA regulation is available on the Attorney General’s CCPA website.

14 Aug

Searching for the One Ring to Rule Them All: A Look at 8 U.S. Federal Privacy Bills

Metaverse Law

Class Actions, Privacy Law CCPA, Class Actions, Federal Privacy Law, Federal Trade Commission, GDPR

Image Credit: 3D Animation Production Company from Pixabay

This article is Part 1 of 2 in a series exploring proposed federal privacy laws in the United States. Part 2 will discuss the constitutional challenges facing not only a proposed federal privacy law but those facing existing state privacy laws as well.

As predicted in our Privacy Law Forecast for 2019, legislators have raced to introduce national privacy regulation in both the House and Senate this year.

In contrast to the European Union’s GDPR, a hodgepodge of sectoral laws govern privacy in specific industries: medical, financial, educational, and marketing sectors, among others. States have enacted laws to protect their residents. And on top of that, Section 5 of the Federal Trade Commission Act (15 U.S.C. § 45) grants authority to the FTC to enforce against unfair and deceptive acts and practices.

This all results in a confusing and burdensome “patchwork” of national, state and sectoral rules. (For more in-depth discussion on the current U.S. privacy regulatory landscape, please see American Privacy Laws in a Global Context.)

Given this regulatory environment, legislators are keen to put forth a single federal privacy law to standardize this “patchwork” and forestall the passage of dozens more state privacy bills. Some have set a deadline, hoping to pass a federal privacy law before the CCPA comes into effect on January 1, 2020. Since the start of 2019, lawmakers have introduced about 230 bills that regulate privacy in some way in either the House or Senate.

The following is a sample of comprehensive bills from both sides of the aisle. Though these bills are unlikely to pass committee, they indicate what policies lawmakers are considering in the current negotiations:

1 2 3 4