Nixon Peabody LLP

  • People
  • Capabilities
  • Insights
  • About

Trending Topics

    • People
    • Capabilities
    • Insights
    • About
    • Locations
    • Events
    • Careers
    • Alumni

    Practices

    View All

    • Affordable Housing
    • Community Development Finance
    • Corporate & Finance
    • Cybersecurity & Privacy
    • Environmental
    • Franchising & Distribution
    • Government Investigations & White Collar Defense
    • Healthcare
    • Intellectual Property
    • International Services
    • Labor & Employment
    • Litigation
    • Private Wealth & Advisory
    • Project Finance
    • Public Finance
    • Real Estate
    • Regulatory & Government Relations

    Industries

    View All

    • Cannabis
    • Consumer
    • Energy
    • Entertainment
    • Financial Services
    • Healthcare
    • Higher Education
    • Infrastructure
    • Manufacturing
    • Non Profit
    • Real Estate
    • Technology

    Value-Added Services

    View All

    • Alternative Fee Arrangements

      Developing innovative pricing structures and alternative fee agreement models that deliver additional value for our clients.

    • Continuing Education

      Advancing professional knowledge and offering credits for attorneys, staff and other professionals.

    • Crisis Advisory

      Helping clients respond correctly when a crisis occurs.

    • DEI Strategic Services

      Providing our clients with legal, strategic, and practical advice to make transformational changes in their organizations.

    • eDiscovery

      Leveraging law and technology to deliver sound solutions.

    • Global Services

      Delivering seamless service through partnerships across the globe.

    • Innovation

      Leveraging leading-edge technology to guide change and create seamless, collaborative experiences for clients and attorneys.

    • IPED

      Industry-leading conferences focused on affordable housing, tax credits, and more.

    • Legal Project Management

      Providing actionable information to support strategic decision-making.

    • Legally Green

      Teaming with clients to advance sustainable projects, mitigate the effects of climate change, and protect our planet.

    • Nixon Peabody Trust Company

      Offering a range of investment management and fiduciary services.

    • NP Capital Connector

      Bringing together companies and investors for tomorrow’s new deals.

    • NP Second Opinion

      Offering fresh insights on cases that are delayed, over budget, or off-target from the desired resolution.

    • NP Trial

      Courtroom-ready lawyers who can resolve disputes early on clients’ terms or prevail at trial before a judge or jury.

    • Social Impact

      Creating positive impact in our communities through increasing equity, access, and opportunity.

    1. Home
    2. Insights
    3. Articles
    4. Privacy by design opportunity or roadblockArticles

    Article

    Privacy by design opportunity or roadblock

    March 3, 2021

    Share

    By Anders van Marter

    As the U.S. continues to play catch up with Europe in terms of privacy regulation, it is worth looking at the direction Europe has taken—particularly, Europe’s embrace of “privacy by design” in its landmark General Data Protection Regulation (GDPR). Is the U.S. finally ready to embrace a right to privacy of personal data? And will U.S. businesses make “privacy by design” a business priority?

    There has been a steady increase in privacy regulations throughout the U.S. in recent years—a trend that does not show any sign of slowing down. These new regulations can pose headaches for companies, particularly because compliance differs from state to state. As the U.S. continues to play catch up with Europe in terms of privacy regulation, it is worth looking at the direction Europe has taken—particularly, Europe’s embrace of “privacy by design” in its landmark General Data Protection Regulation (GDPR). Is the U.S. finally ready to embrace a right to privacy of personal data? And will U.S. businesses make “privacy by design” a business priority?

    Former Canadian Information and Privacy Commissioner Ann Cavoukian first introduced the seven foundational principles behind the concept of “privacy by design” (PbD) in 2009. PbD is an approach to protect privacy by embedding data protection into technology-related processes and procedures and system infrastructure from the beginning. PbD promotes implementing data protection from the outset of the development of new products, services, or technologies and throughout the entire lifecycle of the processing of any personal data cycle.

    Notably, the GDPR expressly incorporated PbD. For example, under Article 25, the GDPR provides that companies must implement technical and organizational measures that are “designed to implement data-protection principles” and to implement “necessary safeguards into the processing.” Moreover, the GDPR incorporates the notion of PbD vis-à-vis directives around data pseudonymization and data minimization. To leverage such concepts, these privacy functions must be built into the initial design of the technology. The GDPR also goes beyond the design of technology and emphasizes the need to create policies and products that reflect data-protection principles.

    While the U.S. has not enacted a sweeping, comprehensive regulation like the GDPR, there has been a significant shift in how Americans view the right to privacy. A recent Pew Research poll found that 81% of the public believes the risks of data collection by companies outweigh the benefits, with 75% of Americans saying there should be new regulations on what companies can do with personal data. And while states have been slow to act, there is a new effort to pass more comprehensive privacy regulations—with many thinking that overarching federal legislation may follow.

    California continues to lead the way in terms of privacy regulation—especially with its recently–passed California Privacy Rights Act (CPRA), which expands the privacy rights within the existing California Consumer Privacy Act (CCPA). While neither the CCPA nor the CPRA, which does not go into effect until January 1, 2023, explicitly require privacy by design, like in the GDPR, they do indicate that perhaps the U.S. is heading in that direction, and businesses should take note. For example, the CCPA provides that a manufacturer of a device that connects to the internet must add a security feature designed to promote against unauthorized access, destruction, and use of the data. And the CPRA embraces a number of the GDPR’s fundamental principles—such as data minimization, data retention, and recognizing categories as sensitive personal information. Therefore, applications that limit data collection, track data through its entire lifecycle, and remove data regularly will streamline compliance with the CPRA. The CPRA raises the bar for data security and will require businesses and developers to focus on privacy from the inception through implementation of new systems and applications. The notion of PbD is weaved throughout the CPRA—indicating a significant shift in U.S. privacy regulation.

    There is a real reckoning emerging in the U.S. regarding the right to privacy over personal data. The proliferation of data and recent high-profile data breaches have only underscored the public’s concern over how companies manage and use personal data. Will businesses shift their view on privacy and begin to embrace PbD and find ways to make it a business advantage as opposed to a roadblock? U.S. companies could be a leader in finding ways to find the balance between the benefits of technology and safeguarding personal data.

    PrivacyCCPAPrivacyCybersecurity

    Practices

    Cybersecurity & Privacy

    Subscribe to stay informed of the latest legal news, alerts, and business trends.Subscribe

    • People
    • Capabilities
    • Insights
    • About
    • Locations
    • Events
    • Careers
    • Alumni
    • © 2023 Nixon Peabody. All rights reserved
    • Privacy Policy
    • Terms of Use
    • Statement of Client Rights
    • Supplier Diversity Program
    • Nixon Peabody International LLC
    • PAL