1.2.1 Historical Context

Privacy as a concept has evolved significantly throughout human history:

• Early Conceptions: Privacy initially focused on physical spaces and freedom from intrusion
• Legal Recognition: Warren and Brandeis’s 1890 article “The Right to Privacy” defined it as “the right to be let alone”
• Post-WWII Developments: Universal Declaration of Human Rights (1948) recognized privacy as a fundamental right
• Information Privacy: With computerization in the 1960s-70s, focus shifted to information privacy
• Fair Information Practice Principles: Developed in the 1970s, forming the basis of modern privacy laws
• Digital Age Challenges: Explosion of data collection, processing power, and AI capabilities

1.2.2 Why Privacy Matters Today

• Scale of Data Collection: Unprecedented volumes of personal data collected
• Ubiquitous Tracking: Constant monitoring across devices and platforms
• Data Analytics: Advanced processing reveals insights beyond original collection purpose
• Economic Value: Personal data as the “new oil” driving business models
• Power Asymmetry: Imbalance between data subjects and data controllers
• Potential Harms: Discrimination, manipulation, surveillance, identity theft
• Chilling Effects: Impact on freedom of expression, association, and autonomy

1.3.1 General Data Protection Regulation (GDPR)

The GDPR, effective since May 2018, represents the most comprehensive privacy regulation globally.

1.3.2 California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

California has established the strongest privacy framework in the United States.

1.3.3 Other Regional Regulations

• Brazil’s LGPD: Similar structure to GDPR, effective 2020
• Canada’s PIPEDA: Consent-based framework with “meaningful consent”
• Australia’s Privacy Act: Privacy principles-based approach
• Japan’s APPI: Requires prior consent for cross-border transfers
• South Africa’s POPIA: Comprehensive privacy law based on GDPR principles
• India’s Draft Personal Data Protection Bill: Developing comprehensive framework

1.3.4 Sectoral Regulations (US)

• HIPAA: Health information privacy and security
• GLBA: Financial privacy
• FERPA: Educational records
• COPPA: Children’s online privacy
• FCRA: Credit reporting

1.4.1 Lawfulness, Fairness, and Transparency

• Lawfulness: Processing must be based on a valid legal ground
• Fairness: Processing must not be deceptive or discriminatory
• Transparency: Clear, plain language information about processing

1.4.2 Purpose Limitation

• Collect data for specified, explicit, legitimate purposes
• Do not process data in ways incompatible with original purposes
• Purpose must be communicated before collection

1.4.3 Data Minimization

• Only collect what is adequate, relevant, and necessary
• Reduce collection scope to what’s needed for the purpose
• Avoid “just in case” data collection

1.4.4 Accuracy

• Ensure personal data is accurate and kept up to date
• Take reasonable steps to rectify inaccurate data
• Implement processes for data quality management

1.4.5 Storage Limitation

• Keep data in identifiable form only as long as necessary
• Establish and enforce retention periods
• Securely delete or anonymize data when no longer needed

1.4.6 Integrity and Confidentiality (Security)

• Implement appropriate technical and organizational measures
• Protect against unauthorized access, accidental loss, destruction
• Ensure ongoing confidentiality, integrity, availability, and resilience

1.4.7 Accountability

• Responsible for and able to demonstrate compliance
• Document decisions and practices
• Implement governance structures and policies

1.5.1 Right to Information

• Provides transparency about collection and use
• Information must be concise, transparent, intelligible, easily accessible
• Typically delivered through privacy notices and policies

1.5.2 Right of Access

• Confirm whether personal data is being processed
• Receive copy of personal data
• Information about processing purposes, categories, recipients, etc.

1.5.3 Right to Rectification

• Correct inaccurate personal data
• Complete incomplete personal data
• Notify recipients of corrections

1.5.4 Right to Erasure (“Right to be Forgotten”)

• Request deletion of personal data under certain circumstances
• Grounds include: no longer necessary, withdrawal of consent, unlawful processing
• Exceptions for legal compliance, public interest, legal claims

1.5.5 Right to Restriction of Processing

• Temporarily limit processing while addressing certain issues
• Applies during accuracy disputes, while determining legitimate interests, etc.
• Data can be stored but not further processed

1.5.6 Right to Data Portability

• Receive personal data in structured, commonly used, machine-readable format
• Transmit data to another controller where technically feasible
• Limited to data provided by data subject and processed by automated means

1.5.7 Right to Object

• Object to processing based on legitimate interests, public interest, or direct marketing
• Controller must demonstrate compelling legitimate grounds that override interests
• Absolute right to object to direct marketing

1.5.8 Rights Related to Automated Decision Making

• Not be subject to purely automated decisions with legal/significant effects
• Obtain human intervention and contest the decision
• Understand logic involved in automated processing

1.6.1 Governance and Accountability

• Establish privacy governance structure
• Designate responsible individuals/teams
• Document policies and procedures
• Maintain records of processing activities
• Implement training programs

1.6.2 Data Protection Officer (DPO)

• Required when:
  • Public authority processes personal data
  • Core activities require regular and systematic monitoring on a large scale
  • Core activities involve large-scale processing of special categories of data
• Must have expert knowledge of data protection law
• Must be independent and report to highest management level
• Responsibilities include monitoring compliance, advising, cooperating with authorities

1.6.3 Data Protection Impact Assessment (DPIA)

• Required for high-risk processing activities
• Systematic process to identify and minimize privacy risks
• Must be conducted prior to processing
• Must involve DPO where designated

1.6.4 Breach Notification

• Notify supervisory authority of personal data breaches within 72 hours (GDPR)
• Notify affected individuals when high risk to rights and freedoms
• Document all breaches, including facts, effects, and remedial action

1.6.5 Vendor Management

• Due diligence in selecting processors
• Written contracts with specific requirements
• Ongoing monitoring of compliance

1.7.1 Territorial Scope

• Establishment: Where an organization is physically or effectively established
• Targeting Principle: Directing activities to individuals in a jurisdiction
• Monitoring Principle: Tracking online behavior of individuals

1.7.2 Cross-Border Data Transfers

• Adequacy Decisions: Recognition that a country provides adequate protection
• Appropriate Safeguards: Mechanisms like Standard Contractual Clauses (SCCs)
• Binding Corporate Rules: For multinational corporate groups
• Derogations: Limited exceptions for specific situations

1.7.3 Conflict of Laws

• Challenge of complying with multiple, sometimes conflicting regulations
• Approaches:
  • Comply with highest standard across operations
  • Jurisdiction-specific approaches
  • Risk-based assessment

1.8.1 Exercise 1: GDPR Compliance Checklist

1. Review the following organizational practices:
   • Customer data collection through website forms
   • Employee monitoring through work devices
   • Marketing email campaigns to prospects and customers
   • Cloud storage of client files
   • Analytics and profiling for service improvement
2. For each practice, identify:
   • Potential lawful basis under GDPR
   • Required transparency information
   • Applicable data subject rights
   • Documentation requirements
   • Security considerations
3. Develop a gap analysis template for GDPR compliance assessment

1.8.2 Exercise 2: Jurisdictional Analysis

Review the following scenario:

A US-based e-commerce company sells products globally through its website. It collects customer information for order processing, offers personalized recommendations based on browsing behavior, and sends marketing emails. The company stores data on US-based servers but uses EU-based customer service contractors.

Answer the following questions: 1. Which privacy regulations likely apply to this company? 2. What factors determine the applicable jurisdictions? 3. What challenges might arise from multiple applicable regulations? 4. What approach would you recommend for compliance?