Consultant for Data Privacy and Consumer Protection Regulations Globally
Background:
The EU General Data Protection Regulation (GDPR) is a legal framework that sets guidelines for the collection and processing of personal information of EU residents and came into effect May 25, 2018. The aim of the GDPR is to protect the data privacy of EU residents in today's data-driven world.
The data privacy movement has experienced rapid expansion in recent years, with regulations such as the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) leading the charge. Several US firms have predicted that in 2022-2023 half of the planet's population personal data will fall under a regulation which mirrors GDPR.
Brazil's LGPD is the largest data privacy regulation in the world after GDPR and CCPA (California Consumer Privacy Act). There are approximately sixteen other countries with GDPR-inspired data privacy laws. This list of countries implementing data protection laws continues to grow, further complicating the landscape, as data laws slightly differ from county to country.
The attached PDF (see exhibit 1) shows the privacy legislation that has passed in California, Colorado, and Virginia. There are nine other states with active bills still pending. Each state's legislation is different, complicating compliance.
At the Society for Neuroscience (SfN), we collect and process personal data from members in ninety plus countries and share this data with vendors/third-party for outsourced activities as necessary. Based on our interpretations of the regulations internally, SfN has implemented certain steps towards being compliant. However, given the ongoing interpretation of the regulations / clarifications in the public domain, the passing of complex and confusing state privacy regulations is matter SfN needs examined de-novo from an external perspective.
