Getting data protection right in 2022

A privacy-first approach is now enforced in apps and in email for most Apple devices and the increasing prevalence of secure browsing tools such as Brave and DuckDuckGo are indicative of greater awareness (read suspicion) of how some big tech companies are tracking their users.

This presents fresh challenges to communicators looking to make data-driven decisions from their marketing tools and will make it more important than ever to carry out good data hygiene practices and ensure personal data is processed with transparency and care.

UK and the EU

From a legislative perspective, the stop gap on Standard Contractual Clauses (SCCs) agreed between the EU and the UK is due to expire on 22^nd December 2022. Both the EU and UK are yet to define what will be needed respectively after this date, but there is a fair chance that lawyers will be busy towards the end of the year rewriting terms to accommodate new clauses for both legislative territories.

The UK government is also potentially seeking to reform data protection legislation as part of the National Data Strategy. It is unlikely any decisions made in this respect will have a real-world impact in 2022 though.

Over the pond

In the US, data protection legislation also remains fragmented with little sign of a federal equivalent to the GDPR still. A growing number of states are pursuing their own data protection acts though with both Virginia and Colorado signed to implement their own data protection acts in 2023. California will also strengthen it’s regulations with the California Privacy Rights Act (CRPA) set to replace the still fairly new California Consumer Privacy Act (CCPA) in July 2023. The CRPA extends the rights introduced by the CCPA along with greater enforcement powers. Although Californian data protection may not seem too relevant to UK organisations, it is the home to Silicon Valley and therefore, many tech companies will look to adapt their software to conform, even if there customers operate elsewhere.