2022 Global

Legislative Predictions
Edited by IAPP Assistant Editor Libby Sweeney
2022 Global
Legislative Predictions
Edited by IAPP Assistant Editor Libby Sweeney

T
he urgency to pass or update privacy laws around the world seems to heat
up more each year, and 2022 is likely to be a hot one. This year’s issue of
the IAPP’s Global Legislative Predictions is the largest to date since the
IAPP began tracking predictions in 2017. Health data has been a center of attention
in data privacy laws, another consequence of the COVID-19 pandemic. With the
passage of China’s Personal Information Protection Law and potential passage of
India’s Data Protection Bill, an additional one-third of the world’s population will
be regulated by a data privacy law. While many countries agree data privacy is an
important issue to regulate, some countries are seeing the greatest obstacle resides
in how best to regulate it.

Editor’s note: While we try to include as many countries as possible, we recognize this is not
an all-encompassing list. If you are interested in submitting 2022 predictions for a country not
featured on this list, please reach out to [email protected].

 Australia certain other online platforms. Once passed,

Keith Eyre, CIPP/E, CIPM, CIPT, FIP the industry has 12 months to develop a
This year we can expect to see the introduc- code or Australia’s data protection authority,
tion of the Privacy Legislation Amendment the Office of the Australian Information
(Enhancing Online Privacy and Other Commissioner, can step in to develop it. The
Measures) Bill and further progress on “other measures” in the bill will substantially
the Australian government’s review of the increase the civil penalties for breaches of the
Privacy Act. Privacy Act and improve the extraterritorial
reach of the Privacy Act to protect the
The Online Privacy Bill, released last year as information collected from individuals in
an exposure draft, would enable a binding Australia, regardless of where the collecting
online privacy code for social media and entity is located or incorporated.

International Association of Privacy Professionals  •  iapp.org 2

In October 2021 the government released a or when a focus on advertising technology
discussion paper containing proposals and consent mechanisms has a knockout effect on
options to modernize the Privacy Act. Some the privacy world. IAB Europe, known for its
proposals and options have been inspired by Transparency and Consent Framework, was
other jurisdictions such as the EU, including investigated by its lead DPA. A leaked draft
introducing individual rights to object and ruling qualifies IAB as a joint controller.
to erasure. With submissions on the paper This rather unpopular position may impact
closing Jan. 10, the government will now standard-setters, making them more
consider the feedback and consult with stake- accountable than they expected.
holders on specific issues before concluding
its review report, which it intends to make Speaking of accountability, last year saw the
public after consideration. The release of an adoption of the EU Cloud Code of Conduct by
exposure draft of Privacy Act amendments the Belgian DPA, the first of its kind for cloud
will then follow the review report, likely in service providers. Adhering CSPs commit to
the second half of 2022 or into 2023. strict data protection rules, achieving legal
certainty and spreading customer trust.
Organizations should take note of the OAIC’s There is more coming on that front, with an
determinations last year regarding the pri- addendum being negotiated to allow using the
vacy practices of Uber, 7-Eleven and Clearview code as a legal transfer mechanism, a pioneer
AI last year as case studies on what to expect move by Belgium.
from the OAIC on enforcement of the Privacy
Act, and what they need to be doing to As we start 2022, let’s hope Belgium finally
protect personal information to comply with adopts its (overdue) AI, machine learning and
the Privacy Act. big data plan. It’s great to be a country of
data centers; it would be even better to be at
the heart of innovative uses of data. The AI
 Belgium Act will then be close; the Belgian DPA must
Diletta De Cicco, CIPP/E, be ready to absorb more tasks and hire more
Charles Helleputte, CIPP/E experts, as their current contingent of
2021 highlighted the need to reshape the lawyers might not do. And with Brussels
Belgian Data Protection Authority. The being Brussels, 2022 will give us (again) a full
existing setup allowed external members to EU privacy agenda — Digital Services Act,
hold key positions at the DPA and elsewhere. Digital Markets Act, ePrivacy. Let’s be ready!
This raised concerns of potential conflicts
of interest. Making the headlines through-
out the year, it ultimately escalated to the  Bermuda
European Commission with the launch of an Nancy Volesky, CIPP/US
infringement procedure. On the eve of the The last few years could be categorized as an
Jan. 12 response deadline, Belgium announced active preparatory period in anticipation of
changes to strengthen the independence of Bermuda’s privacy legislation, the Personal
the DPA’s members. A new law is expected Information Protection Act, 2016, being
this year and will be closely monitored — implemented. During this time, Privacy
“Brussels watching Brussels.” Commissioner Alexander White, CIPP/A,
CIPP/C, CIPP/E, CIPP/G, CIPP/US, CIPM,
Let’s also bet on the (upcoming) decision in CIPT, FIP, was appointed and it heralded the
the Interactive Advertising Bureau Europe, emergence of a professional privacy sector,

International Association of Privacy Professionals  •  iapp.org 3

including the establishment of a Bermuda sanctions applied by Brazil’s DPA, the
IAPP KnowledgeNet Chapter. Autoridade Nacional de Proteção de Dados,
which enacted a regulation for its due
The time spent has been well served as the administrative process, and approval of an
government confirmed 2022 will be a busy amendment to the constitution, including the
year for privacy-related legislation. It looks protection of personal data as a fundamental
likely that the PIPA or parts of the PIPA individual right and establishing that the
may finally come into force. Overall, major federal government has exclusive powers to
changes to the PIPA are not anticipated, so legislate in data protection matters.
organizations should do well to continue their
preparations for compliance based on the With enforcement on the radar and the
requirements present. dawning of awareness that the General Data
Protection Law applies to any sector, control-
There will, however, be some changes to lers, processors and data subjects alike real-
the PIPA and the 2010 Public Access to ized the LGPD is “for real,” triggering moves
Information legislation (Bermuda’s approach in the legislative front. Many of them aim to
to Freedom of Information) resulting from carve out exceptions for certain sectors.
a harmonization exercise between the two,
as PATI presently provides individuals with Agribusiness, for example, has been pushing
access to their personal information the for a sector-specific bill for “agricultural
government holds. In addition, we will see data,” which may include personal data, to
amendments to the Electronic Transactions be processed by “providers of agricultural
Act, 1999 which contains data protection and technologies.” Likewise, non-profit sectors are
privacy elements that must be aligned with propelling a bill aiming at an exemption of
the PIPA. The government also announced it their own. However, none of those bills are on
will introduce a CyberSecurity Act, which a fast track for approval, which means there
will establish minimum standards for will probably be plenty of room for debate if
cybersecurity for critical assets. such exceptions will mature into law.

The privacy commissioner spent the last In addition, the ANPD’s schedule for 2022
year issuing guidance and that is expected includes the issuance of regulation on data
to accelerate in the new year. With the subject rights, the appointment and roles of
announcement of Bermuda hosting the data protection officers, international data
Global Privacy Assembly’s Summit in 2023 transfers, and lawful basis for data processing
and Bermuda’s privacy commissioner sitting activities. Finally, the ANPD has yet to issue
on the conference’s executive committee, a regulation on much-awaited criteria for the
privacy in Bermuda takes on an international calculation of monetary penalties, which
focus. Preparations may serve as a catalyst were not set forth in the due administrative
for further privacy initiatives. process regulation.

 Brazil  Canada
Angela Bittencourt da Fonseca, Shaun Brown
CIPP/E, CIPM, CDPO/BR Quebec privacy law will align more closely
Last year’s hallmarks in data privacy legis- with the EU General Data Protection
lation were the start of the effectiveness of Regulation once the changes under Bill 64

International Association of Privacy Professionals  •  iapp.org 4

are phased in over the next three years. The Ontario private-sector privacy law. Although
inclusion of significant penalties and more 2022 is an election year in Ontario — which
resources for enforcement mean businesses could slow down or even derail the process —
should pay close attention to interpretive this is an important development to watch.
guidance provided by Quebec’s DPA, the
Commission d’accès à l’information du
Quebec, this year.  Chile
Javiera Sepúlveda, Andrea Céspedes, CIPP/E,
Less transformational amendments to federal María José Díaz
privacy legislation, introduced in Bill C-11 2022 will probably be a year with significant
late 2020, died when the Liberal government shifts in the local data privacy environment.
called an election last year. The re-elected First, due to substantial changes that will
Liberal government has since indicated promptly be passed to the consumer pro-
updating the law is a “top priority” and that a tection regulations, the National Consumer
new bill will be introduced in 2022. Although Protection Service will become the DPA in
the bill will be revised in response to criticism Chile, but only in regard to the processing
of C-11, a major rewrite is unlikely. The federal of consumers’ personal data. SERNAC will
government also completed a consultation on have this role temporarily — as long as
modernizing the public-sector Privacy Act last such powers are not invested in another
year, so 2022 may see publication of concrete authority — until the bill modifying current
proposals for amendments to that act. data protection law is approved. SERNAC
has made some pronouncements in connec-
In late 2021, British Columbia very quickly tion with the protection of consumers’ data
passed amendments to its public-sector (including issuing interpretative opinions) in
privacy legislation, notorious for its restrictive the preparation of its appointment as DPA.
data residency requirement for personal
information. British Columbia removed Additionally, legislative discussion on the bill
the prohibition on storage and access of law that modifies the privacy protection
outside of Canada, making cloud-based law is encouraging and moving forward.
technologies more accessible to public bodies. One of the most debated points of the bill,
Disclosures of personal information outside regarding if the authority in charge should be
Canada may still be subject to regulations an autonomous DPA or the existing Council
though, which could be published in the for Transparency, seems to have been resolved
coming year. A special committee convened in the creation of an autonomous authority as
to review the private-sector Personal proposed by the government.
Information Protection Act released a report
recommending several changes to the law, In October 2020, two bills of law regarding
including mandatory breach reporting “neuro-rights and brain activity” were submit-
and stronger enforcement powers for the ted to Congress. The first one, which already
Information and Privacy Commissioner. It has been approved and entered into effect,
seems likely that the PIPA will be amended was a constitutional amendment that aimed
this year to implement at least some of the to include “neuro-rights” in the catalog of
committee’s recommendations. guarantees recognized in the Chilean Political
Constitution. The second bill, which is still
The Ontario government recently completed being discussed in Congress and is expected
a consultation on proposals to develop an to be approved in 2022, seeks to give a legal

International Association of Privacy Professionals  •  iapp.org 5

expression to these constitutional rights, the scope of important data and to take
protecting individuals’ lives and the physical proper risk management actions.
and psychological integrity in the develop-
ment of neurosciences, neurotechnologies Data legislation at the local level is also evolv-
and their clinical applications. ing at a fast pace. In Shenzhen and Shanghai,
the cities with dynamic digital economies,
Thus, we hope there will be actual news local governments are spearheading the
for 2022, with major changes for personal formulation of local rules for protecting
data regulation. personal data as well as unlocking the value
of data. Both the Shanghai Data Regulations
and the Shenzhen Data Regulations came into
 China effect Jan. 1, 2022. With the launch of the
Barbara Li Shanghai Data Exchange, Shanghai is
2021 was a significant year for data protection exploring cutting-edge technologies and
legislation in China, marked with the Data methodologies for creating innovative
Security Law and the Personal Information mechanisms for defining data rights and
Protection Law entering into force in promoting data transactions.
September and November, respectively.
However, people are waiting eagerly for the The PIPL and DSL have significantly
implementing rules and guidelines with more increased the penalties for noncompliance.
practical guidance and references. The regulators have been targeting large
internet platform companies to crack down
On the national level, the Cyberspace on excessive collection of personal data
Administration of China recently issued the beyond the business necessity and the use of
consultation draft of the Administrative big data and algorithms for discriminating
Regulations on Network Data Security and customers. It has been reported that in 2022,
the Measures for Security Assessment of Chinese regulators will continue to be active
Cross-border Data Transfer, both of which are in enforcement actions and financial, trans-
likely to be completed in 2022. The former portation, auto, e-commerce, pharmaceutical
Regulations provide some clarity on data and health care industries are likely to be
classification and also impose certain vig- targeted sectors.
orous requirements on companies in terms
of data breach response and cybersecurity
review for overseas investment, while the   Czech Republic
latter Measures lay down specific stipulations František Nonnemann, CIPP/E
for the threshold, procedures and timeline We cannot expect any important new rules
for security assessment for cross-border in privacy and data protection to be adopted
data transfer. In addition, the Information in the Czech Republic in 2022. The main
Security Technology - Guideline for reasons are two: Because of general elections
Identification of Important Data, the draft in October 2021, there is no legislative plan
of which was published in 2021 for public for the coming years. Main priorities of the
comments, is expected to be finalized in 2022. new government will likely not lay in the
This guideline, upon issuance, will provide data protection area and there have not been
helpful references for businesses to assess if recent discussions on any important topics to
the data they are handling would fall within be newly regulated.

International Association of Privacy Professionals  •  iapp.org 6

On the other hand, significant changes in joining Schengen, Cyprus needs to harmonize
the regulation of online marketing (cookies) its legislation with the legal instruments of
and telemarketing became effective Jan. 1. the Schengen Information.
The relevant amendment to the Czech Act on
Electronic Communications was adopted by Cyprus, as of 2016, was making efforts to
the former national parliament. transpose into national law the Directive
(EU) 2019/1937 on the protection of persons
For both types of marketing — cookies (and who report breaches of Union Law (the
similar tracking tools) and telemarketing Whistle-blower Directive), adopted October
— there will be a newly introduced opt-in 2019. The Directive was set to be transposed
principle. The previous situation was that the into law by Dec. 17, 2021. However, this did
opt-out principle was applicable instead for not occur as there were inconsistencies to be
both categories. tackled between the bill and a law proposal
submitted in 2016 for the protection of public
This change means that prior explicit consent whistleblowers. On Jan. 20, the Plenary
is needed for usage or storage of cookies in Session of the Cyprus Parliament voted for
the user’s web, except technically necessary the passing of the national law transposing
cookies or cookies necessary for providing the the Directive, titled “The Protection of
service asked by the user. Similarly, telemar- Persons who report violations of EU Law
keting in both the business-to-business and and National Law of 2022.”
business-to-consumer sectors will be legally
possible only with prior explicit consent of There is imminent need to amend Cyprus
the called party. Contract Law in order to allow the con-
tracting parties to choose Cyprus law to
govern the new standard contractual clauses,
 Cyprus adopted by the European Commission in June
Maria Raphael, CIPP/E to legitimize international data transfers. This
Following Cyprus’ application in July 2019 for will be achieved by incorporating provisions
accession to the Schengen Area, the super- that confer third-party beneficiary rights to
visory authorities from the EU along with data subjects into Cyprus Contract Law or
European Commission experts have been data protection legislation, which is a prereq-
assessing Cyprus’ infrastructure. Despite uisite for the governing law of the SCCs.
the Schengen Committee adopting a positive
report in 2020 regarding the capacity of the Lastly, it is expected that the Cyprus gov-
Office of the Commissioner of Personal Data ernment will begin developing a legislative
Protection to adequately supervise systems framework to ensure the availability of
and procedures the public authorities needed, data with transparent regulations on data
the assessment in other areas led to the protection, taking into account the GDPR
European Union Home Affairs Commissioner and the EU Regulation on the free flow of
announcing in June 2021 Cyprus was not yet non-personal data, while facilitating the
ready to become the newest member of the interoperability of data. The new legislative
borderless zone. However, the vice president framework will enable digital services to use
emphasized that “in the turn of enlargement, up-to-date and high-quality information while
Cyprus is clearly coming in the fourth posi- considering the protection of personal data.
tion, and yes, Cyprus remains a candidate The Cyprus government has committed to
for Schengen.” While still in the process of creating a data ecosystem with guidelines and

International Association of Privacy Professionals  •  iapp.org 7

regulations about data interoperability and Since Datatilsynet cannot issue fines by them-
data exchange agreements. selves, we are still waiting to see if Danish
courts agree to the proposed fines. To this day,
only one case has been decided by a Danish
 Denmark court (in first instance), and it led to a reduc-
Karsten Holt, CIPP/E, CIPM, CIPT, FIP tion of the proposed fine (EUR 200,000) to
At the Danish Parliament’s opening session only EUR 13,500 due to a number of mitigat-
in October 2021, the Danish government ing circumstances. The ruling was appealed by
published its legislation plans for the coming the prosecution, so we still have no final court
year. Five of the proposed acts have interest- rulings on GDPR fines in Denmark.
ing privacy aspects:

• New national legislation governing social  Finland

media platforms and their responsibility Milla Keller, CIPP/E
to delete illegal or false content on their In 2022, we will likely see an update to the
platform, including requirements for Act on the Protection of Privacy in Working
increased transparency and a right to Life. Anyone who has worked with employee
appeal the social media’s decisions to a privacy in the Nordics will have noticed
public body. It will be interesting to see Finland has one of the strictest approaches in
how a national legislation will work with this area in all of EU. The update will extend
global social media platforms. the possibilities to process employee personal
data without the employee’s consent.
• Revision of the rules on telecommuni-
cations logging as a tool for criminal In 2021, Finland updated cookie guidelines.
investigations. The authority responsible for enforcing
the cookie rules had to change its
• Revision on the rules on fingerprint interpretation of the rules due to a ruling
and DNA collection and registration to from the administrative court. This marked
improve the police’s options for criminal a 180-degree turn for Finnish cookie
investigations. compliance: Before, the authority maintained
its interpretation that it is possible to provide
• New rules on tort claims for victims of valid consent with browser settings. The new
digital (online) offences. cookie guidelines set one of the strictest
standards in the EU. In 2022, we expect to see
• Amendment of the Criminal Act to how enthusiastically the authority intends to
specifically address identity theft as a enforce the guidelines.
criminal offense.
Lastly, European DPAs are cooperating on
The Danish DPA, Datatilsynet, has been numerous cases concerning international data
busy the previous year, issuing new guidance transfers following the “Schrems II” ruling,
material on a number of topics and making and some Finnish cases are pending the
decisions in a number of cases, often leading finalization of these cooperation procedures.
to requests to the police for criminal proceed- In 2021, the Finnish Data Protection
ings and fines. Many of these cases have been Ombudsman’s Office did not publish any
related to insufficient security of processing decision or detailed guidelines on the topic.
(Article 32). Hopefully 2022 will bring clarity when some

International Association of Privacy Professionals  •  iapp.org 8

of the cases are finally closed and we have a (management of working time; respect of
better idea of the local supervisory authority’s health and safety rules during telework;
approach to international data transfers. respect of instructions concerning the trans-
fer of personal data of the persons concerned;
respect of cybersecurity measures).
 France
Cécile Martin
In 2022, it is highly likely health data will still  Germany
be at the center of concern for France’s DPA, Ernst-Oliver Wilhelm,
the Commission nationale de l’informatique CIPP/E, CIPM, CIPT, FIP
et des libertés. Indeed, this data, known as On Nov. 24, 2021, the formation of a new
sensitive data in European law, has been government in Germany resulted in a joint
widely collected and processed by many agreement of the so-called “Traffic-Light
different data controllers and processors in Coalition” from Social Democrats, Liberal
the current health context to fulfill different Democrats and Green Party.
purposes, such as access to the workplace for
certain professions, allowing establishment The Coalition Agreement contains commit-
of the sanitary pass, monitoring the evolution ments of the new government for the next
of the pandemic, establishing vaccination four years, including: strengthen digital citi-
campaigns, deepening research, implementing zen rights and IT security, introduce a right to
health protocols for people suffering from encryption, promote anonymization, establish
COVID-19 and more. criminal liability for unlawful deanonymiza-
tion, support rapid adoption of the ePrivacy
In view of the numerous data breaches that Regulation and an ambitious agreement with
have occurred in this field and the numerous the U.S. to enable legally robust and com-
interests this type of data can arouse, the pliant data transfers at a European level of
verification of the conformity of the data protection, and enhance the Federal Data
processing implemented and security mea- Protection Law, Bundesdatenschutzgesetz. It
sures taken should still give rise to numerous is very likely that the planned enhancement
controls by CNIL agents. of the BDSG will take inspiration from an
evaluation by the Board of German Super-
Similarly, it is anticipated employee moni- visory Authorities, Datenschutzkonferenz,
toring systems will be subject to increased released in March 2021, and an evaluation
vigilance by the CNIL. As a result of the from the Federal Ministry of the Interior
pandemic, many employees are now working (Bundesministerium des Inneren) released
in a hybrid work environment, with periods in October 2021. There seems to already
of office work and periods of working at be consensus in the new government that
home. This requires companies to adapt, the institutionalization of the DSK and the
since they must allow them to continue refinement of the rules for Employee Data
carrying out their remote missions under the Handling should be part of the enhancement
same conditions as if they were in the office. of the BDSG.
Therefore, companies must give them access
to personal data, such as data on customers, On Nov. 25, 2021, the German Federal
prospects, suppliers or even employees of Protection Act against Infections
the organization, under appropriate security (Infektionsschutzgesetz) entered into effect.
conditions, all while controlling their activity Among other things, this law established the

International Association of Privacy Professionals  •  iapp.org 9

so-called “3G rule” (named for the German Whistleblower Directive and the law
words for vaccinated, recovered and tested implementing the Decision 2008/615/JHA
negative: geimpft, genesen and getested) at on cross-border cooperation in combating
the workplace and provided a legal ground terrorism and cross-border crime (Prüm
to process employment health data until Decision). In addition, regulation will be
March 19, though this can be extended for introduced regarding measures against the
three months. COVID-19 pandemic, health records, e-health
and teleworking. Finally, the government
On Dec. 1, 2021, the Telecommunication shall publish the National Plan for Artificial
Telemedia Data Protection Act, known Intelligence.
as the Telekommunikation-Telemedien-
Datenschutz-Gesetz, will enter into effect. Apart from the above, the Framework Law
The TTDSG contains provisions that, among 4624/2019 supplementing the GDPR and
others, aim to clarify the application of the incorporating the Law Enforcement
GDPR and the ePrivacy Directive in telecom- Directive may also be amended according
munications and telemedia. For example, to the improvements proposed by the
storage of and access to information in the Hellenic Data Protection Authority in its
end user’s terminal equipment is generally Evaluation Report of the Law. Other possible
only permitted with a GDPR-compliant legislative developments concern the adoption
consent; exceptions are defined in accor- of secondary regulation by the Ministry
dance with the requirements of the ePrivacy of Digital Governance regarding the EU
Directive. Furthermore, the TTDSG contains Cybersecurity Act and the implementation
new provisions on digital estate, privacy of Law 4727/2020 on digital governance,
protection for terminal equipment, consent with an emphasis on public sector data
management and supervision. interoperability.

On Jan. 1, Article 327q of the German Civil At the level of supervision, Greece’s DPA
Code, known as the Bürgerliches Gesetzbuch, has already integrated additional highly
entered into effect. This article deals with qualified personnel into its organization and
when a consumer provides their personal data was expected to acquire a newly appointed
for gaining access to some service and will council by the parliament in 2021. In 2022,
be considered similarly if they had provided the DPA will have the necessary resources
money for the service (while maintaining the and mandate to make a fresh start and
data subject rights of the consumer). This execute a plan of regulatory interventions
enhancement of the BGB is considered highly in hot areas of data processing and
relevant by consumer and privacy protection enforcement activities in high-risk market
organizations. sectors. The authority may, on the one hand,
issue guidelines and opinions in relation to
video surveillance, body cameras worn by
 Greece police, health data, employee data processing
Antonios Broumas, CIPP/E and whistleblowing, whereas on the other
Compared to 2019 and 2020, 2022 is expected hand, it could conduct a plan of investigations
to be a year of increased legislative develop- and dawn raids in the markets of finance,
ments and supervisory activity for Greece insurance, electronic communications,
in data protection. Forthcoming legislative e-commerce and marketing.
developments include the enactment of the

International Association of Privacy Professionals  •  iapp.org 10

   Hong Kong, China the Constitutional and Mainland Affairs
Timothy Ma, CIPP/E, CIPM Bureau back in January 2020, which would
In 2021, the main piece of privacy and further update the PDPO with a mandatory
data protection legislation in Hong Kong data breach notification requirement, data
underwent a major revamp. In October, retention guidelines, regulate data proces-
the Personal Data (Privacy) Amendment sors, expand the definition of personal data
Ordinance was published in the Hong Kong and confer additional powers to allow the
Gazette and became effective. Major changes commissioner to directly impose financial
include the criminalization of “doxxing,” penalties. There is no precise timeline for
expanding the privacy commissioner’s powers implementation at this stage. However, with
to carry out criminal investigations and passage of the Amendment Ordinance, it is
prosecute doxxing and related offences, and expected attention will return to effecting
demand disclosure of doxxed personal data these broader amendments to the PDPO.
cease. The Office of the Privacy Commissioner
for Personal Data also set up a telephone
hotline for handling inquiries or complaints  India
regarding doxxing activities. The PCPD Pranav Rai, CIPP/A
issued the Amendment Ordinance “India—Confusion Raj…” was a chapter title
Implementation Guideline to explain the in Graham Greenleaf’s “Asian Data Privacy
amendments, with examples to illustrate the Laws” and it set out the severe deficiencies of
scope and application of doxxing offenses, India’s data protection rules from 2011. Little
the powers conferred to the commissioner did we know this title would age splendidly
and how the public can lodge complaints in 2021, and these rules — which only
with the commissioner. superficially resemble a data protection law —
would continue to exist even today.
Given the commissioner’s focus on combating
doxxing (having received 5,800 doxxing In late 2019, when the Personal Data
complaints through to June), it is expected Protection Bill, 2019 — largely regarded as
the commissioner will actively exercise its “progressive” by many important voices,
powers under the Amendment Ordinance, including Greenleaf — could not be tabled
carrying out investigations into alleged before Parliament amid protest from the
doxxing and prosecuting offenders to the opposition, it was referred to the standing
extent doxxing constitutes a criminal offence. committee for further scrutiny. The
It is also expected the commissioner will issue committee was expected to come up with
cessation notices to individuals or entities its report by the budget session (March 2020)
(such as operators of social media platforms, of Parliament, but managed to table its
internet service providers or hosting service report only in December 2021. This report
providers) to take expeditious action to recommends substantial amendments to
remove personal data subject to doxxing. the 2019 bill and a phased approach to
The PCPD is expected to issue further implementing the law.
guidance and materials to enhance public
awareness of and compliance with the The delay in tabling the report was, however,
Amendment Ordinance. only one of the reasons impeding the passage
of the law. The Ministry of Electronics &
The Legislative Council is also expected Information Technology has lately been reti-
to consider amendments first proposed by cent about providing details on the upcoming

International Association of Privacy Professionals  •  iapp.org 11

law and even about its shift in focus to committee-proposed bill — are under threat
non-personal data legislation/framework, in varying proportion.
which adds to the ambiguity. Perhaps because
of this shifting focus, the committee recom- In 2022, the committee-proposed bill (or
mended an expansion in the scope of the bill perhaps a legislative compromise of that bill)
by including non-personal data protections will likely continue moving forward — albeit
and renaming it “Data Protection Bill.” in fits and starts — towards being passed as
law. If the government can, however, regain
While there is nothing inherently wrong its resolve — last displayed prior to the
with this approach, it has some flaws and introduction of the 2019 bill before
may even be premature. There are also Parliament, but absent since then — a
some controversial provisions in the comprehensive data protection law would
committee-proposed bill, like questionable be possible in the next Parliament session
independence of the DPA and the exceptions (starting in February 2022). The hope still
section that keeps government agencies out is that India will shed the “Confusion Raj”
of the bill’s purview. Uncertainty regarding tag in 2022 and show others a fourth path:
the contents of the proposed law and timing a “Fourth Way to Privacy, autonomy and
of its passage was already aplenty and has empowerment,” distinct from the approaches
only increased since the tabling of the report. in the U.S., EU and China, as suggested by the
The report remains but a recommendation Justice B.N. Srikrishna committee.
to Parliament, and there is lack of unanimity
even among the committee members’ – with
some prominent members dissenting.  Ireland
Kate Colleary, CIPP/E, CIPM
Together these cast doubts regarding the gov- 2022 will see the commencement of the final
ernment’s determination to get the Personal sections of the Data Sharing and Governance
(or possibly an all-encompassing personal Act 2019, which provides a clear legal basis for
and non-personal) Data Protection Bill passed the sharing of personal data between public
swiftly. It cannot be a matter of government bodies in certain circumstances. The aim is to
ability, though — after all, the political reduce the administrative burden associated
dynamics of the committee continue to be with the need for individuals to provide their
favorable to the majority, the ruling Bhartiya personal data to numerous public bodies.
Janta Party. An official and unambiguous
government version from the relevant min- The Data Protection Commission published
istry on the way forward on proposed legis- its Regulatory Strategy 2022-2027, which
lation will be assuring; until then, the doubts sets out its vision for a crucial five years in
regarding government resolve will remain. data protection law. The DPC emphasizes
taking careful account of the needs of
If this incertitude continues and a compre- diverse stakeholders, and the fast-paced
hensive data protection law is not brought and non-traditional sectors it regulates. All
expeditiously, the constitutionally guaranteed strategic goals set out in the strategy have
right to life and personal liberty of the resi- been proposed as a means of “doing more, for
dents, trade (particularly India-EU FTA), and more.” As the DPC has finite resources, it will
also the newfound purpose of “interest and prioritize complaints of systemic importance
security of the state” — made unmistakable and will seek a collective approach to
by addition to the prefatory material of the enforcement throughout Europe.

International Association of Privacy Professionals  •  iapp.org 12

The strategy outlines five strategic goals: allocation to 23.2 million. The funding will
facilitate the recruitment of more than 40
• Regulate consistently and effectively. new staff, with specialized skill sets in areas
such as investigation, technology and legal.
• Safeguard individuals and promote data
protection awareness. In September 2021, the DPC concluded its
investigation into WhatsApp, finding it had
• Prioritize the protection of children and failed to discharge its GDPR transparency
other vulnerable groups. obligations. A fine of 225 million euros was
imposed along with a reprimand and an
• Bring clarity to stakeholders. order for WhatsApp to take a range of
remedial actions.
• Support organizations and drive
compliance. WhatsApp appealed, seeking to quash the
decision and an order that certain provisions
We look forward to the DPC publishing the of the Data Protection Act, 2018 are invalid,
following guidance in 2022: unconstitutional and incompatible with the
European Convention of Human Rights. We
• Quarterly case studies based on common await further developments in 2022.
complaint issues.
In September 2021, the DPC also commenced
• Guidance on complaint-handling two inquiries regarding TikTok. The first
processes. relates to platform settings for users under
18 and age verification measures for persons
• Updates on the development of codes under 13 as well as transparency obligations.
of conduct and certifications to enable The second inquiry will focus on transfers of
sectoral best practice. personal data by TikTok to China. We expect
to see progress made in 2022.
The DPC published the final version of the
Fundamentals for a Child-Oriented Approach In December 2021, the DPC submitted a draft
to Data Processing in 2021. This is the culmi- decision (relating to Instagram’s processing of
nation of an intensive project over three years personal data of children) to other concerned
involving three separate stakeholder consulta- supervisory authorities across the EU. We
tion processes (including a direct consultation await the views of the CSAs in early 2022.
with children), engagement with experts
on child rights, expansive research and a
two-stage drafting process. With the publi-  Israel
cation of the fundamentals, 2022 could see a By Dan Or-Hof, CIPP/E, CIPP/US, CIPM, FIP
new age in the processing of children’s data in The Israeli government is moving forward
Ireland, with controllers and processors more with the enactment of two amendments to
aware of their enhanced obligations and the the Protection of Privacy Law, 5741-1981. The
issue stated as a priority for enforcement first, Amendment No. 13, will provide the
by the DPC. Privacy Protection Authority with substantial
enforcement powers that the PPA lacks under
The DPC received additional funding of 4.1 the current law, including considerable fines
million euros for 2022, bringing their total and police-like investigation authority. The

International Association of Privacy Professionals  •  iapp.org 13

second, Amendment No. 14, is aimed at be protected even more, even when they are
narrowing down the mandatory database operating remotely. At the same time, the
registrations and modernizing definitions strong acceleration in digitization has led
under the PPL, including personal data, to a significant increase in cyberattacks;
sensitive data and data processing. So far, companies and public administrations are
the legislation process of these two bills was now called upon to invest more in digital
suspended due to various reasons, but with security and staff training.
the current government, there is a likelihood
they will be enacted in 2022. The other big challenge is social media.
Although it seems to be an exclusively EU
Israel continues to suffer from an increasing game, the Garante has been at the forefront
volume of cyberattacks on companies and of discussions with major social networks,
public bodies, causing mass leaks of personal such as Facebook and TikTok. The intro-
data. As a result, information security duction on the market of new, potentially
continues to dominate data protection privacy-compromising smart devices and the
compliance efforts. Privacy-related class difficulty in finding a reliable solution for the
actions are on the rise. They are focused identification of minors made it necessary
mainly on claims for violation of information to have an honest discussion between the
security statutory obligations, following parties. The companies explained adopted
cybersecurity events that have caused solutions and the Garante provided indica-
unauthorized access to personal data, and tions necessary to ensure a higher coefficient
on use of personal data without appropriate of compliance with data protection regu-
notices and consents, in violation of the PPL. lations. Since these solutions need time to
Class actions continue to be the dominant settle, the year 2022 will certainly be devoted
risk for companies doing business in Israel. to such discussions. It is therefore expected
that in the year to come, the Italian DPA will
The discussions between the EU and Israel be among the most active and attentive on
around the continuance of the adequacy these issues at the international level.
recognition are still underway with no
published end date. Currently, the EU Finally, the digitalization of the public admin-
continues to maintain the 2011 adequacy istration and the development of artificial
recognition decision. intelligence will be at the heart of the Italian
agenda, and the Garante and the protection of
personal data will be at the forefront.
 Italy
Rocco Panetta, CIPP/E
2021 was a busy year for Italy’s DPA, the  Japan
Garante, and 2022 will no doubt be the same. By Gabor Gerencser, CIPP/E
As the EU Commission’s adequacy decision
The recent sanction to an Italian university demonstrates, Japan already has a robust data
for the unlawful use of software to monitor protection regime. Nevertheless, a significant
students during exams and the measures amendment of the Act on the Protection of
taken in relation to the still-persistent Personal Information is to enter into force on
COVID-19 pandemic pave the way for a April 1, 2022, as the second comprehensive
future in which the fundamental rights of overhaul of Japan’s data protection law, which
citizens, students and workers will need to was first enacted in 2005 and significantly

International Association of Privacy Professionals  •  iapp.org 14

amended last in 2017. The current amendment  Lithuania
further strengthens data subject rights Natalija Bitiukova, CIPP/E, CIPM, FIP
in Japan. In 2021, the tensions between data protection
and freedom of expression resurfaced in
Outlined more in detail in this article, the Lithuania when the Supreme Administrative
amendments, among other things: Court found a local newspaper in violation of
data protection rules for publishing personal
• Expand data subjects’ rights when data of the individuals allegedly involved
demanding the cessation of use, cessa- in corruption. The case prompted a debate
tion of third-party transfer, erasure about the need to revise the outdated Law
and electronic disclosure of their on the Provision of Information to the Public
personal data. regulating data processing in the journalistic
context, and the discussion is likely to
• Introduce mandatory obligations to continue into 2022. In addition, the court
report data breach incidents to the decided to conduct a judicial review of the
Personal Information Protection case, and the decision, which will set the
Commission and notify the affected course for judicial enforcement in the future,
data subjects in cases when the data is expected this year.
subjects’ rights and interests are likely
to be infringed. In 2022, Lithuania is set to create an inde-
pendent oversight mechanism for intelligence
• Strengthen current regulations on data activities by adopting a recently proposed
transfers to third parties outside Japan; bill on the Inspector of Intelligence Services.
for example, requiring the provision of According to the bill, a newly established
certain information to data subjects. Ombudsman-type institution will, among
other things, have a right to investigate
During 2021, the PPC issued detailed enforce- complaints related to unlawful personal data
ment rules, explanatory guides and Q&As on processing in the context of intelligence
these amendments. Such detailed rules and activities. If adopted, the law will establish a
guidance elaborate on important practicalities third authority with responsibility for data
of the amendment, such as when and what protection oversight in Lithuania in addition
data breach incidents are to be reported to the already-existing State Data Protection
to the PPC. Inspection and Office of the Inspector of
Journalist Ethics.
Therefore, 2022 and especially its first quarter
will be busy for privacy practitioners in Japan. It is planned that in 2022, 14 new positions
With all the necessary guidance expected to will open in the DPA, increasing the number
be in place, Japanese businesses will have to of its staff by almost 30%. Although a
thoroughly revisit their privacy management positive development, it is likely the DPA will
practices, including external privacy notices face challenges competing for talent against
and adapting incident response manuals. large businesses and law firms and thus be
required to hire more junior staff, potentially
impacting its ability to handle rapidly
growing numbers of complaints and
enforcement cases.

International Association of Privacy Professionals  •  iapp.org 15

Given the high ambitions of the current To date, the CNPD also issued no less than
ruling government in the area of innovation seven different formal advices on bills of law
and new technologies, a stronger emphasis on related to the fight against COVID-19. In 2022,
the implementation of the national artificial the measures to fight the pandemic are likely
intelligence strategy is expected. This, to remain high in the political agenda.
coupled with the European developments
around the AI Act, will likely generate At the same time, the CNPD deals with
national discussions (which were limited “business-as-usual” operations, including
so far) around the tensions between new the publication of 36 decisions (in a country
technologies and human rights, including where the population last year was estimated
the right to private life and personal data slightly under 650,000). Most of these related
protection. to the function of the DPO, CCTV monitoring
and geolocation. In 2022, many more sanction
decisions are to be expected.
 Luxembourg
Vincent Wellens, Yoann Le Bihan, CIPP/E In May 2021, the CNPD launched a
2021 was busy for Luxembourg’s National second public consultation on its
Commission for Data Protection, to say the Article 42 certification framework project
least. The DPA made global headlines by (GDPR-CARPA) but has not yet published
imposing the heaviest GDPR fine ever — the results. Delivering on this project is
approximately 746 million euros — part of the 2020-2022 roadmap and the
to Amazon regarding its interest-based CNPD started working on it before May 2018,
advertising business in July 2021. The so we can expect new developments in the
CNPD decision is being challenged before coming months.
the Luxembourg administrative court of
first instance, and the decision will shed Finally, an important topic that risks
further light on the basis of lawfulness for heating the debates in 2022 is the flow of
such activities and some aspects of the data between public-sector entities and
procedure before the CNPD. Amazon risks private or other public entities. The CNPD
becoming a regular client of the CNPD as seems to require that the list of addressees of
the non-governmental organization behind public-sector personal data must be included
Max Schrems, NOYB, launched new actions in the law governing the administration
against Amazon before the CNPD in 2019 (on concerned, while at the same time, several
the right of access regarding Amazon Prime legislative “open data” initiatives, such as the
service) and at the end of 2021 (on the deploy- draft Data Governance Act on the EU level,
ment of algorithms discriminating users). favor the access to public sector data.

A more stringent enforcement of the rules on

cookies and online trackers will likely come  Mexico
too, following the October 2021 publication of Gabriela Espinosa Cantu, CIPP/US, CIPM
the long-awaited guidelines, which clarified A handful of initiatives to amend the existing
the views of the CNPD and its interpretation Mexican Federal Data Protection Law Held
of the law in practice in this respect. by Private Parties have been presented by
Furthermore, six audits on transparency different members in Congress. And while
in the e-commerce sector are ongoing. none of them has moved forward significantly
through the complex legislative process,

International Association of Privacy Professionals  •  iapp.org 16

indicating a fairly premature parliamentary   The Netherlands
stage, some of them are worth mentioning. Abraham Mouritz, CIPP/E, CIPP/US,
CIPM, CIPT, FIP
Although none of the current amendment 2018 was all about having a privacy
bills are radical in modifying the law to framework, and 2019 and 2020 were centered
mirror the EU’s GDPR, some initiatives on organizations not having their technical
propose changes to provisions that would and/or organizational measures in place.
bring the Mexican Data Protection Law more Several events in 2021 drastically shifted
in line with it, such as: the focus to ensure transparency of data,
especially with AI. It is this area where I see
• Including data portability rights. potential legislative data protection reform
taking place in The Netherlands.
• Notification within 72 hours to affected
individuals after a breach. • Start with the verdict of the Hague
district court in the SyRI case in
• Defining what constitutes a “risk of mid-2020. SyRI is a citizen-risk profiling
harm” to an individual’s rights as a result system designed by the Dutch govern-
of a breach. ment to process large amounts of data
collected by various Dutch public author-
• Providing extraterritorial effects to the ities to identify persons that, according
law-defining obligations to controllers or to the algorithms, are most likely to
processors regardless of where they are commit social benefits fraud. The court
located when certain conditions are met. ruled SyRI was insufficiently transparent
and verifiable, thereby considering the
While some of these initiatives could be use of the system to be unlawful and
worth reviewing and discussing thoroughly, it noncompliant with Article 8 of the
seems unlikely to happen given the political European Convention on Human Rights.
arena in Mexico. Most of these bills have
been presented by lawmakers not part of • In March 2021, the Amsterdam District
the majority in Congress, meaning they are Court ruled the AI systems of ridesharing
trapped at the chamber of origin. Moreover, companies Uber and Ola do not meet the
the Mexican president suggested at the requirements of transparency. The court
beginning of 2021 his intention to dissolve ordered both companies to disclose data
Mexico’s DPA, the National Institute of used to deduct earnings, assign work,
Transparency, Access to Information and suspend drivers and make clear how
Protection of Personal Data, by questioning driver surveillance systems are used.
its autonomy and criticizing its cost. Given My colleague Anton Ekker, the attorney
that the president is in the second half of his representing former Uber drivers, is
mandate and his party holds the majority of truly doing ground-breaking work in
votes in the current legislature, it is unfor- these cases.
tunately most likely that both chambers in
Congress will push his agenda first rather • The Dutch government fell on 15 Jan.
than provide attention and efforts in setting after the use of a child welfare system
a higher bar for data protection and privacy wrongly labelled thousands of parents
rights in Mexico. as fraudsters (“toeslagenaffaire”).
The system used by the Dutch Tax

International Association of Privacy Professionals  •  iapp.org 17

 Authorities consisted of AI risk-based of the data portability right, describing a
algorithms. Similar to SyRI, this system mechanism for consumers to securely share
displayed a bias to certain groups more their personal information with trusted
likely to commit fraud. This crisis also third parties. The right will be rolled out on
highlights some of the dangers of AI. a sector-by-sector basis, with banking likely
To date, this crisis for many households to be the first cab off the rank. The primary
has not been resolved and has left many legislation will create an overarching frame-
people not just wrongly labeled in work for the right, including basic obligations
countless systems, but also with large that will apply to designated sectors. The
debts. As a result, people have lost types of personal information in scope for the
homes, their jobs and around 1,115 right will be specified in each sector designa-
children were rehomed. tion, with more detailed obligations set out in
sector rules and data standards.
These matters illustrate the need to make the
use of AI more transparent — not just to the The Privacy Act 2020 introduced a new
data subjects but also to those who use the requirement for the privacy commissioner
system to better understand why and how to take into account cultural perspectives on
certain automated decisions are being made. privacy when exercising their functions. In
It is not without reason that Article 22 of the Aotearoa/New Zealand, this includes Māori
GDPR places restrictions on decisions “based perspectives. According to outgoing Privacy
solely on automated processing.” Currently Commissioner John Edwards, “we are begin-
the use of AI is predominantly governed by ning to engage in a process of understanding
ethical rules, which, among other things, how (the Privacy Act), this human right, this
stress the need for AI to be transparent and commercial imperative, and this consumer
explained — so-called White Box AI. The protection might be informed by te ao Māori
European Commission’s upcoming regulation and engaged to meet the aspirations of
on the use of AI shifts the need for AI tāngata whenua. This is exciting, and it
transparency from the ethical to the legal saddens me to leave this role as we embark
sphere. The standards for the regulation are on this next stage in the evolution of privacy
not expected to be ready until 2024. in Aotearoa.”

This will be a legislative theme for 2022, with

  New Zealand privacy-related legislative changes on the
Daimhin Warner, CIPP/E horizon that include a focus on Te Tiriti obli-
2021 was dominated by implementation of gations, te ao Māori concepts and increased
the Privacy Act 2020. 2022 will be an excit- engagement with Māori. Examples include
ing year of complementary developments, the Data and Statistics Bill and the Digital
helping New Zealand regain its position at the Identity Trust Framework. These changes
forefront of future-proofed privacy regula- are taking place against a background of
tion, but also signalling the emergence of an increased visibility and discussion of concepts
Aotearoa/New Zealand approach to privacy such as Māori data sovereignty.
that reflects our unique bicultural foundation.
Finally, we will have a new privacy commis-
A bill implementing a new consumer data sioner in 2022, with John Edwards taking up
right will be introduced to Parliament in the role of U.K. Information Commissioner in
2022. This will be New Zealand’s version the new year. It will be exciting to learn what

International Association of Privacy Professionals  •  iapp.org 18

the incoming commissioner’s priorities will While some of the proposed laws advance
be, though they will likely include continuing privacy protection, some pose risks to privacy,
compliance monitoring of the rental sector and like the integration of private closed-circuit
perhaps an early flexing of statutory muscle TV infrastructure into the National Security
with another enforcement action or two. Network in Nigeria Bill and the Internet Child
Pornography Prevention Bill, 2019, pending
before the House of Representatives.
 Nigeria
Ridwan Oloyede, CIPP/E, CIPM, FIP, There is a likelihood of more sector-specific
Oluwagbeminiyi Ojedokun, CIPP/E frameworks from other regulators, increasing
2021 was an eventful year for privacy and organizations’ compliance landscape. For
data protection in Nigeria. The year witnessed example, the Central Bank of Nigeria may
the issuance of sanctions by the National finally release its Data Protection Regulation,
Information Technology Development Agency. mooted since 2018.
The revised National Cybersecurity Strategy
was released. Lagos State legislature held a We expect progress with the National
public hearing for its Data Protection Bill. Electronic Health Record Bill, awaiting the
There were also significant court decisions Healthcare Services Committee report. In
impacting data protection and 2022 is poised addition, we expect to see a revised version of
to be more eventful. the National Health ICT Strategic Framework
after its mandate expired in 2020. Thus,
The most significant proposed legislation is we anticipate another five-year, strategic,
the Nigeria Data Protection Bill 2020, which action-driven framework.
would establish an independent supervisory
authority. The bill’s progress has stalled since With the effort by the Lagos state govern-
2020 when it was first released for public ment to enact a data protection law, we may
contribution and has yet to make it to the see the trend of other states releasing or
legislature. However, there is a move to passing laws with data protection or privacy
develop a new bill instead. As a result, the implications. Another state in South West
development, passage and signing of the bill Nigeria reportedly has a draft law to present
are expected to be accelerated. to its legislature.

We should see progress with the Electronic The inclusion of an 8 billion naira fine for
Transaction Bill and Digital Rights and failure to store data locally was rumoured
Freedom Bill. The president declined assent to be one of the reasons President Buhari
to the latter’s previous version of the bill refused to assent to the 2019 Data Protection
in 2019, now revised and introduced in the Bill. However, there is suspicion that the
House of Representatives and expecting the mandatory data localization provision will
House Committee report. In addition, the find its way back into the 2020 version of the
Electronic Transaction Bill is expected to see bill, albeit with specific categories of data.
some progress. The bill is currently expecting
the Senate Committee on Banking Insurance There has also been much conversation on
and Other Financial Institutions report. pervasive practices of digital lending compa-
NITDA is also expected to amend its estab- nies, and regulators are starting to pay atten-
lishing Act, granting it additional regulatory tion. There is a pending bill before the House
powers over technology companies and data. of Representatives to regulate the activities of

International Association of Privacy Professionals  •  iapp.org 19

the lenders and class action filed for violation Finally, in 2022, the privacy commission
of privacy. In addition, we expect coordinated will issue its report on the state of privacy
action from the Central Bank of Nigeria, in Norway. The commission is a consultative
the Federal Competition and Consumer body appointed by the Norwegian govern-
Protection Commission and NITDA (the ment to map the existing data privacy
substantive data protection regulator) to reign landscape in Norway and identify the most
in the lenders. Finally, NITDA is expected significant challenges going forward. The
to increase regulatory action through the findings of the commission are intended
issuance of guidelines and sanctions. to lay the foundation for further policy
development regarding privacy in Norway.

 Norway
Martha Ingves   The Philippines
The focus on AI is steadily increasing in Irish Salandanan-Almeida, CIPM
Norway and will likely continue in 2022. The The Philippines’ privacy law, the Data
Norwegian DPA, Datatilsynet, started its Privacy Act, was enacted in 2012, with its
Sandbox for Responsible AI in 2021, which Implementing Rules and Regulations issued
aims to support the innovation of ethical and in 2016. Five years into its implementation,
responsible AI solutions. The Sandbox will there are proposed amendments to the DPA
continue with new projects in 2022. introduced by way of a house bill lodged
before Philippine Congress.
Regulatory reforms are also on the horizon,
as Norway is likely to introduce changes to its Among the proposed amendments are the
ePrivacy rules. The Norwegian government inclusion of financial data in the definition
recently proposed the adoption of a new of sensitive personal information and a
Electronic Communication Act, even though clarification on the requirements for personal
it might be short-lived due to the possible data breach notification.
adoption of a new ePrivacy Regulation at
the EU level soon. Among other things, the There are also suggested changes to the
proposed act could entail changes regarding criteria for lawful processing of sensitive and
the rules on consent for the use of tracking personal information, allowing processing
technologies (e.g., cookies), which under the for public health purposes and humanitarian
current legal regime may be given through emergencies, among others, to align the
web browser settings. criteria with international standards. Further,
to address concerns around child online
Norway might witness some high-profile protections, there is a recommended
litigation in the privacy area in 2022. In provision that will require parental consent
December 2021, Datatilsynet issued its for online services offered directly to children
highest fine so far — 65 million NOK (around 15 years old or younger.
6.5 million euros) — against Grindr for failing
to comply with the consent requirements Lastly, to strengthen the implementation
under the GDPR. Grindr is likely to appeal of the DPA, the house bill declared
the fine before the Norwegian Privacy Board definitive functions of the National Privacy
of Appeals, Personvernnemnda, which could Commission, the Philippines’ privacy regula-
issue its decision in 2022. tor, in the exercise of its quasi-judicial powers
and in the effective enforcement of its orders.

International Association of Privacy Professionals  •  iapp.org 20

Another upcoming development is the issu- purpose of potential future claims. Polish
ance of a circular by the NPC, with guidelines courts overturned such decisions, stating a
on administrative fines, designating a range controller cannot predict if and when a data
of 1-5% of annual gross income for certain subject may raise claims. But this does not
privacy violations. exclude such claims being raised, and the
controller has a right to store data to defend
In November, the NPC launched the itself or exercise its claims.
Philippine Privacy Trust Mark with NPC
Chairman Raymund Liboro stating that Regarding notification of data breaches, the
it comes at an opportune time, as the UODO issued decisions where data control-
Philippines aims to fully embrace digitali- lers were found responsible for mail lost by
zation for our economic recovery. He goes professional mail deliverers (such as Polish
on to say this will not be achieved without post or private couriers). It will be interesting
strengthening the foundation of trust in to observe how the situation develops and
every action and transaction we make online. whether controllers will be obliged to control
While completely voluntary, organizations more entities that act on their own.
acting as personal information controllers
and processors are expected to secure PPTM We predict the DPA will change the way it
certification in the coming year to demon- calculates administrative fines. This is based
strate operational privacy compliance and to on the court cases where the current method
increase trust among their data subjects. of calculation was successfully questioned
by one of the controllers. Results of the
dispute should be visible soon in practice
 Poland of the authority.
Marcin Lewoszewski, Anna Kobylańska
For 2022 we predict further, intensive Also, we expect enforcement actions of the
enforcement actions taken by Poland’s DPA, UODO in relation to cross-border proceedings
Urząd Ochrony Danych Osobowych. In 2021, held by the UODO and other EU DPAs. This
we witnessed some interesting court decisions will likely be related to some of the consumer
overturning UODO decisions. Once such protection organizations and their activities
decisions are annulled, the supervisory in Poland.
authority must revise all such cases. We
expect revised decisions on data retention, We expect new legislation related to
notification of data breaches and calculation COVID-19 security measures, such as an act
of administrative penalties. on employers’ access to employee vaccination
status information. We also expect new
Regarding data retention, the UODO took legislation enabling employers to check
the position that a controller should delete employees’ sobriety and an act regulating
the data right after a relationship with a data protection of whistleblowers’ identities.
subject ends. As a result, the controller cannot
claim it has a legitimate interest to keep the In terms of sectorial regulation, we envisage
data later on for the purposes of exercising or a new law on clinical trials, supplementing
defending legal claims. The DPA stated if the EU regulation. Under the new law we should
controller cannot prove it has good reasons see provisions regulating the situation of a
to believe such claims will be raised, the sponsor of clinical trials regarding personal
controller should not store the data for the data of clinical trial participants.

International Association of Privacy Professionals  •  iapp.org 21

We also expect new developments concern- After Jan. 1, some foreign internet companies
ing the interplay between personal data are required to open offices in Russia. The
protection and access to data in the public new law applies to internet giants having
domain. Under new laws, information on all more than 500,000 Russian users daily,
agreements entered into by public institutions hosting providers storing Russian users’
will be made public. As a result, a lot of infor- data and others. The law requires that such
mation included in such agreements, such as companies, among other things, obey the
salaries of employees of public institutions, personal data localization requirement
will be made available to anyone. This may (conduct certain processing operations
influence the way personal data is protected with Russian nationals’ data in databases
and how it may be used by third parties. physically located within Russia). If they
fail, Roskomnadzor may prohibit them from
collecting data, restrict money transfers,
 Russia and/or block access to their websites and
Stanislav Rumyantsev, CIPP/E applications from the territory of Russia
In 2021, Russia adopted several laws demon- without recourse to courts. There is a general
strating a trend towards strengthening data trend towards enforcing the localization
protection. Supervisory authorities will likely requirement.
focus on the enforcement of new rules in 2022.

Beginning March 1, 2021, Russia imposed  Serbia

restrictions on the processing of publicly Petar Mijatović
available personal data. Data operators According to the official yearly report
(Russian equivalent of the term controllers) of Serbia’s DPA, the Commissioner for
must obtain data subjects’ consent to the Information of Public Importance and
publication of personal data. In the consent Personal Data Protection, adopted in March
form, a data subject may specify conditions 2021, the main impediments in exercising
and limitations for the processing of his/her data subject rights in Serbia are the normative
data by anyone who accesses it. Data oper- flaws of the Law on Personal Data Protection,
ators must publish these conditions and noncompliance of other laws with the LPDP
limitations. The DPA, Roskomnadzor, has and lack of implementation of the current
not checked the fulfilment of these rules yet. Data Protection Strategy. In June, the
2022 may bring first case law on the matter. government of the Republic of Serbia formed
the working group for the preparation of the
Next year, Roskomnadzor will inspect compa- draft of the new Data Protection Strategy
nies according to the recently adopted state with an action plan.
supervision and control procedures.
It is expected that in 2022 this working
Parliament is hearing a bill amending group will come out with some suggestions
requirements to the consent form. Written regarding the country`s future plan in the
consent serves as a lawful basis for disclo- field of data protection, especially in terms of
sures of HR data by employers, cross-border better implementation and potential revision
transfers into some countries and in other of the LPDP, which in August celebrated two
cases. If the bill turns into law, data operators years of its application and harmonization
will have to update their templates and with the GDPR.
retrain HR personnel.

International Association of Privacy Professionals  •  iapp.org 22

In 2021, only a couple binding corporate rules and enhancing controls over spam, which
were adopted by the commissioner for the now includes spam sent using instant
transfer of personal data between groups messaging services.
of entities.
This brings us to what to expect in 2022. Data
Keeping in mind that many of the interna- portability and enhanced penalties are two
tional companies operating their businesses other important provisions in the amend-
through Serbian affiliates obtained approval ment that still have not been enforced and
by an EU DPA on their BCRs, it can be we may see these happening soon. Already a
expected that in 2022 many of them will fundamental data subject right in the GDPR,
implement the requirements of Serbia’s LPDP data portability will be enforced soon, albeit
and initiate the procedure of obtaining the with a list of exceptions. Those include a case
approval from Serbia’s DPA on their BCRs as where the transmission can cause immediate
well. In this case, Serbian affiliates will have or grave harm to or threaten the safety or
the right to rely on BCRs as an appropriate physical/mental health of the individual
safeguard for transfer of personal data within concerned, or is contrary to national interest.
the group of entities. Singapore was already in the “million-dollar
penalty” club — a rarity in the rest of the
region — and the penalties for organizations
 Singapore will soon be enhanced further and imposed
Pranav Rai, CIPP/A on new classes of organizations: Up to 10% of
The previous few years saw the first compre- the breaching organization’s annual turnover
hensive review of Singapore’s Personal Data in Singapore if the annual turnover exceeds
Protection Act since its enactment, resulting SGD 10 million, and for use of dictionary
in an amendment with the aim to continue attacks and address-harvesting software, up
safeguarding consumers’ interests and keep to 5% of the breaching organization’s annual
pace with technological advances and new turnover in Singapore if the annual turnover
business models. exceeds SGD 20 million.

The amendment takes effect in phases and

2021 saw its first batch enforced. Some are   South Africa
innovative, like the amendment removing Nerushka Bowan
consent requirements — subject to certain 2021 was a significant year for data privacy
conditions — for organizations that use in South Africa. On July 1, the long-awaited
personal data to improve or enhance their Protection of Personal Information Act,
products, services, methods or processes, 2013 commenced following a 12-month grace
and even understand customer behavior period. As a result, we do not anticipate any
and preference. further major legislative changes this year,
but we do anticipate various developments
There are others that are perhaps not so and a busy year.
imaginative, but nevertheless in line with
Singapore’s privacy ambitions and aims, like Over the course of the year, we anticipate
including a mandatory breach notification businesses continuing to get to grips with
system, bringing personal data processors on their compliance obligations from POPIA,
behalf of public agencies within the PDPA’s the further operationalization of the DPA,
ambit, further empowering the commission the Office of the Information Regulator,

International Association of Privacy Professionals  •  iapp.org 23

additional guidance published by the reg- There are certain sections that have not yet
ulator, approval and publication of codes come into force: the prosecution of cyber-
of conduct for industry bodies and sectors, crimes, the handling and preservation of
the publicizing of data breaches, civil action evidence, and the reporting obligations for
regarding the right to privacy and POPIA, and telecommunications providers and financial
enforcement actions taken by the regulator. services institutions. We anticipate the
We also anticipate an increase in the number date for commencement for the remaining
of data subject access requests received by provisions of the Cybercrimes Act will be
responsible parties as well as access to infor- announced later this year.
mation requests, courtesy of the Promotion
of Access to Information Act, 2000.
  South Korea
We anticipate guidance from the regulator Kyoungjin Choi
on a number of topics, including cross-border In 2020, South Korea allowed the compatible
transfers of data, data breach reporting and use of personal data and the processing of
the handling of juristic person information. pseudonymized data for archiving in the
South Africa is one of the only jurisdictions public interest, scientific research purposes
in the world that recognizes and protects or historical research purposes through
the personal information of existing juristic the revision of the so-called “Three Data
persons in addition to living natural persons. Laws,” in response to the data era. And the
Personal Information Protection Committee
The regulator reported that it received a was reborn as an independent supervisory
number of data breach notifications already. administrative authority. However, there were
However, we have not yet seen any enforce- criticisms the revision of the “Three Data
ment action from the DPA. POPIA gives the Laws” did not reflect all the diverse demands
regulator strong powers to enforce compli- of changes in the data age. The PIPC prepared
ance with the Act, including issuing notices, a drastic amendment bill through the
launching investigations, taking on lawsuits Drafting Committee for Amendment of
on behalf of data subjects and issuing admin- Personal Information Protection Act,
istrative fines of up to ZAR 10 million. and several amendments, including the
government bill, are currently pending in
Although South Africa now has comprehen- the National Assembly. An alternative that
sive data protection legislation, we do not yet integrates several laws is being prepared, and
have adequacy status in terms of the GDPR. in 2022 the PIPA is expected to be revised in
We hope to achieve this status in 2022. Sim- the following direction:
ilarly, we hope to receive guidance from the
regulator deeming the EU to be adequately • The distinction between online and
protective regarding POPIA. offline disappears and the same basis for
processing personal data applies.
Another significant regulatory development at
the end of last year was the commencement • As new rights of data subjects, the rights
of the Cybercrimes Act, 2021 in December. related to automated decision-making,
The Cybercrimes Act creates a host of new such as the right to object or the right to
cybercrimes, such as cyber fraud and explanation as well as the right to data
revenge porn. portability are introduced.

International Association of Privacy Professionals  •  iapp.org 24

 • A new system for international transfers without any legal basis through the AI
of personal data is introduced by application Clearview. The DPA declared the
stipulating adequacy decisions or certifi- usage was a breach of the GDPR. The DPA has
cation as the legal basis for transborder shifted strategy in its enforcement actions,
data flow. now prioritizing complaints before risk-based
proactive enforcement of specific processing
• The self-regulation system is activities. We expect to see a speedier process
strengthened. in 2022 and receive more interesting case
law in the coming year, e.g., use of consent
• The scope of the law is extended to for cookies, use of Google Analytics in view
mobile image data processing devices of the “Schrems II” judgement, role of joint
in addition to closed-circuit TV. controllers and more.

• A unified legal basis for legitimate During 2021, the Swedish government sought
processing of personal data is estab- to improve the infrastructure and the use of
lished by integrating without distinction e-identification within the public sector. The
according to collection/use or provision current system, which has relied on private
to a third party. identifications systems, has been considered
not sufficiently secure. Therefore, a report
• The dispute mediation system is was presented with a proposal of a legal
strengthened. framework regarding acceptance and
verification of e-identification services that
• Blind spots in the PIPA are eliminated can be used in contact with the public sector.
by reducing the exclusionary rules and In 2022, it is expected legislative proposal
incorporating them into the legal basis shall conclude and may open the government
for legitimate processing. to new services.

• The existing criminal sanctions signifi- Following the discussion of whether public
cantly shift to economic sanctions, such authorities could or should outsource their
as administrative fines (less than 3% of IT operations or use public cloud services,
total turnover). the government presented an interim report
at the beginning of 2021. The interim report
As PIPA is expected to be significantly revised analyzes the government agencies’ need
in 2022, global data controllers must prepare for secure and cost-effective IT operations,
with special attention. security and legal conditions for coordinated
government IT operations, and analyzes
the legal conditions for public authorities,
 Sweden municipalities and county councils to
Sofia Edvardsen outsource IT operations and cloud services
At the beginning of 2022, there were over to private suppliers with maintained
100 ongoing investigations by Sweden’s DPA, security. The report provided a framework
the Integritetsskyddsmyndigheten, which is for assessing risk much like the European
an increase compared to previous years. The Data Protection Board framework on
oldest investigation is from March 2019. A “Schrems II” and did not rule out cloud
case that garnered a lot of media attention service providers as such. A new Swedish
was the police’s use of facial recognition Government Official Report on the

International Association of Privacy Professionals  •  iapp.org 25

subject was issued Dec. 15, which specifically • The possibility (but not the obligation) for
addressed the Swedish authorities’ need for private data controllers to appoint a DPO.
a secure and cost-effective IT operation.
Furthermore, it addressed the appropriateness • The obligation to carry out impact
and legality to use cloud services in the assessments.
public sector.
• The encouragement made to professional
In the beginning of 2022, the government associations to draft their own codes of
presented a bill with a revision of the conduct and submit it to the supervisory
Swedish Consumer Sales Act that applies to authority for approval.
the purchase of goods as well as digital con-
tent and digital services. The proposal aims to • The obligation for private companies with
adapt Swedish law to two EU directives and more than 250 employees to maintain a
entails, among other things, clearer rules for record of processing activities.
assessing errors in digital content with some
relevance for data protection. • The duty to notify security breaches as
well as some reinforcement of individ-
The government’s work on cybersecurity uals’ rights, in particular regarding the
proceeded with the foundation of a new right of access and data portability.
Swedish Cybersecurity Centre. Sweden
implemented the EU Regulation (EU) 2019/881 In terms of sanctions, fines of up to CHF
(Cybersecurity Act) in July 2021. We except 250,000 may be imposed on private individ-
to see much activity in this field in 2022. uals in the case of intentional behavior and
omissions only. Negligence will therefore not
Further, the implementation of Directive be sanctioned. It should be noted that if the
(EU) 2019/1937 on the protection of persons identification of the person responsible within
who report breaches of Union law entered a company requires disproportionate inves-
into force mid-December 2021, aiming to tigative measures, the company itself may
increase the possibilities for employees in be sanctioned, but up to a maximum of CHF
both the public and private sectors to 50,000. In contrast to the European authori-
report misconducts. ties, the commissioner will still not be able to
impose administrative sanctions. Offenders
will therefore be punished by the cantonal
 Switzerland criminal prosecution authorities, to which the
Stéphane Droxler, CIPP/E, CIPM commissioner may report offenses.
After more than three years of parliamentary
discussions, the revision of the Data The enforcement of this new law is not
Protection Act was finally approved in expected before the second half of 2022, or
September 2020. The new law aims to achieve even early 2023. At the time of writing, the
EU recognition of data protection equivalence. consultation period for the draft implement-
ing ordinance just ended. This highly contro-
To this end, it provides new tasks for data versial text does not provide the substance
controllers and processors, such as: expected for the implementation of the law to
be achieved. Many privacy pros think either it
• The introduction of the principles of will have to be rewritten or many provisions
privacy-by-design and default. will have to be amended.

International Association of Privacy Professionals  •  iapp.org 26

  Thailand data protection impact assessments, data
Yulia Askhadulina, CIPP/E protection standards, certification and
On May 27, 2019, Thailand adopted the international cooperation.
Personal Data Protection Act 2019, the coun-
try’s first general data protection law with The PDPA was enacted as part of the
GDPR-like extraterritorial reach. The law Thailand 4.0 plan, a countrywide reform
prescribed a one-year grace period for the aimed to create an innovation-driven
formation of the Personal Data Protection economy, as shown in the PDPA Master
Committee, issuance of subordinate regula- Plan. Unfortunately, the current economic
tions and businesses to prepare towards outlook is not looking great for Thailand, as
compliance. In 2021, the PDPA’s enforcement the economy is heavily reliant on tourism
date was postponed to June 1 of this year fol- and COVID-19 travel restrictions continue to
lowing the Ministry of Digital Economy and impact the country negatively. Should this
Society’s request to enable its stakeholders trend continue in 2022, the government may
to cope with the effects caused by COVID-19 need to focus on more pressing issues.
and allow for the formation of the Personal
Data Protection Committee. Despite the
general delay of the PDPA, data controllers  Turkey
are required to implement security measures Furkan Güven Taştan
under the Personal Data Security Standards Turkey celebrated the fifth year of its
B.E. 2563 (2020) set forth by the MDES. first-generation data protection code in 2021,
which has made bold moves to enhance
The PDPA prescribes the general require- Turkish data protection culture. In 2022, eyes
ments applicable to personal data processing will be on the march toward the revision of
and the specific requirements are left out the Turkish Data Protection Act, a move that
to be addressed in the subordinate regula- appears to be gaining momentum. It is possi-
tions. Throughout 2021, the MDES acted as ble we will see an act more compliant with the
the temporary Office of the Personal Data EU’s third-generation regulation, the GDPR.
Protection Committee and conducted a
series of public consultations for the draft One of the Turkish presidency’s strategic aims
subordinate regulations, two of which were in the 11th Development Plan is the revision
conducted in English. The subordinate reg- of the Turkish Data Protection Act to comply
ulations are organized into three groups. with EU standards. The Ministry of Justice
Group 1 covers consent requirements, privacy correspondingly set the timeline for the
notices, responsibilities of data controllers, reform process. The legislation is anticipated
cross-border data transfers, DPOs, qualifica- to be enacted in April 2022 after receiving
tions and requirements, security measures, public opinion. Turkey will likely follow the
compliance processes, and sensitive personal same path as the EU by adopting a risk-based
data processing. Group 2 covers, among other approach and the accountability principle
things, scope clarification and representative with this reform package. These adoptions
designation, cooperation and consistency may be considered the essence of the
mechanisms, derogations, data subject prospective act.
rights, the responsibility of data processors,
archiving purposes in the public interest, As for the details, conditions for processing
and research and statistics. Group 3 covers special categories of personal data that are
codes of conduct, automated processing, challenging in Turkey’s corporate world will

International Association of Privacy Professionals  •  iapp.org 27

be readjusted in harmony with the GDPR. approve a new data protection law building
Moreover, the means for transfers of on the existing QFC regulations and aligning
personal data abroad as provided in the law closer to the DIFC and ADGM legislations)
in force will possibly be extended with novel will begin negotiating a tri-partite data
appropriate safeguards such as BCRs, codes adequacy agreement between the three
of conduct and approved certifications. financial centers, as well as joining the DIFC
Another critical prospective revision might in pursuing adequacy approval from the U.K.
be presented in the increase of the current
administrative fines that are insufficient to The broader region is also set to experience
enforce the law effectively. In sum, the new significant momentum in terms of regulatory
legislation package may prove that Turkey will developments that emulate the GDPR and
be increasingly considered a strict follower impact corporate and governmental data
of countries with relatively more harmonized privacy obligations. This will include clarifica-
data protection regulations. tion around data localization requirements in
various jurisdictions and ratifications relating
to penalties and criminal accountability
  United Arab Emirates (particularly in Egypt’s Data Protection Law).
Ben Crew, CIPP/E Free zones in Saudi Arabia, specifically Neom
Organizations across the country are going and the King Abdullah Financial District,
to feel a profound impact from the recently will develop their own unique data privacy
enacted UAE Personal Data Protection Law. laws to compete with the DIFC and ADGM
As a Dubai-based data privacy consultant as major business centers. In parallel, addi-
with more than a decade of experience in tional countries will follow the lead of Saudi
this space, I expect the executive regulations, Arabia and the UAE in an attempt to lay the
due in March, will see a final version of the groundwork for a long-term, Gulf Cooperation
law being a more business-friendly, slimmed Council-wide data privacy accord that will
down version of the GDPR, similar to the data likely come into force in the next five
protection laws recently established in the to 10 years.
Dubai International Financial Centre and Abu
Dhabi Global Market.
  United Kingdom
Beyond the passage of the UAE Data John Bowman, CIPP/E, CIPM, FIP
Protection Law, we expect to see additional The U.K. government hit the ground
activity across the country. For example, running in the second half of 2021 with the
the DIFC is strengthening its data privacy publication of its ambitious plans for data
position, including making impending reform to boost innovation, economic growth
changes to its 2020 Data Protection Law to and protect the public. The results of the
remedy shortcomings revealed since it was government’s consultation on reform should
enacted. An adequacy decision from the emerge in 2022. It will be interesting to see
Department for Digital, Culture, Media & if feedback received from industry, privacy
Sport in the U.K. for the DIFC is also expected advocates and other interested parties is
this year, something that would significantly taken into account as the government firms
improve the business environment for up its policy proposals. Whether this results
companies operating under that jurisdiction. in new legislation during 2022 remains to be
Additionally, the ADGM, DIFC and Qatar seen. However, policymakers in the EU will
Financial Centre (which is expected to likely monitor developments closely to see if

International Association of Privacy Professionals  •  iapp.org 28

any potential reforms to the data protection other priorities to deal with, including the
regime diverge too far from the standards ongoing COVID-19 pandemic and the upcom-
necessary for the European Commission’s ing mid-term elections. It is possible legisla-
U.K. data adequacy decision to remain valid. tion concerning specific issues like children’s
In the meantime, the U.K. government will be privacy and biometric privacy may be passed.
advancing its own program of data adequacy
partnerships with the U.S., Australia, South On the enforcement front, the U.S. Federal
Korea, Singapore, the Dubai International Trade Commission is expected to begin
Finance Centre and Colombia, all named rulemaking on privacy and AI. Currently, the
as priority candidates for U.K. adequacy Build Back Better Act is under Senate consid-
determinations. eration and, if passed, would grant the FTC
$500 million, stronger enforcement authority
Another key development is the appointment and additional resources.
of a new information commissioner for the
U.K. John Edwards moved from New Zealand Check with the US Federal & State Privacy
to the U.K. to take on this high-profile role in Watch page in the IAPP Resource Information
succession to Elizabeth Denham, who stood for the latest information.
down after more than five years in the post.
The government has proposed some changes
to how the Information Commissioner’s Office   United States —
operates and to the role of the commissioner,
including empowering businesses to use data health care
to drive innovation and growth in a way Kirk Nahra, CIPP/US
that protects the public. In the meantime, Health care privacy, as both a legislative and
institutions should monitor developments a regulatory matter, is becoming more compli-
in regulatory enforcement under the new cated and less stable with each passing year.
commissioner to see if there are changes in
priorities or approaches. On the legislative front, the most likely
developments will continue to focus on
the implications of health care under the
  United States “comprehensive” state privacy laws. These
Michelle Clarke new laws — in California, Virginia and
2022 promises to be another busy year for Colorado — treat health privacy in mostly
U.S. privacy legislation. California will begin consistent ways by creating wildly inconsis-
its rulemaking process and Virginia lawmak- tent frameworks for health information and
ers are slated to review seven amendments health privacy.
to its privacy legislation. More than a dozen
states have introduced or reintroduced In California, for example, health information
privacy legislation since Jan. 1. It will not be of California residents can be regulated under
a surprise if we see two or three states pass at least six different frameworks under the
comprehensive privacy legislation before the California Consumer Privacy Act and
end of the year. California Privacy Rights Act. This includes
the Health Insurance Portability and
Will the increase in state privacy laws Accountability Act and information
spur the passage of a comprehensive federal regulated by the Confidentiality of Medical
law in 2022? It’s unlikely, as Congress has Information Act (a sort of — but not quite —

International Association of Privacy Professionals  •  iapp.org 29

“mini-HIPAA” specific to California), which of the rule (and of the relevant Health
are both exempt from the CCPA. Information Technology for Economics and
Clinical Health Act provisions).
The CCPA then kicks in to regulate in some of
the gaps left by these other laws, but does not We also can expect to see health privacy
apply to health information of non-profits or addressed in discussions about COVID infor-
most health information held by employers mation, primarily in the ongoing political
about employees (including virtually all disputes about vaccine mandates and the like.
COVID-related information, especially vaccine To be clear, in most situations, vaccine infor-
information). This general approach applies mation is not regulated by HIPAA — when
in Colorado and Virginia as well to create your employer asks for your vaccine infor-
different rules for similar information mation, HIPAA is not relevant. Same with
depending on who holds it and for what your airline, neighborhood restaurant, gym or
purposes. We will watch to see whether movie theater. We are likely to see proposals
other states follow this pattern as they try to address the privacy of vaccine information,
to pass their own state privacy laws. We will but in isolation rather than as part of a more
also consider if this same approach will apply comprehensive look at health care privacy.
under federal privacy proposals as they move
forward next year.
 Zimbabwe
On the HIPAA front, the U.S. Department Kuda Hove
of Health and Human Services is reviewing On Dec. 3, 2021, the Data Protection Act of
various information-sharing rules to address Zimbabwe came into effect. This law has been
issues related to opioid use and social deter- in development since 2013. According to the
minants of health. Specifically, it is debating act’s long title, the law seeks to “provide for
whether to expand the scope of permitted dis- data protection with due regard to the
closures to allow more disclosures to family Declaration of Rights under the Constitution
members, social service agencies and others … to establish a Data Protection Authority
in the interests of individuals even when and to provide for their functions.” Addition-
the individuals do not seek or approve these ally, the act also makes amendments to the
disclosures. These regulatory evaluations also Criminal Code (Codification and Reform) Act
may lead to legislative provisions, as there to provide for investigation and collection of
is meaningful debate about whether these evidence of cybercrime, unauthorized data
disclosures should actually be permitted. collection and breaches, and to provide for
admissibility of electronic evidence for
The FTC is also entering the regulatory debate such offenses. Lastly, the act amends the
about health privacy through a statement Interception of Communications Act to
of principles related to the personal health establish a Cyber Security and Monitoring of
records data breach notification rule. Because Interception of Communications Centre.
of the broad gaps left in the protection of
health information due to the limited scope The Data Protection Act defines key data
of the HIPAA rules, the FTC is seeking to protection concepts such as personal
expand the scope of this breach notification information, biometric and other sensitive
rule and apply it to a broader range of health data, data subject, data processor and data
care mobile applications, beyond the personal controller. Additionally, the act outlines the
health records that were the original focus circumstances under which the transborder

International Association of Privacy Professionals  •  iapp.org 30

flow of data may be undertaken. The act des- is currently no provision for any kind of
ignates the country’s existing telecommunica- judicial oversight of the operations of this
tions regulator, the Postal and Telecommuni- interception center.
cations Regulatory Authority of Zimbabwe, as
the national DPA. This focus on the interception of commu-
nications is in line with the government’s
Apart from these positive provisions, the announcement in November 2021 about the
act has several provisions that undermine creation of “a cyber-team that is constantly
the constitutional right to privacy and data on social media to monitor what people send
protection in general. For example, the and receive since we cannot wish social media
amendment to the Interception of away.” In 2022, it is expected there will be
Communications Act that establishes a Cyber an increase in state-sponsored surveillance,
Security and Monitoring of Interception of which includes the interception of communi-
Communications Centre places the center cations, especially considering the country is
under the president’s direct control. There expected to hold elections sometime in 2023.

For more privacy-related resources, including legislation trackers, tools, guidance, surveys and
in-depth reports, check out the IAPP Resource Center.

International Association of Privacy Professionals  •  iapp.org 31