Governments around the world have stepped in to regulate the collection and use of personal data. In this video, we'll take a high level look at the most prominent laws GDPR, CCPA and COPPA and any online advertiser and marketer should understand these laws. As a consumer, it's also good to know what your rights are. Let's begin with GDPR. GDPR stands for the General Data Protection Regulation. It's a law that protects data and online privacy in the European Union. GDPR is a very detailed and pretty complex law. At high-level, we can group some of its key requirements into two buckets. EU citizen data rights, and data protection obligations for companies who collect the data. As for citizen rights, the law specifies that people have the right to access the personal information received about them, they have the right to correct that information, the right to have all the information that was collected and saved about them erased, and they have the right to data portability. In other words, they have the right to get a file of their personal information and pass it onto another party. As for the data protection obligations, the law specifies how companies must protect the information that they receive. It also specifies that companies must alert people within 72 hours if their personal data was leaked, and companies must designate people whose job will be to protect the data they receive. The law also says that companies should limit their data collection and that certain data categories are prohibited, for instance, ethnicity and sexual orientation. Before they receive any data, companies should ask for consent. GDPR was developed and is managed by the European Union. Any company that works with the personal data of EU residents, must comply no matter where the business is based. The different EU countries have their own supervisory authorities that monitor compliance. Fines related to GDPR can be substantial, up to four percent of the annual revenue of a company. In July 2019, British Airways was issued a $230 million dollar GDPR fine, after the personal details of around 500,000 customers were stolen in cyber attacks. The Information Commissioner's Office in the UK investigated and concluded that the hackers were able to steal the information as a result of poor security arrangements at British Airways. Laws like this and fines of this magnitude have raised attention to data security. Next, let's have a look at the CCPA. In 2019, the Governor of California signed into the law, The California Consumer Privacy Act. Enforcement of this law started in 2020. The strictest of any consumer privacy laws in the US, this law aims to give residents of California more privacy and protection. And, this law is not dissimilar from the GDPR. The law wants to give consumers more insight into what data is collected about them and a say in whether or not they want the data to be collected. There are five distinct rights the CCPA gives to consumers. The right to know what information is collected about them, the right to know whether that data is sold and to whom, and the right to opt out of that sale, the right to access the personal information that was collected about them, the right to require a business to delete their personal information and finally, the right to not be discriminated against for exercising their rights under the act. The CCPA falls under the responsibility of the California State Attorney General's office. Any business that collects and controls the personal information of California residents, should comply with the CCPA. The California Attorney General and residents of California can initiate lawsuits and fines under the CCPA can be up to $7,500 dollars for intentional violations and $2,500 dollars for unintentional violations. The law went into effect in January 2020, so it's too early for any high-profile lawsuits under this law. Another important law to be aware of as a marketer is COPPA, or the Children's Online Privacy Protection Act. This law took effect in 2000 and it limits the collection and use of personal information of people under the age of 13. COPPA was specifically designed to protect children. It requires that notice be given and parental consent is obtained before any personal information is collected from children. It also requires that companies have a clear and comprehensive privacy policy and companies that collect data from minors, need to keep that data confidential and secure. COPPA is managed by the US Federal Trade Commission, the FTC. All companies that interact with children under the age of 13 in the US, must comply with COPPA. The FTC relies on people to alert them to violations of COPPA and those complaints can prompt in an investigation. Fines related to COPPA can be very substantial, up to $40,000 dollars per violation. In 2019, Google was fined $170 million dollars for collecting and saving personal information from children and using it for advertising. This was a very high level overview of the most prominent laws that governments have established to regulate the collection, and use of personal data. In the next video, we'll have a look at how the advertising industry itself is also stepping in to regulate the way data is used. See you there.
