Suggestions
Felicity Slater
Legal and Policy Intern at Future of Privacy Forum
Felicity Slater is a dedicated professional with a background in Law & Policy, specializing in Privacy & Tech Law.
She has a Bachelor's degree in Philosophy from Grinnell College and a Master of Philosophy (M.Phil.) in Philosophy from The Graduate Center, City University of New York.
Felicity has gained valuable experience through various roles such as Legal and Policy Intern at Future of Privacy Forum, a research assistant at Boston University School of Law, and a Development Associate at Madison Square Park Conservancy.
She has also been a J.D. Candidate with a concentration in IP and Information Law at Boston University School of Law and held the position of Matthew Z. Gomes Fellow at the BU/MIT Technology Law Clinic.
Currently, Felicity is a Law & Policy Intern at Future of Privacy, focusing on Privacy & Tech Law at BU Law, and serves as a Board Member at BKROT.
Highlights
Today, for the first time, the FTC enters into a consent decree with a data broker that bars that broker from sharing or selling any sensitive location data going forward. This settles the FTC's allegations that the company, "sold precise location data that could be used to track people’s visits to sensitive locations such as medical and reproductive health clinics, places of religious worship and domestic abuse shelters."
Gov. Carrney has signed the Delaware Personal Data Privacy Act (DPDPA) into law, making DE the 12th U.S. state to have enacted comprehensive privacy legislation (https://lnkd.in/eYs8uH6d).
The DPDPA will take effect on January 1, 2025 and follows the general model established by the Connecticut Data Privacy Act (CTDPA), with some key differences. For Future of Privacy Forum, I wrote about the features that make the DPDPA unique (https://lnkd.in/eKe_FF8i):
1️⃣ Broad Scope The DPDPA establishes the lowest primary coverage threshold of any state comprehensive privacy law passed so far, applying to organizations that control or process the data of at least 35,000 Delaware residents annually.
2️⃣ Sensitive Data Categories The DPDPA creates a category of “sensitive” personal information that is subject to greater protections, and expands this category beyond that which is established by many other states to include “status as transgender or nonbinary" and “mental or physical health condition or diagnosis (including pregnancy).”
3️⃣ Protections for Teens The DPDPA forbids covered entities from selling or processing for targeted advertising purposes the data of consumers that the controller knows, or willfully disregards, are between the ages of 13 and 17 without consent.
4️⃣ Expanded Rights to Access and Delete In line with other comprehensive privacy laws, the DPDPA grants consumers the right to require controllers to delete their personal data. Unlike comparable laws, however, the DPDPA requires controllers to delete data obtained about a person from a third-party source (such as a data broker) except for “a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal data remains deleted from the controller’s records,” which they may not use for any other purpose. The DPDPA also creates a unique affirmative right to “obtain a list of the categories of third parties to whom the controller has disclosed the consumer’s personal data.”
5️⃣ Unique Treatment of Nonprofits Delaware joins Colorado and Oregon in not generally carving out nonprofit organizations in its scope. Like Oregon, however, the Delaware law carves out nonprofits that combat insurance fraud. The DPDPA also creates a novel data-level exemption for the the personal data of staking or abuse victims.
6️⃣ UOOM Uncertainty The DPDPA establishes that consumers have the right to opt out of the processing of their personal information for: targeted advertising, data sales, and profiling for the purposes of automated decision-making with significant impact on the consumer. Drafting ambiguities make it unclear whether the DPDPA permits opting-out of profiling via device signals, which would be a first for a state comprehensive privacy law.
