Best Practices

Age Appropriate Design: new code of practice regarding online services for children from the UK Information Commissioner

The UK Information Commissioner’s Office has published a new code of practice for online services directed to children, Age appropriate design: A code of practice for online services. The new code sets 15 flexible standards and gives specific explanations of how the GDPR applies to childrens’ online activities and pursuits. The code is not a

Health Industry Cybersecurity Practices: New consensus practices and tools from HHS

The US Department of Health and Human Services (HHS) has produced a set of cybersecurity resources for healthcare provider organizations from small to large. So far, HHS has published four documents: an overview report of cybersecurity issues and practices, two technical volumes, and a toolkit. The documents focus on what an expert multistakeholder consensus group determined to be the five most prevalent cybersecurity threats and the ten core cybersecurity practices. The practices are voluntary, and utilize the NIST cybersecurity framework. The documentation is based in reality, not conjecture, and the documents are not intended to sell any particular products for any particular vendor. This has allowed for a rich and helpful documentation of current challenges along with solutions. See our overview of the four new resources.

Public Comments: WPF comments on proposed revised consent decree re: Uber; requests FTC to hold workshop to determine standards for privacy assessments

In comments to the FTC regarding a proposed revised consent decree with Uber Technologies, Inc., WPF urged the FTC to clarify what the term “assessment” means in the context of a consent decree with a company. The comments note that the requirement for an assessment is not the same as the requirement for an audit.