In this lesson,
we will learn about privacy regulations.
Privacy regulations are designed to protect
individual's personal information and privacy rights
by setting requirements for how organizations
collect, store, use, and share data.
For example, the Children's Online Privacy Act, or COPPA,
focuses on protecting children's data in the US.
The General Data Protection Law, or LGPD,
sets data protection standards in Brazil.
The California Consumer Privacy Act, or CCPA,
addresses privacy rights in the state of California.
And the General Data Protection Regulation, or GDPR,
enforces data protection across the European Union.
In all cases,
organizations must adapt their security strategies
to comply with these diverse regulations,
ensuring robust data protection and privacy measures
tailored to different legal requirements
in different geographical regions.
Let's learn more about the Children's Online Privacy Act,
the General Data Protection Law,
the California Consumer Privacy Act,
and the General Data Protection Regulation.
When developing a security policy,
it's essential to involve experts
from legal, human resources, public affairs,
and other key stakeholders
to ensure compliance with relevant laws and regulations.
There are numerous laws and regulations
that our organizations need to follow,
and experts help ensure our security policies
meet or exceed all applicable legal requirements.
For the exam,
you need to be familiar with the various laws, regulations,
and standards that might apply to your organization,
such as GDPR,
which affects how personal data is processed and protected.
Understanding how regulations like GDPR
impact your organization is very important.
In this lesson, we'll discuss a range of regulations,
and while you don't need to memorize everything,
you should be able to recognize key words.
For instance, when you hear GDPR,
you should associate it with data privacy
and personal information protection,
especially when handling data from the European Union
or its citizens.
First, we have the Children's Online Privacy Protection Act,
or COPPA.
COPPA sets specific requirements for website operators
and online services
that are directed toward children under 13 years of age.
COPPA also applies to any website or service
that knowingly collects personal information
from users under 13,
even if the site isn't specifically targeting children.
Essentially, if a company knows it's collecting data
from a child under 13 years of age,
whether intentionally or not,
COPPA requires them to follow strict guidelines
to protect the child's privacy
and secure their personal information.
So let's imagine you are running a website like Facebook
and collecting data from all your users.
You are subject to COPPA.
However, large tech companies like Facebook
often try to claim they aren't bound by this law
because they don't specifically target children under 13.
In fact, when someone creates a Facebook account,
they're asked to enter their birthday,
and if they're under 13,
they can't proceed without parental consent.
However, many kids bypass this
by lying about their age to create an account.
So even if children are lying about their age,
that website Facebook is still subject to COPPA.
Under COPPA, the federal government,
specifically the Federal Trade Commission,
can issue fines of up to $40,000 per violation,
which can add up quickly.
While this could devastate small businesses,
larger companies like Facebook and Google
may not feel the financial impact as much,
making COPPA a topic of debate.
It's important to note that if your product or service
could be used by younger audiences,
COPPA will apply and impose strict requirements.
Second, we have Brazil's General Data Protection Law,
or LGPD.
LGPD sets specific requirements
for how companies and organizations
handle the personal data of individuals in Brazil.
This law applies not only to businesses operating in Brazil,
but also to any company, regardless of location,
that processes personal data from Brazilian residents.
It ensures that businesses follow strict guidelines
regarding the collection, storage,
and usage of personal information,
prioritizing the protection of privacy.
So let's imagine you are running an online service
that collects user data,
including names and email addresses
from Brazilian customers.
Even if your business isn't based in Brazil,
LGPD still applies,
requiring you to obtain clear consent from users
before gathering their information.
Users also have the right
to request access, correction, or deletion of their data.
Non-compliance with LGPD can result in significant fines
up to 2% of your company's revenue in Brazil,
with a maximum of 50 million reals per violation.
This can have serious consequences,
especially for smaller businesses.
So it's important to ensure compliance
if your organization processes data
from Brazilian residents.
Third, we have the California Consumer Privacy Act, or CCPA.
The CCPA gives California residents more control
over the personal data that companies collect from them.
It applies to businesses that meet specific criteria,
such as earning over $25 million in annual revenue,
or those that handle the personal information
of 50,000 or more customers.
Under CCPA, consumers have the right to know
what personal data is being collected,
the ability to request that their data be deleted,
and the right to opt out of the sale of their data.
So let's imagine you are running an online retail site
and collecting data from California-based users,
like names and shopping preferences.
Since your business is required to meet CCPA criteria,
you are required to inform customers
about the data you are collecting
and give them the option to request its deletion
or to opt out
of having their information sold to third parties.
Non-compliance can lead to penalties,
with fines of up to $7,500 per intentional violation.
While these fines
might not significantly impact large corporations,
they could pose a challenge for smaller businesses.
It's important to note
that CCPA applies even if you're not based in California
as long as you handle data from California residents.
Fourth and finally,
we have the General Data Protection Regulation, or GDPR.
The GDPR is one of the biggest and best requirements
in terms of consumer privacy protections.
GDPR is a law created by the European Union
and enforced by the data protection authorities
in each European Union member state.
Here's how GDPR works.
It states that personal data cannot be collected, processed,
or retained without the individual's informed consent.
Informed consent means that the data is collected
and used only for the specific purpose
clearly explained to the user in plain language,
not hidden in legal jargon.
For example, if a website asks
for your name, email, and address
to sell and deliver you a product,
then that company selling and delivering the product
is their stated purpose.
They can't send you marketing materials later
unless you agree to allow them
to send you those marketing materials.
The statement allowing the sending of marketing materials
must be clearly stated at the time of purchase.
GDPR also gives users the right
to withdraw their consent at any time,
as well as the ability to inspect, amend,
or erase any data the organization holds about them.
This is commonly known as the right to be forgotten.
If you are a resident of the European Union,
you can contact the company that collected your data
and request that all data they have on you be deleted,
and they are legally required to comply.
This law offers strong protections for European citizens.
However, if you're an American, GDPR doesn't apply.
So companies aren't obligated to honor the same rights
unless they choose to.
But you can always request data deletion,
but those companies aren't legally required
to actually delete your data.
So remember, the Children's Online Privacy Protection Act
is a US law that protects the privacy
of children under the age of 13
by requiring websites and online services
to follow strict guidelines
when collecting their personal information.
Brazil's General Data Protection Law applies to any company
that processes data from Brazilian residents,
setting strict rules on how personal data
is collected, stored, and used,
with significant fines for non-compliance.
The California Consumer Privacy Act
gives California residents in the US
control over their personal data,
allowing them to know what data is being collected,
request deletion, and opt out of data sales.
The General Data Protection Regulation is an EU law
that requires informed consent for data collection,
gives users the right to access, amend,
or delete their data,
and is enforced
by data protection authorities across Europe.
These laws and acts protect individuals' privacy
and ensure that companies handle personal data responsibly.