Zoom AI policy backlash, NatWest DSR bomb, healthcare FTC

**Colleen:** Hi, Alysa. How are you doing today? **Alysa:** Hello, I'm good. How are you? **Colleen:** I'm good. It's a pleasure to be here with you, stepping in for JJ today. You and I don't get to speak like this all the time, so nice to be here with you. **Alysa:** Yeah, I was about to say you don't look like JJ, but — so, my name is Colleen for those who haven't met me, from the Ketch team. I work with JJ on the marketing side at Ketch. And so, here to step in for this week's privacy huddle with Alysa as we talk about some exciting topics. **Colleen:** JJ may be traveling, but the privacy news doesn't stop, so we have to keep it — it might be hot and sticky summer in DC and you'd think it would slow down, but no, not in privacy land. You and JJ have been talking a lot about AI lately, but today with the news this week, why don't we come back to healthcare data? On Monday, we saw members of Congress send a letter to the FTC expressing their support of recent actions. Drumbeat on the health info. Can you talk to us about the latest there? **Alysa:** Yeah, sure. So, one, I would say the misnomer is we're not just talking about hospital data, and I think a lot of companies will come at it thinking, I don't deal with healthcare data, when they might be in a wellness space or other types of areas that really do raise — could it be health personal information or wellness personal information that might fall in that bucket? And what we saw Congress do was send a letter to the FTC supporting their rulemaking efforts on the Health Data Breach Notification Rule. That's significant, I think, because some might have criticized the agency for taking a pretty aggressive interpretation of the scope for the health data breach notification rule. And you had at least six members of Congress say, keep at it. This is really important, noting the FTC's enforcement actions against BetterHelp and GoodRx. And so I think that was pretty notable. On the same day that Congress sent this letter over to the FTC, we saw the FTC has a business blog. For those who don't visit it periodically, I highly recommend it because the FTC — it's kind of the answers to the test, right? The FTC posts the kinds of expectations that it has for how companies are addressing certain issues. This was on healthcare privacy and really had done essentially a roundup of all of the privacy enforcements that they have taken and what are the lessons to learn from that, including in respect to digital advertising. And so if you are in this space and you are doing digital advertising, what are the expectations for compliance in addressing that? So, I thought those two documents getting some attention is hopefully a good reminder that the FTC prioritizes this topic. I think a lot of companies were focused on the state laws and maybe some of them don't come online until the next year or the year after that and so there's not a priority to really think through how these new expectations for healthcare data are online now because we have a federal agency — we have two federal agencies actually — really, really prioritizing the space. **Colleen:** Yeah, a great reminder that it's not just hospitals — it's a much broader group of businesses that this applies to. And to your point, shoring up compliance on this really just requires having a handle on that digital advertising presence. At Ketch, we talk a lot about the concept of tag orchestration and making sure that you're collecting consent or opt-in or whatever you need to do when your consumers visit your website before you start firing tags that maybe are collecting the sensitive and personal data. So, I think tag orchestration and management really comes into the conversation here. **Alysa:** Yeah, no, I think that's exactly right. I think what we also find with a lot of companies is not thinking that site visitors — that that suddenly by itself is sensitive personal information, that that's healthcare information. And what we've seen from these cases and some of the discussion is really companies need to even think about what's the purpose of their website. If the purpose of their website is by default a connection and nexus to personal health information, then that homepage visitor is to be treated as personal health information, whether it's covered by HIPAA or not. You know, where HIPAA leaves off, the FTC picks up. So, there are some pretty high expectations there. **Colleen:** Yeah, I love what you said about the FTC blog being the answers to the test. You don't want to miss that read for sure. **Alysa:** Yeah, no, exactly. Well, you know, sometimes the FTC gets criticized because as practitioners we know you learn the insights from their enforcements. Their settlements really give the indications of where they're monitoring the industry — and not everybody. You have your day job, so you're not reading every settlement and press release that comes out from the FTC. And I think the business guide, the guidance there — it takes two minutes to skim through it, but I do think it identifies the major themes to keep in mind. **Colleen:** Do you think there's any significance to Congress sending the letter to them on Monday, urging them to focus on it? Is it just reiteration of them wanting to make sure it's a priority, or any indication they think FTC will lose sight of this as a priority, or is that reading into it too much? **Alysa:** Look, I think it's a political issue after the Supreme Court's decision in Dobbs, and I think you have a lot of both members of Congress as well as just states really wanting to communicate to constituents that they are paying attention to this issue. It's important to them, it's important to consumers, and so supporting the FTC and staying on it. The FTC's chair was in the hot seat in Congress on other issues over the past two weeks. Their budget was arguably diminished more on the competition side, and so I think you just have allies really saying keep at it. What you're doing is important and don't let up. **Colleen:** All right, well let's move into U.S. state privacy updates. We haven't done a roundup in a while on the huddle so let's talk about the flow. We have several in effect now, new ones coming in. Can you talk to us a little bit about the timeline, Alysa, what to think about? **Alysa:** Yeah, sure. So, I'm going to put my practical lens on this. In a lot of companies, we didn't have that many, right? You had a handful, you have three, four, and so you could take potentially a state-by-state approach. And we see that in a lot of the privacy policies. They'll have a broad privacy policy and then maybe extend rights to just those states that have these comprehensive privacy laws in effect. And now what we see is you have six more states added to the list, and they're all across the country. And so, we've got three that come online next year, three that come online in twenty twenty-five, and that's not even to mention — well, what about when state legislatures come back in session, right, in the fall and what new states will be added to the list? So I think it's some important questions on whether, even in the absence of federal legislation, when is the tipping point to have a comprehensive national approach, and identifying where there's some of the outliers on different topics to focus in on, whether you just apply those outlier topics to that particular state. I'll just kind of call out a couple. Oregon, I thought was really interesting. So, Oregon has a requirement in its law, which comes online next year, that when a consumer makes a request, part of the business's obligation is to identify by name all of the third parties to whom it's sold personal information — and that's different. California, we've got this requirement to disclose the categories. And so, think about the efforts now with diligence and identifying all the companies that one might sell or engage with for digital advertising — and that's going to be a new burden. So, I anticipate we're going to be talking about that and thinking through how do you manage that list? How do you have insight into that list to be able to disclose? So, that's one. I think the other one — we started the conversation with health information. I'll maybe conclude it with that. Sensitive personal information is a pretty big topic and I would say by and large, most of these states are going with an opt-in. California was unique that it was opt-out. A few other states are opt-out, but most are opt-in. And so back to thinking about using this information for digital advertising — take that as an example. I think a lot of companies have to give some thought to whether they can verify that they have an opt-in to use that data. And this goes to inferred data too, by a number of these state laws. So, there's some challenges ahead and I anticipate some business practices are gonna go through some rocky, rough waters, so to speak. **Colleen:** That's interesting. Do you still feel like when you think about the scale of kind of common denominators in these laws versus exceptions, are there still more common denominators that apply versus exceptions, or is the scale changing there? **Alysa:** Yeah, no, there's absolutely common denominators. I think those are the easier parts, right? Consumers have rights. They get to ask for copies of their data and they get to ask to delete their data or make a correction request. I think while it seems like it's around the margins, some of those really change business practices where they're distinct because it becomes harder operationally to do something with your data just for one state, right? That most companies — their systems — they do it as a business practice as opposed to here's what I do for Oregon, here's what I do for California. And so that's — it's really just thinking holistically, what's a durable strategy so we're not constantly shifting every six months, every four months. Most businesses cannot move that quickly to meaningfully change practices. **Colleen:** Exactly, makes a lot of sense. And I love the call on sensitive personal information too. I think personally it seems it's not as straightforward as you would hope, and I think we've seen that too in the requests that we've been getting in our series — relating to our series of Practical Privacy workshops — asking some of our attendees what do they want to talk about, and SPI is at the top of the list. They want to deep dive into what does that really mean, right? **Alysa:** And well, so you've got your obvious examples, right? My diagnosis of XYZ. But what about general conditions, right? What about if you're buying a whole bunch of products like toilet paper or various things — on its own, vanilla. But when you add it together, what inferences are companies making that may be in a health space, right, to advertise an antidepressant? Those are the kinds of things that I think these laws in fact are trying to target, and so companies kind of peeling the onion and getting to some of those inner layers with the business teams, the advertising teams, to really understand the audiences and how they are inferring data in that space. **Colleen:** Great. All right. Well, thanks, Alysa. I think that's a good place to stop, but I really appreciate you chatting today, as always. Good to see you.