After the recent Court of Justice of the European Union decision on sensitive inferences that can be drawn from the name of your spouse, it is fair to ask: Is everything sensitive data (special category data)?
Katie Hewson of Stephenson Harwood and I were duly skeptical earlier this month at the 7th annual INPLP Annual Conference in Vienna, Austria.
It IS a CJEU decisionThe definition of sensitive information under the new US privacy laws is Article 9 GDPR, plus moreSensitive inferences are a point of focus for the Federal Trade Commission and at issue in the new FTC Kochava caseSensitive inferences take on a new significance in the wake of the Dobbs decisionInferences are personal information and should be included in your response to CA access requests, along with, according to the California Attorney general, a detailed explanation of how the inferences were made (algorithmic transparency)Sensitive inferences are addressed in the draft Colorado CPA rulesThe NAI recently addressed them in a guidance regarding the advertising context.
And as a bonus:
Sensitive inferences could be part of the new CPRA right to limit use of sensitive information, and in the Colorado CPA required opt in.