If passed, licensees must maintain a comprehensive information security program (based on its size and complexity, activities and sensitivity of information to be protected), and… Read More »Legislation: Minnesota Re-Proposes Insurance Data Security Law
Legislation: Montana Proposes Online Privacy Policy Requirements If passed, operators of commercial websites or online services must post a conspicuous privacy policy that details… Read More »Legislation: Montana Proposes Online Privacy Policy Requirements
If passed, licensees must develop, implement, and maintain a risk assessment program that manages cybersecurity events (such as unauthorized access to, or misuse of an… Read More »Legislation: North Dakota Bill Imposes Licensed Insurer Security and Breach Obligations
The video game publisher collected user data for interest-based advertising without providing information required under the Digital Advertising Accountability Program (enhanced notice link, opt out… Read More »Children: Video Game Publisher Lacked Interest-Based Advertising Disclosures
If passed, a mobile application developer or a telecommunications carrier will be prohibited from sharing a customer’s location data collected while their device was physically… Read More »Legislation: New Hampshire Bill Prohibits Sharing of Location Data
The delay in enforcement of the LGPD has rendered sanctions harmless and led to less protection for citizens from data breaches and flagrant collection of… Read More »Legislation: Brazil Bill Seeks to Immediately Implement LGPD Sanctions
National Security Commission on AI Pinpoints Chinese Threat By Debra Kaufman The National Security Commission on Artificial Intelligence identified China as the first to challenge… Read More »National Security Commission on AI Pinpoints Chinese Threat by Debra Kaufman
If passed, LGPD provisions relating to the implementation of administrative sanctions for violations would be postponed from August 1, 2021 to January 1, 2022 in… Read More »Legislation: Brazil Seeks to Delay LGPD Sanctions
If passed, first and third party website operators shall not collect, use, sell, share, exchange, or store data (including cookies) for the purpose of digital… Read More »Legislation: Kentucky Bill Requires Website Operators to Obtain Consent
If passed, first and third party website operators shall not collect, use, sell, share, exchange, or store data (including cookies) for the purpose of digital… Read More »Legislation: Kentucky Bill Requires Website Operators to Obtain Consent
Virginia is about to get a major California-style data privacy law Ars Technica Virginia is poised to follow in California’s footsteps any minute… Read More »Virginia is about to get a major California-style data privacy law
Check out this article from The Hacker News. The Weakest Link in Your Security Posture: Misconfigured SaaS Settings — https://thehackernews.com/2021/02/the-weakest-link-in-your-security.html
Top EU Privacy Regulator Calls for Total Ban on Targeted Ads By Debra Kaufman February 12, 2021 The European Data Protection Supervisor (EDPS) Wojciech Wiewiórowski, the… Read More »Top EU Privacy Regulator Calls for Total Ban on Targeted Ads
White House Names Official to Lead Probe of Expansive Hack By Debra Kaufman February 12, 2021 In December, suspected Russian hackers compromised SolarWinds Corp., a small… Read More »White House Names Official to Lead Probe of Expansive Hack
Financial Information: OCC Fines Former General Counsel $3.5 Million for Reckless Behavior Jurisdiction(s): United States – Federal United States Ranking: Authority RiskGuidance ControlGuidance Industry: Financial Services,… Read More »Financial Information: OCC Fines Former General Counsel $3.5 Million for Reckless Behavior
Streaming service Spotify has notified an unspecified number of its customers of a data breach, responding by resetting passwords on the accounts that were attacked.… Read More »Spotify notifies customers of breach, files under CCPA
California Issues Fourth Set Of Amendments To CCPA Regulations | Fox Rothschild LLP – JDSupra On the first night of Hannukah, the California Department… Read More »California Issues Fourth Set Of Amendments To CCPA Regulations | Fox Rothschild LLP – JDSupra
First CCPA Settlement Reached in Hanna Andersson Case Tuesday, December 15, 2020 CPW readers are already familiar with the California Consumer Privacy Act (“CCPA”) which took effect… Read More »First CCPA Settlement Reached in Hanna Andersson Case
An academic paper notes that, post-Brexit, there will be legal challenges if the EU Commission grants full adequacy for EU-UK data flows (the CJEU’s Schrems II decision… Read More »Adequacy: EU-UK Data Flows Post-Brexit Remain Uncertain
Unredacted, unencrypted customer PII stored on the ecommerce platform was scraped by hackers and offered for sale on the dark web; reasonable steps will be… Read More »Data Breach: Online Retailer to Settle CCPA and UCL Allegations
The debt collector was fined $50,000 after it incorrectly sent its account files to CRAs with incorrect payment details on debts, and it failed to… Read More »Accuracy: CFPB Fines Debt Collector for Unlawful Credit Reporting Agencies
The telecom failed to resolve an individual’s complaint after it charged him another individual’s invoice 5 times (the individual was not a client of the… Read More »Legitimacy: AEPD Spain Fines Telecom EUR 75,000 for Willful GDPR Breach
Qualified entities designated by Member States (after demonstrating that they meet specific criteria) can bring actions for protection of collective consumer interests that were harmed… Read More »Legislation: EU Parliament Approves Class Action Model
An attacker inserted malicious code into the chatbot on the company’s payment page, potentially compromising the financial data (card numbers and CVV numbers) of 1.5… Read More »Hacker: ICO UK Fines Ticket Company £1.25 Million For Data Breach
October 27th 2020 saw the Information Commissioner issue an ‘Enforcement Notice’ against Experian, under DPA18, for its processing of personal data for ‘offline marketing services’. The… Read More »ICO issues enforcement notice against Experian
A social network platform was breached by hackers taking advantage of remote working vulnerabilities (i.e., the hackers exploited employees’ VPN issues by calling and impersonating… Read More »Data Breach: NY Regulator Finds Social Network Lacked Appropriate Security
Supermarkets operating in-store pharmacies failed to properly dispose of electronic devices used to collect the signatures and purchase information of customers (the devices were discarded… Read More »Data Breach: Retailer to Pay NJ AG $235,000 for Improper Disposal by Supermarket Pharmacies
Data Breach: Health Provider to Pay AGs $5 Million Jurisdiction(s): United States – Alaska,Arkansas,Florida,Illinois,Indiana,Iowa,Kentucky,Louisiana,Massachusetts,Michigan,Mississippi,Missouri,Nebraska,Nevada,New Jersey,North Carolina,Ohio,Oregon,Pennsylvania,Rhode Island,South Carolina,Tennessee,Texas,Utah,Vermont,Washington State,West Virginia Ranking: Authority RiskGuidance ControlGuidance Industry: Healthcare… Read More »Data Breach: Health Provider to Pay AGs $5 Million -USA
Data Breach: ICO UK Fines Airline £20 Million for Insufficient Security Jurisdiction(s): European Union Ranking: Authority RiskGuidance ControlGuidance Industry: Transportation | BusinessActivity: Information Security – Organisational… Read More »Data Breach: ICO UK Fines Airline £20 Million for Insufficient Security
Second wave of Covid is top emerging risk IT-Online In its Emerging Risks Monitor Report, Gartner surveyed 119 senior executives across most industries and geographies… Read More »Second wave of Covid is top emerging risk – IT-Online
https://www.law.com/corpcounsel/2020/09/28/legal-departments-should-play-leading-role-in-ccpa-gdpr-data-subject-access-requests/
https://www.law.com/corpcounsel/2020/10/19/microsofts-privacy-chief-calls-for-greater-consumer-data-protection-to-aid-pandemic-recovery/?slreturn=20200919212813
LGPD: MPDFT Brazil Files First Public Civil Action A preliminary injunction is sought against a company that unlawfully sells personal information (i.e., name and contact details)… Read More »LGPD: MPDFT Brazil Files First Public Civil Action
Companies are reacting to the changes in consumer behavior and moving on-line – that bring additional challenges and complexity as it relates to Privacy. Retailers… Read More »COVID -19 has forced retailers into the cloud and on-line – which presents additional privacy and security challenges
After a number of postponements and many discussions about further delay, the Brazilian Lei Geral de Protecção de Dados Pessoais (General Data Protection Law, LGPD)… Read More »Brazilian General Data Protection Law, LGPD enforcement will start in August 2021
The move to Working From Home has increased the reliance on cloud monitoring tools but that is not enough. The hackers are using the same… Read More »Cloud Risk Assessments are critical part of a cyber defense strategy. Good data points form The Hacker News – Cybercriminals Are Using Legit Cloud Monitoring Tools As Backdoor
The passage of this bill likely brings some welcomed relief to companies subject to CCPA, as the existing exemptions were set to expire at the… Read More »CCPA Bill Extending Exemptions Passes Through California Legislature
Interesting development around blockchain privacy https://cointelegraph.com/news/secret-contracts-may-soon-bring-privacy-features-to-public-blockchains #privacy #blockchain #emergingrisk #data
The impact of CCPA is being recognized around the world as people look to do business with California https://securitybrief.co.nz/story/california-s-ccpa-now-enforced-worldwide #cybersecurity #data #ccpa #privacy… Read More »California’s CCPA now enforced worldwide – How New Zealand is looking at CCPA
…Consumer-facing brands in the U.S. are contending with a growing array of consumer privacy laws. There has been no creation of a federal standard for… Read More »What’s The Impact Of Data Privacy Regulation On Loyalty Marketing?
The impact and reach of CCPA continues to gain attention both nationally and globally https://www.politico.com/states/california/story/2020/08/31/andrew-yang-takes-lead-role-in-california-data-privacy-campaign-1314061 #ccpa #data #cybesecurity #emergingrisk
Great article on CCPA California Consumer Privacy Act (CCPA) has put restrictions and conditions on how organizations can store, process, and share consumer data in… Read More »CCPA for Marketers: What You Really Need to Know
https://www.networkadvertising.org/sites/default/files/final_response_to_texas_privacy_council_survey_8.21.2020.pdf “The Texas Privacy Council should be mindful of unintended side effects of a legislative approach that places unreasonable restrictions on digital advertising and… Read More »Opt-In: Advertising Industry Urges Texas to Reject Restricted Privacy Approach
Effective July 30, 2020, each request by an OSHA representative to examine or copy employee medical records must be made pursuant to a medical access order,… Read More »Legislation: New OSHA Rule Focuses on Employee Privacy
Where an employee tests positive, HR, Employee Relations or a supervisor should collect from the employee relevant information about their test results (e.g., date of… Read More »COVID-19: South Carolina Department of Health Best Practices for Businesses – Privacy Concerns
The Connecticut Insurance Data Security Law goes into effect on October 1, 2020. Licensed insurance companies, and any other companies otherwise authorized to operate… Read More »The Connecticut Insurance Data Security Law goes into effect on October 1, 2020.
A criminal complaint alleges the former CSO of a ride-sharing platform obstructed justice and deliberately concealed breach details; he allegedly paid hackers (who downloaded 57… Read More »Criminal Sanctions: DoJ Alleges Breach Concealment by CSO
The US Department of Commerce and EU Commission have started talks to evaluate the potential for a strengthened EU-US Privacy Shield that complies with the… Read More »Potential for a strengthened EU-US Privacy Shield
Continuing our updates on Privacy Risk and Readiness Management Despite the massive impacts of the pandemic on the world around us, the pace of… Read More »New York Department of Financial Services announced cybersecurity charges against First American Title Insurance Company.
Final regulations that guide businesses and consumers under California’s new digital privacy law went into effect recently, marking a significant step towards giving Americans the… Read More »Final Regulation For Landmark California Digital Privacy Law
How COVID-19 Will Globally Alter Our Relationship with Data https://www.advertisingweek360.com/how-covid-19-will-globally-alter-our-relationship-with-data/ #emergingrisk #CCPA #GDPR #ADWEEK
If passed, Lawful Access to Encrypted Data Act (“Act”) is introduced in the United States Senate – if passed, the Act will take effect 1… Read More »Legislation: US Bill Requires Mandatory Encryption Backdoors
