South Carolina’s Insurance Breach Notice Requirements Now In Effect

By Liisa Thomas and Shanna Pearce on January 22, 2019 Posted in Data Breach, Data Security

South Carolina now has specific breach and security requirements for insurance companies. The law applies to those licensed under the state’s insurance laws and went into effect January 1. Under the law, companies must tell the insurance regulator within 72 hours of determining that a breach occurred. Other breach requirements include conducting investigations and keeping records of incidents for at least five years. This new notice requirement does not exempt companies from South Carolina’s general breach notice law, which requires notice to impacted individuals. Continue Reading

No Federal Court Standing for BIPA Violation Without Injury

By Shanna Pearce on January 16, 2019 Posted in Biometrics, Employee Privacy

A lawsuit against US Cold Storage under the Biometric Information Privacy Act was recently dismissed because, the court held, the violations of the law were merely technical. As a result, the plaintiff did not have sufficient standing. This decision echoes the other cases we have reported on recently. Continue Reading

CBPR System Grows with Entry of Australia and Chinese Taipei

By Liisa Thomas and Amber Thomson on January 15, 2019 Posted in Cross-Border Data Transfers, International Privacy, Privacy

2018 saw two new members of APEC’s Cross Border Privacy Rules (CBPR) system: Australia and Chinese Taipei. They join the US, Mexico, Canada, Japan, South Korea and Singapore. As we have reported on previously, the CBPR system is meant to help companies transfer information between participating countries. In the coming months, Australia’s Attorney General plans to work with businesses to implement the system. The Chinese Development Council also plans to work with China’s ministries and departments to boost discussions about privacy protection with other countries. The system has often been compared to other cross-border schemes, including the Privacy Shield (see our update to that program). Companies join by completing self-assessments and participating with an “accountability agent” (in the US, there is only one approved accountability agent). Continue Reading

A Look Back at 2018 Privacy Shield Enforcement

By Liisa Thomas on January 14, 2019 Posted in EU Privacy, FTC, Privacy Shield

Over the course of 2018, the FTC brought several actions against US companies for violations of the Privacy Shield program. The program, which as we have reported on previously gives participating US companies a mechanism to receive personal information from EU entities. The program is reviewed annually by the EU to determine if, from an EU perspective, it continues to provide “adequate levels of privacy protection.” In December the EU concluded in its report (and accompanying working document) that the program continues to provide sufficient protection levels. The EU commission noted in reaching its conclusion that the Department of Commerce has increased its scrutiny of privacy policies (looking to see if companies are posting correct complaint forms), and pursuing companies who were mentioning their adherence to the program before the certification had been finalized by the Department of Commerce. Continue Reading

California AG Holding Series of CCPA Public Forums

By Liisa Thomas on January 10, 2019 Posted in CCPA, Consumer Privacy

In support of the California AG’s work towards drafting regulations under the California Consumer Privacy Act, a series of public forums are being held throughout California. The AG has invited the public to participate and provide comments either at, before or after the events, the first of which was held this week (January 8, in San Francisco). The next events are to be held January 14 (San Diego), January 24 (Riverside), January 25 (Los Angeles), February 5 (Sacramento), and February 13 (Fresno). As a reminder, as we have reported on in the past, the AG has until July 1, 2020 to adopt regulations. Continue Reading

Pass It On: Locks Don’t Prevent Leaks

By Jonathan E. Meyer on January 9, 2019 Posted in Data Security

It is common for individuals to see the “padlock icon” on their browser bar when visiting a website, and assume they are safe. Sadly, this assumption is no longer valid. As we approach Data Privacy Day (January 28, 2019) many companies are taking extra steps to train employees about steps they can take to protect themselves – and their organizations. Here’s one to pass along to the team. Continue Reading

2019 is the Year of . . . CCPA?

By Liisa Thomas, Craig Cardon, Brian Anderson, Rachel Tarko Hudson and Snehal Desai on January 8, 2019 Posted in California Privacy, CCPA, Consumer Privacy

Everyone who has been paying attention to privacy news knows that January 1, 2020 is the implementation date of the California Consumer Protection Act, and July 1, 2020 is the current deadline for enforcement to begin. July 2020 is also the current deadline for the California AG to implement regulations under CCPA. Read more about the law in our blog post from last year. What should companies do over the coming months to get ready for what looks like a sweeping new set of requirements? Two big ones: keep a 12 month look-back of data processing activities and take stock of what you collect and how you use it. Over the coming months you will also want to look at how you might handle rights requests, and take the CCPA into account for your 2019 and 2020 budgeting. This graphic can help you communicate the importance of CCPA to internal stakeholders. Continue Reading

When the U.S. Government Declares Companies Cyber-Insecure, We Should All Pay Attention

By Jonathan E. Meyer, Townsend Bourne and Bryce Chadwick on January 7, 2019 Posted in Cybersecurity, Data Protection, Data Security

The U.S. Government is increasingly taking the initiative to alert companies to the cybersecurity risks of certain foreign corporations. Whether by issuing binding directives on agencies, passing laws or promulgating regulations that include prohibitions on the use of these companies’ products – including by government contractors, the Government is becoming less reluctant to interfere in the private market in favor of warning American companies of the cybersecurity dangers out there. Continue Reading

US Breach Laws Are Coming: Vermont

By Liisa Thomas and Shanna Pearce on December 21, 2018 Posted in Data Breach, Data Security

On January 1, 2019 Vermont’s breach notice law will include obligations specific to data brokers. A “data broker” is defined as a business that “knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.” Under the law, data brokers must keep a record of “data broker breaches” and annually tell this information to the state. Brokers will need to provide this as part of a new annual registration process. The registration also requires data brokers to explain how they let individuals opt-out of having information collected, stored or sold. Finally, data brokers also have to develop and maintain a comprehensive information security program. Continue Reading

Company’s Vendor Suffers Breach, No Business Associate Agreement, $500K OCR Settlement

By Matthew Shatzkes on December 20, 2018 Posted in Data Breach, Healthcare Privacy

A Florida staffing agency which provides physicians to hospitals and nursing homes, has agreed to a $500,000 settlement with the U.S. Department of Health and Human Services, Office for Civil Rights. The settlement comes after an investigation revealed that the company, Advanced Care Hospitalists, disclosed the protected health information of 9,255 people to a third-party billing company without having a business associate agreement in place. Specifically, patient names, date of births and social security numbers were provided to the billing company. The settlement followed a data breach at the billing company. Namely, the PHI was exposed on the billing company’s website. Continue Reading

By scrolling this page, clicking a link or continuing to browse our website, you consent to our use of cookies as described in our Cookie and Advertising Policy. If you do not wish to accept cookies from our website, or would like to stop cookies being stored on your device in the future, you can find out more and adjust your preferences here.

Agree