E-Cig Company Settles Online Behavioral Advertising Inquiry

By Liisa Thomas on March 21, 2019 Posted in Consumer Privacy, Online Privacy

A Dutch e-cigarette company recently settled a self-regulatory inquiry over its online behavioral advertising practices. The Accountability Program (a US self-regulatory group that oversees online and interactive behavioral advertising) found that the company, Fontem, did not provide sufficient methods for individuals to opt out of online behavioral advertising (OBA). The Accountability Program enforces the Digital Advertising Alliance’s online behavioral advertising program. That program requires companies that engage in online behavioral advertising to provide both notice of their OBA practices, and the ability to opt-out. Continue Reading

Happy First Day of Spring! Ohio Insurance Law Effective Today

By Amber Thomson, Liisa Thomas, Elfin Noce and Kari Rollins on March 20, 2019 Posted in Consumer Privacy, Cybersecurity, Data Security

Ohio recently followed South Carolina as the second state to adopt cybersecurity legislation modeled after the NAIC’s Insurance Data Security Model Law. The Ohio law, Senate Bill 273, applies to insurers authorized to do business in Ohio and goes into effect today, March 20, 2019 (the first day of Spring). Companies have, under the law, a year to put the security measures into place. The law, like the NAIC model, requires insurance providers to take several steps to protect personal information, including conducting risk assessments and having a written information security program and incident response plan. Smaller insurers -those with less than 20 employees, less than $5 million in gross annual revenue, and less than $10 million in assets- are exempt from the security program requirements. HIPAA-compliant companies are also exempt from the program requirements. The law impacts how companies select third-party service providers, and requires certification of compliance annually. Continue Reading

US State Breach Law Modifications Begin in 2019 with Massachusetts

By Liisa Thomas on March 11, 2019 Posted in Data Breach, Data Security

Massachusetts’ breach notice law has been amended, requiring companies who suffer a data breach to provide more information to the Attorney General about the incident. The law will go into effect in a month, on April 11, 2019. As most know, already under MA’s breach notice law, companies that suffer a breach that impacted Massachusetts individuals are obligated to tell the MA AG. As part of that notice, they needed to explain the nature of the breach, number of residents impacted, and mitigation steps taken. Now, the MA AG will also need to be told if the company has a written information security program, as well as greater detail about the breach itself. These details include the person responsible for the breach of security, if known, as well as the name and title of the person reporting the breach and relationship to the entity that was breached. A sample copy of the notice sent to consumers also needs to be provided to the MA AG. That sample notice will be posted on the MA AG website within one day of receipt, provided that doing so does not “impede an active investigation” by either the MA AG or other law enforcement agency. The law also provides additional requirements on the AG to post information to its website about breaches. Continue Reading

Sheppard Mullin Podcast Reports on Current Hot Topics in Privacy and Data Security

By Liisa Thomas and Michael Cohen on February 27, 2019 Posted in Consumer Privacy

For multinationals, keeping up with changes in privacy laws and compliance requirements can be very difficult, as they vary widely across borders and within nations. The norms and expectations of privacy regulations even vary across demographics and generations. Continue Reading

New York Department of Financial Services Releases Letter Regarding Third Party Data Sources

By Liisa Thomas on February 21, 2019 Posted in Consumer Privacy

In a recent letter, the New York Department of Financial Services provided guidance for insurers who use third party data to help with their underwriting decisions. The letter was drafted in response to reports that insurers are getting information about potential insureds from many “unconventional” data sources, including those that contain predictive models and algorithms. These sources are used to supplement medical underwriting, and include information that isn’t necessarily related to a person’s medical condition, but might impact an insurer’s decision. While these sources could improve the market, according to NYDFS (e.g., by simplifying and expediting life insurance sales and making pricing more accurate) the sources themselves are not uniformly reliable. NYDFS had two specific concerns about these sources: first, that the algorithms they use may have a negative impact on consumers; and second, that these sources are often used without the consumers’ knowledge. Continue Reading

HIPAA Breach Results in a $4,500,000 Class Action Settlement

By Matthew Shatzkes on February 20, 2019 Posted in Data Breach, Healthcare Privacy

Community Health System, one of the largest health systems in the United States, has agreed to pay $4,500,000 to settle claims made against it arising from a 2014 data breach. The data breach, believed to be caused by malware installed by Chinese hackers on CHS’s computer system, exposed the names, dates of birth, addresses, telephone numbers, and Social Security numbers of approximately 4.5 million patients. Continue Reading

Cyber Concerns Lead to EU Recall of a Connected Kids Devices

By Liisa Thomas, Jonathan E. Meyer and Elfin Noce on February 13, 2019 Posted in Children's Privacy, Consumer Privacy, EU Privacy, Internet of Things

Citing cybersecurity concerns with a children’s smartwatch, the European Commission recently issued a recall of the device. The Safe-KID-One is a smartwatch that gives parents the ability to track and communicate with their children. According to the European Commission, security issues with the device could allow a hacker to access a user’s data, including location history, phone numbers and serial number. Additionally, the hacker could use the watch to “call another number of his choosing, can communicate with the child wearing the device or locate the child through GPS.” This is one of the first recalls of an internet of things device by the European Commission and puts device makers on notice that they should take cybersecurity seriously when designing new devices. Continue Reading

Court Finds Cybersecurity-Related Claims Sufficient in Securities Class Action

By Jonathan E. Meyer and Elfin Noce on February 6, 2019 Posted in Consumer Privacy, Cybersecurity, Data Breach, Data Security, Privacy

In the aftermath of Equifax’s data breach, a federal court recently found that allegations of poor cybersecurity coupled with misleading statements supported a proper cause of action. In its decision, the U.S. District Court for the Northern District of Georgia allowed a securities fraud class action case to continue against Equifax. The lawsuit claims the company issued false or misleading statements regarding the strength and quality of its cybersecurity measures. In their amended complaint, the plaintiffs cite Equifax’s claims of “strong data security and confidentiality standards” and “a highly sophisticated data information network that includes advanced security, protections and redundancies,” when, according to the plaintiffs’ allegations, Equifax’s cybersecurity practices “were grossly deficient and outdated” and “failed to implement even the most basic security measures.” The court found that data security is a core aspect of Equifax’s business and that investors are likely to review representations on data security when making their investment decisions. Continue Reading

Massachusetts Changes Data Breach Notification Requirements

By Sheppard Mullin on January 29, 2019 Posted in Data Breach

The Governor of Massachusetts has just signed into law amendments to the state’s data breach notification law. The amendments will go into effect April 11, 2019. Under the amended law, companies whose breaches involve Social Security numbers must provide free credit monitoring services to affected individuals. The services must last 18 months (42 months if the breached company is a credit reporting agency). Companies can’t require individuals to waive their rights to sue in order to get free credit monitoring and must certify to the state that the services provided comply with the law. Continue Reading

By scrolling this page, clicking a link or continuing to browse our website, you consent to our use of cookies as described in our Cookie and Advertising Policy. If you do not wish to accept cookies from our website, or would like to stop cookies being stored on your device in the future, you can find out more and adjust your preferences here.

Agree