Photo of James Fazio

James Fazio

Subscribe to James Fazio's Posts

James Fazio is special counsel in the Intellectual Property Practice Group in the firm's San Diego (Del Mar) office.

Contact: Read more about James Fazio

The Dutch Data Protection Authority recently imposed a €475,000 fine ($558,000) against the hotel website Booking.com for waiting longer than 72 hours to report a data breach. According to the Dutch DPA press release, Booking.com learned of the breach on January 13, 2019 and reported it to the DPA on February 7, 2019. The DPA did not make it clear in that release whether Booking.com had, in fact, determined on January 13, 2019 that a security breach impacting personal information of Dutch citizens had occurred or whether January 13, 2019 was date that Booking.com was first alerted to suspicious activity.
…
Continue Reading Booking.com Fined By Dutch DPA For Breach Notice Delay

The new acting FTC chair, Rebecca Kelly Slaughter, recently signaled that the FTC may increase enforcement and penalties in the privacy and data security realm. Slaughter pointed to several areas of focus for the FTC this year, which companies will want to keep in mind:…
Continue Reading What Is FTC’s Course Under Biden?

Many states require insurance providers that do business in their states to complete annual certifications of compliance.  As examples, the deadline in New Hampshire is coming up on March 1.  The deadline in Alabama, Connecticut, Delaware, Louisiana, Michigan, Mississippi, Ohio, and South Carolina was February 15.  (The deadline under new laws in Michigan and Virginia will be February 15 as well, starting in 2022 and 2023, respectively.)  The deadline in New York is April 15. …
Continue Reading Insurance Cybersecurity Certifications: A State Roundup

A class action lawsuit filed against PayPal in connection with a breach it suffered in 2017 was dismissed recently because the plaintiffs did not adequately allege PayPal’s intent to deceive investors.  The litigation began after PayPal’s acquired TIO Networks Corporation, a smaller payment processor and platform.  Post-acquisition, PayPal announced that it had discovered “security vulnerabilities” in TIO’s operations and it thus suspended TIO’s operations.  At that point, TIO had not yet been integrated into PayPal’s platform.  PayPal confirmed that it was investigating TIO’s security measures with the help of outside assistance, and that PayPal customers’ data remained secure.  PayPal further confirmed that it was not aware of any breach of personal information maintained by TIO.  The following month, however, PayPal announced that a breach of personal information had in fact occurred.  Confidential information belonging to 1.6 million customers had been potentially compromised, causing PayPal’s stock price to drop by 5.75%. …
Continue Reading Successful Dismissal of PayPal Class Action Over Breach Disclosures Serves as Risks Reminder

The operator of CafePress, an online retailer that sells customizable mugs and other products, has reached an agreement with New York State Attorney General Letitia James and six other State Attorneys Generals to settle claims related to a 2019 data breach.  The breach stemmed from a cyberattack that the company suffered in early 2019. Upon learning of the attack, the company engaged a third-party investigation firm that identified a vulnerability in the company’s Structured Language Query (SQL) protocols. As a result, CafePress looked at its database and two weeks of logs but did not find evidence of any data breach.  Regardless, CafePress released a security patch to fix the vulnerability and automatically reset the passwords of all customer accounts, requiring all users to reset their passwords upon logging in.
Continue Reading New York and Others Settle with CafePress Over 2019 Data Breach