Category Archives: Privacy

Live Free or Die Trying—New Hampshire Voters Enshrine Right to Privacy in State’s Constitution

By David Poell on November 19, 2018 Posted in Consumer Privacy

On Election Day 2018, in the State that boasts the official motto of “Live Free or Die,” over 80% of New Hampshire voters overwhelmingly approved an amendment to the State Constitution enshrining an explicit “right to privacy” to New Hampshire residents. Question 2 on New Hampshire ballots asked voters to approve (or reject) the following … Continue Reading

Update on Enforcement of China’s Cybersecurity Law

By Amber Thomson on November 15, 2018 Posted in Chinese Privacy, Consumer Privacy

Companies doing business in China may see an increase in enforcement actions with the enactment of a new cybersecurity regulation and the enforcement powers of the Public Security Bureaus (PSBs) officially codified. The regulation – Provisions on Internet Security Supervision and Inspection by Public Security Organs – is now in effect, more than a year … Continue Reading

Ninth Circuit Opens Door for More Expansive Meaning of ATDS in TCPA Cases

By David Poell on November 14, 2018 Posted in Consumer Privacy, TCPA, Telecommunications Privacy

In the recent case of Marks v. Crunch San Diego, LLC, 904 F.3d 1041 (9th Cir. 2018) the Ninth Circuit broadly interpreted the TCPA’s definition of automatic telephone dialing system (often referred to as ATDS) to include devices with the capacity to dial stored numbers automatically. The device at issue in Marks is called the … Continue Reading

Supermarket Held Vicariously Liable in UK’s First Data Leak Class Action

By Shanna Pearce on November 13, 2018 Posted in Consumer Privacy, Data Security, EU Privacy

UK supermarket chain Morrisons has been held vicariously liable for the acts of a malicious employee in the UK’s first data leak class action. The issue began in 2014, when a disgruntled Morrison’s internal IT auditor posted to a public file-sharing website the payroll data of nearly 100,000 employees (including names, addresses, dates of birth, … Continue Reading

UK Issues Fine for Unsolicited Funeral Marketing Emails

By Alyssa Shauer and Liisa Thomas on October 26, 2018 Posted in Communication Privacy, Email Marketing, EU Privacy

The U.K. data protection authority recently fined a lead generation company £90,000 ($118,000) for a 2017 unsolicited email marketing campaign. The company, Boost Finance Ltd, sent over 4 million emails promoting pre-paid funeral plans under the name findmeafuneralplan.com. In reaching its decision, the ICO (the UK data protection regulator), said that the company violated the … Continue Reading

SEC Issues $1 Million Identity Theft Rule Fine

By Liisa Thomas and Amber Thomson on October 22, 2018 Posted in Privacy, SEC

The Securities and Exchange Commission recently settled with Voya Financial Advisors, Inc. for alleged violation of Regulation S-ID (otherwise known as the Identity Theft Red Flags Rule) and Regulation S-P (otherwise known as the Safeguards Rule). According to the SEC, Voya had failed to implement a written identity theft program as required of broker-dealers and … Continue Reading

France Imposes Fine for Unauthorized Use of Fingerprint Timeclocks

By Shanna Pearce on October 15, 2018 Posted in Biometrics, EU Privacy

French data protection authority CNIL has issued a fine against company Assistance Centre d’Appel related to the use of biometric technology in the workplace. During an audit at the end of 2016, CNIL found that the company was using fingerprint timeclocks to track employee hours without prior authorization from CNIL as required by the French … Continue Reading

California Pioneers IoT Security Legislation

By Liisa Thomas on October 9, 2018 Posted in Consumer Privacy, Data Security, Online Privacy

California’s governor recently signed into law a bill requiring connected device manufacturers to include “reasonable” security features for connected devices sold in California. The law doesn’t go into effect until January 1, 2020, and requires that the devices have security “appropriate to the nature and function of the device” and appropriate to the type of … Continue Reading

Apple Imposes Privacy Policy Requirement for All Apps Operating on its Platform

By Shanna Pearce on September 27, 2018 Posted in Consumer Privacy, Mobile Privacy, Online Privacy

As Apple recently reminded developers, starting on October 3, 2018 it will require all apps being submitted for distribution through its app store, or for testing by its TestFlight service, to have a publicly posted privacy policy. This requirement was incorporated into Apple’s App Store Review Guidelines and will apply to all new apps, as … Continue Reading

UK’s ICO Fines Marketing Company Over Unsolicited Emails

By Liisa Thomas on September 18, 2018 Posted in Europe, Online Privacy

The UK’s data protection authority, the ICO, recently fined marketing firm Everything DM Ltd for sending almost 1.5 million marketing emails without obtaining sufficient consent as required by the UK’s Privacy and Electronic Communications Regulations. In particular, the company sent messages on its clients behalf, the messages appeared to the recipient to come from the … Continue Reading

New York Federal Court Dismisses Nationwide Class Action Arising Out of Alleged Spying by E-Commerce Retailers

By Kari Rollins and David Poell on September 10, 2018 Posted in Data Security, Online Privacy

In a victory for online retailers, a New York federal court recently dismissed three putative class action lawsuits brought on behalf of website visitors whose mouse clicks, keystrokes, and electronic communications were tracked by a third-party marketing company. The cases were filed against three e-commerce retailers—Casper (a mattress manufacturer and retailer), Tyrwhitt (a men’s clothing … Continue Reading

Unixiz Settles COPPA Allegations with NJ AG

By Liisa Thomas on August 27, 2018 Posted in Children's Privacy, COPPA, Data Breach, Data Security, Online Privacy

Unixiz, operator of the i-Dressup site, reached an agreement with the New Jersey Attorney General to settle charges that the company had violated the Children’s Online Privacy Protection Act and the New Jersey’s Consumer Fraud Act. The New Jersey AG claimed that Unixiz violated these statutes by collecting information about children without first getting parental … Continue Reading

FTC Seeks Comment on Fundamental Privacy Enforcement Issues

By Jonathan E. Meyer on August 10, 2018 Posted in Consumer Privacy, FTC, Online Privacy

On August 6, the FTC announced that it is seeking comment on a number of topics that are fundamental to its work, including on privacy. These topics will form the basis of its hearings on “Competition and Consumer Protection in the 21st Century”, which it will hold from September through January 2019, as we recently … Continue Reading

EU and Japan Strike Tentative Data Transfer Deal

By Shanna Pearce and Liisa Thomas on August 9, 2018 Posted in EU Privacy, Privacy Shield

The EU and Japan have reached a “reciprocal adequacy” agreement to allow data to flow more easily between them. As part of a larger bilateral trade deal which included commitments by both parties to reduce tariffs, Japan also agreed to enact additional safeguards to comply with new EU data protection standards. Those additional safeguards include … Continue Reading

DOJ Report Suggests Direction For Addressing Cyber Threats

By Jonathan E. Meyer on August 8, 2018 Posted in Cybersecurity, Data Security, Government Privacy

As many of you have no doubt seen, the Justice Department recently released the report of the Attorney General’s Cyber Digital Task Force, a body the Attorney General had created in February. In the report, the Task Force, chaired by Deputy Attorney General Rod Rosenstein, seeks to answer the question: “How is the Department responding … Continue Reading

The California Privacy Law Is Coming: What Should Your Company Do Now?

By Liisa Thomas, Craig Cardon, Brian Anderson, Rachel Tarko Hudson and Shanna Pearce on July 25, 2018 Posted in Consumer Privacy

As has been widely reported, California’s new privacy regime is set to come into effect on January 1, 2020. The law constitutes an expansion beyond California’s existing privacy laws, in particular California’s existing Shine the Light Law and the California Online Privacy Protection Act. Various provisions of the new law will apply to businesses with … Continue Reading

FTC Pursuing, and Getting More Specific, About Privacy Post-LabMD Finding

By Matthew Turetzky, Jonathan E. Meyer and Liisa Thomas on July 18, 2018 Posted in Consumer Privacy, FTC

The Eleventh Circuit recently issued a long awaited ruling in the LabMD case. In that case, the FTC had gone after a cancer detection facility that suffered a data breach. The agency criticized the company for lax data security and in July 2016 issued a broad order against the company requiring changes to the company’s … Continue Reading

FTC Provides Insight into COPPA Deletion Requirements

By Shanna Pearce on July 12, 2018 Posted in Children's Privacy, Consumer Privacy, FTC, Online Privacy

The Federal Trade Commission recently posted a blog entry reminding companies about the deletion requirements under the Children’s Online Privacy Protection Act. Namely, that companies under the Act must give parents the right to review and delete their children’s information. In addition COPPA also requires companies to delete children’s personal information when the information is … Continue Reading

FTC Outlines Expected Privacy Program Elements in BLU Settlement

By Liisa Thomas on June 22, 2018 Posted in Consumer Privacy, Data Security, FTC, Mobile Privacy

The FTC recently settled with the mobile phone company BLU Products, Inc., over allegations that the company was letting one of its vendors pull extensive and detailed personal information off of users’ phones. According to the FTC, BLU phones were pre-loaded with firmware updating tools made by ADUPS Technology. ADUPS, through its software, was then … Continue Reading

DHS Releases New Cybersecurity Strategy

By Jonathan E. Meyer on May 21, 2018 Posted in Cybersecurity, Privacy Regulation

On May 15, the Department of Homeland Security released its long-awaited Cybersecurity Strategy. The Strategy aims to reduce cybersecurity risk through “an innovative approach that fully leverages our collective capabilities across the Department and the entire cybersecurity community.” It sets a course of cybersecurity policy for the Department for the next five years and signals … Continue Reading

By scrolling this page, clicking a link or continuing to browse our website, you consent to our use of cookies as described in our Cookie and Advertising Policy. If you do not wish to accept cookies from our website, or would like to stop cookies being stored on your device in the future, you can find out more and adjust your preferences here.

Agree