Five companies settled with the New York Attorney General over mobile app data security issues at the end of last year. The AG alleged that the companies, Western Union, Priceline, Equifax, Spark Networks, and Credit Sesame,...more
South Carolina now has specific breach and security requirements for insurance companies. The law applies to those licensed under the state’s insurance laws and went into effect January 1. Under the law, companies must tell...more
1/23/2019
/ Cybersecurity ,
Data Breach ,
Data Breach Plans ,
Data Privacy ,
Data Protection ,
Data Security ,
Insurance Industry ,
New Legislation ,
Notice Requirements ,
Risk Management ,
State Data Breach Notification Statutes
Over the course of 2018, the FTC brought several actions against US companies for violations of the Privacy Shield program. The program, which as we have reported on previously gives participating US companies a mechanism to...more
1/15/2019
/ Data Privacy ,
Data Protection ,
Data Security ,
Departments of Commerce ,
Enforcement ,
EU ,
EU-US Privacy Shield ,
Federal Trade Commission (FTC) ,
International Data Transfers ,
Personal Data ,
Personally Identifiable Information ,
Privacy Certification ,
Privacy Policy
Everyone who has been paying attention to privacy news knows that January 1, 2020 is the implementation date of the California Consumer Protection Act, and July 1, 2020 is the current deadline for enforcement to begin. July...more
On January 1, 2019 Vermont’s breach notice law will include obligations specific to data brokers. A “data broker” is defined as a business that “knowingly collects and sells or licenses to third parties the brokered personal...more
12/24/2018
/ Cybersecurity ,
Data Breach ,
Data Brokers ,
Data Collection ,
Data Protection ,
Data Security ,
Disclosure Requirements ,
Encryption ,
Good Faith ,
New Legislation ,
Notice Requirements ,
Opt-Outs ,
Personal Data ,
Personally Identifiable Information ,
Registration Requirement ,
State Data Breach Notification Statutes
In another change to US state breach notice laws in 2019, South Carolina will have new breach notice requirements for insurance companies. The requirements follow the National Association of Insurance Commissioners’ Insurance...more
12/20/2018
/ Cybersecurity ,
Data Breach ,
Data Privacy ,
Data Protection ,
Data Security ,
Incident Response Plans ,
Insurance Industry ,
National Association of Insurance Commissioners ,
New Legislation ,
Notification Requirements ,
Risk Assessment ,
State Data Breach Notification Statutes
The UK Information Commissioner’s Office recently released helpful encryption guidance. Although released to address the GDPR security requirements, this document may be helpful more broadly because of the detail around...more
As we approach 2019, companies will want to keep in mind the changes that are coming to various US states’ breach notice laws. On January 1, 2019 Iowa’s law, which has already been amended twice since it was passed in 2008,...more
12/13/2018
/ Cybersecurity ,
Data Breach ,
Data Privacy ,
Data Protection ,
Data Security ,
Encryption ,
Exemptions ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Notification Requirements ,
State Attorneys General ,
State Data Breach Notification Statutes
The Federal Trade Commission recently issued a cyber guide that, while intended for small businesses, can be of help for all businesses. The purpose of the guide, which includes various modules, is to help smaller businesses...more
11/13/2018
/ Cyber Insurance ,
Cyber Threats ,
Cybersecurity ,
Data Breach ,
Data Privacy ,
Data Protection ,
Data Security ,
Federal Trade Commission (FTC) ,
New Guidance ,
Phishing Scams ,
Popular ,
Risk Mitigation ,
Small Business ,
Vendor Contacts
Effective November 2, 2018, companies that suffer a breach may have certain defenses in Ohio if they have a written cybersecurity program in place. Under this new law, companies can use as an affirmative defense the existence...more
10/30/2018
/ Affirmative Defenses ,
Confidential Information ,
Cyber Threats ,
Cybersecurity ,
Data Breach ,
Data Privacy ,
Data Protection ,
Data Security ,
Gramm-Leach-Blilely Act ,
Health Insurance Portability and Accountability Act (HIPAA) ,
New Legislation ,
NIST ,
Policies and Procedures ,
Popular ,
Safe Harbors ,
Security Controls ,
State Data Breach Notification Statutes
The New Jersey attorney general recently announced its settlement with software company LightYear Dealer Technologies, LLC- doing business as DealerBuilt- over a 2016 data breach. The company provides its clients, car...more
The U.K. data protection authority recently fined a lead generation company £90,000 ($118,000) for a 2017 unsolicited email marketing campaign. The company, Boost Finance Ltd, sent over 4 million emails promoting pre-paid...more
10/26/2018
/ Consent ,
Data Privacy ,
Data Protection ,
Email ,
Enforcement Actions ,
Fines ,
Information Commissioner's Office (ICO) ,
Marketing ,
Opt-Outs ,
Privacy and Electronic Communications Regulation 2003 (PECR). ,
Third-Party ,
UK
The Securities and Exchange Commission recently settled with Voya Financial Advisors, Inc. for alleged violation of Regulation S-ID (otherwise known as the Identity Theft Red Flags Rule) and Regulation S-P (otherwise known as...more
10/23/2018
/ Bad Actors ,
Broker-Dealer ,
Customer Information ,
Cybersecurity ,
Data Breach ,
Data Privacy ,
Data Protection ,
Data Security ,
Enforcement Actions ,
Fines ,
Identity Theft ,
Identity Theft Prevention Program ,
Identity Theft Red Flags Rule ,
Investment Adviser ,
Passwords ,
Personally Identifiable Information ,
Policies and Procedures ,
Regulation S-ID ,
Regulation S-P ,
Safeguards Rule ,
Securities and Exchange Commission (SEC)