On September 28, 2023, the Cyberspace Administration of China (CAC) published the draft Provisions on Regulating and Promoting Cross-Border Data Transfers (Draft Provisions). If adopted into law in their current form, the...more
On October 30, 2023, the SEC filed a litigated complaint against SolarWinds, a software development company, and Timothy Brown, its chief information security officer (CISO). The SEC alleges that from October 2018, when...more
11/7/2023
/ Compliance ,
Corporate Governance ,
Cyber Attacks ,
Cybersecurity ,
Data Breach ,
Data Privacy ,
Data Protection ,
Data Security ,
Disclosure ,
Enforcement Actions ,
Information Security ,
Information Technology ,
Popular ,
Risk Management ,
Risk Mitigation ,
SolarWinds
On October 30, the U.S. government released its long-awaited, sweeping executive order (the AI EO or Order) on artificial intelligence (AI). The Order directs various U.S. government departments and agencies to evaluate AI...more
11/6/2023
/ Artificial Intelligence ,
Biden Administration ,
Compliance ,
Copyright ,
Corporate Governance ,
Cybersecurity ,
Data Privacy ,
Data Security ,
Executive Orders ,
Healthcare ,
Innovative Technology ,
Intellectual Property Protection ,
Legislative Agendas ,
Life Sciences ,
Machine Learning ,
National Security ,
Popular ,
Regulatory Agenda ,
Regulatory Reform ,
Regulatory Requirements ,
Technology Sector
A recently unsealed case against Pennsylvania State University:
- Serves as yet another example of the increased use of the False Claims Act (FCA) in cybersecurity enforcement.
- Underscores the need for companies...more
On September 20, 2023, the U.S. Department of Homeland Security released a report outlining the varied and sometimes conflicting reporting requirements that private entities face when they are victims of a cyber incident. The...more
10/17/2023
/ CIRC ,
Corporate Governance ,
Cyber Incident Reporting ,
Cybersecurity ,
Department of Homeland Security (DHS) ,
Legislative Agendas ,
Popular ,
Public-Private Entities ,
Regulatory Agenda ,
Reporting Requirements ,
Securities and Exchange Commission (SEC)
In this month’s Privacy & Cybersecurity Update, we examine Delaware’s new comprehensive data privacy law, a joint statement by 12 data protection authorities on data scraping and data protection, a district court ruling on a...more
10/3/2023
/ California Privacy Protection Agency (CPPA) ,
Cybersecurity ,
Data Privacy ,
Data Protection ,
Popular ,
Privacy Laws ,
Risk Assessment ,
Risk Management ,
State and Local Government ,
State Data Privacy Laws ,
State Privacy Laws ,
Web Scraping
In this month’s Privacy & Cybersecurity Update, we analyze the Biden administration’s proposed cybersecurity labeling program for smart devices, NIST’s extensive overhaul of its cybersecurity framework, and data privacy law...more
9/6/2023
/ Biden Administration ,
California ,
California Privacy Rights Act (CPRA) ,
Colorado ,
Compliance ,
Cybersecurity ,
Data Privacy ,
Data Protection ,
Labeling ,
NIST ,
Popular ,
Privacy Laws ,
Smart Devices ,
State Privacy Laws
In this month’s Privacy & Cybersecurity Update, we examine the newly established data privacy framework between the EU and U.S. and new consumer privacy laws in Oregon and Texas. We also review a court ruling that delayed...more
8/2/2023
/ Biometric Information Privacy Act ,
California ,
California Privacy Rights Act (CPRA) ,
Cyber Incident Reporting ,
Cybersecurity ,
Cybersecurity Framework ,
Data Privacy ,
Data Transfers ,
Disclosure ,
EU ,
European Commission ,
European Economic Area (EEA) ,
General Data Protection Regulation (GDPR) ,
NYDFS ,
Oregon ,
Popular ,
Privacy Laws ,
Proposed Amendments ,
Regulatory Requirements ,
Risk Management ,
Texas
On July 26, 2023, the U.S. Securities and Exchange Commission (SEC) voted 3-2 to adopt final rules that are intended to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance and...more
7/28/2023
/ Compliance ,
Corporate Governance ,
Cyber Incident Reporting ,
Cybersecurity ,
Disclosure Requirements ,
New Rules ,
Proposed Rules ,
Publicly-Traded Companies ,
Regulation S-K ,
Reporting Requirements ,
Required Forms ,
Risk Management ,
Securities and Exchange Commission (SEC)
In our June Privacy & Cybersecurity Update, we review new data privacy laws in Colorado, Connecticut, Florida and Montana; Verizon’s annual Data Breach Investigations Report; AM Best’s report on cyber insurance trends; and...more
7/6/2023
/ Biometric Information Privacy Act ,
Consumer Privacy Rights ,
Cyber Insurance ,
Cybersecurity ,
Data Breach ,
Data Collection ,
Data Processors ,
Data Protection ,
Employer Liability Issues ,
Employment Litigation ,
Enforcement ,
Investigations ,
Liability ,
Negligence ,
New Amendments ,
New Legislation ,
New Regulations ,
Opt-Outs ,
Popular ,
Privacy Laws ,
State and Local Government ,
State Privacy Laws ,
Technology Sector ,
Verizon
On June 1, 2023, the U.S. Supreme Court issued its highly anticipated decision in the consolidated cases United States ex rel. Schutte v. SuperValu Inc. and United States ex rel. Proctor v. Safeway, Inc., Nos. 21-1326 &...more
6/12/2023
/ Drug Pricing ,
False Claims Act (FCA) ,
Fraud ,
Healthcare ,
Pharmaceutical Industry ,
Pharmacies ,
Prescription Drugs ,
Reasonable Interpretations ,
Safeco ,
Scienter ,
SCOTUS ,
US ex rel Thomas Proctor v Safeway Inc ,
US ex rel Tracy Schutte et al v SuperValu Inc et al
In this month’s Privacy & Cybersecurity Update, we review new consumer privacy laws in Tennessee and Indiana, three GDPR rulings by the Court of Justice of the European Union, updates regarding future California Privacy...more
6/5/2023
/ California Privacy Protection Agency (CPPA) ,
Cyber Insurance ,
Cybersecurity ,
EU ,
European Court of Justice (ECJ) ,
Fraud ,
General Data Protection Regulation (GDPR) ,
Hackers ,
Insureds ,
Liability ,
Privacy Laws ,
State Privacy Laws ,
Wire Fraud
The rapid adoption of artificial intelligence (AI) technology into corporate environments has left many organizations understandably struggling with how to identify, measure and manage the unique risks of these nascent...more
In this month’s Privacy & Cybersecurity Update, we look at Washington state’s passage of the first-ever state-level health data privacy law and the finalized California Consumer Privacy Act regulations. We also examine a...more
5/2/2023
/ California Consumer Privacy Act (CCPA) ,
California Privacy Rights Act (CPRA) ,
Cybersecurity ,
Data Privacy ,
Data Protection ,
Department of Health and Human Services (HHS) ,
Food and Drug Administration (FDA) ,
Fraudulent Wire Transfers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Healthcare ,
Insurance Industry ,
Medical Devices ,
Notice of Proposed Rulemaking (NOPR) ,
Popular ,
Privacy Laws ,
Reproductive Healthcare Issues ,
State Privacy Laws
In this month’s Privacy & Cybersecurity Update, we examine Iowa’s new data privacy law (the sixth state to enact a privacy law), the Biden administration’s new national cybersecurity strategy, the U.K. government’s revised...more
4/4/2023
/ Amended Regulation ,
Biden Administration ,
Consumer Privacy Rights ,
Critical Infrastructure Sectors ,
Cybersecurity ,
Data Protection ,
National Security ,
Popular ,
Privacy Laws ,
State Privacy Laws ,
UK
In the past year, the Board of Governors of the Federal Reserve System (the Board) Biden administration officials, and other U.S. banking regulators have repeatedly voiced growing concerns about certain cryptoasset...more
2/7/2023
/ Banking Regulators ,
Banking Sector ,
Banks ,
Biden Administration ,
Blockchain ,
Cryptoassets ,
Cryptocurrency ,
FDIC ,
Federal Reserve ,
Financial Institutions ,
Financial Services Industry ,
OCC ,
Risk Assessment
In this month’s Privacy & Cybersecurity Update, we analyze recent fines against Meta and their impact on the future of behavioral advertising, the timeline for the California Privacy Rights Act’s regulations to become...more
2/1/2023
/ Advertising ,
California ,
California Privacy Rights Act (CPRA) ,
Class Action ,
Court of Justice of the European Union (CJEU) ,
Cybersecurity ,
Data Breach ,
FCC ,
Fines ,
Investigations ,
Metaverse ,
Popular ,
Privacy Laws ,
Proposed Amendments ,
Reporting Requirements ,
Settlement Agreements ,
State and Local Government ,
State Privacy Laws ,
UK
On January 3, 2023, the Board of Governors of the Federal Reserve System (Federal Reserve), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) issued a Joint Statement on...more
1/6/2023
/ Banks ,
Cryptoassets ,
Cryptocurrency ,
Enforcement ,
Federal Reserve ,
Financial Services Industry ,
Joint Statements ,
Non-Bank Lenders ,
OCC ,
Regulatory Agenda ,
Risk Factors
In this month’s Privacy & Cybersecurity Update, we examine the European Commission’s draft adequacy decision on the EU-U.S. Data Privacy Framework, as well as guidance from the U.K. Information Commissioner’s Office on...more
1/3/2023
/ Biometric Information Privacy Act ,
Cyber Insurance ,
Cybersecurity ,
Data Breach ,
Data Privacy ,
Data Protection ,
Employee Monitoring ,
EU ,
European Commission ,
International Data Transfers ,
Popular ,
Privacy Laws ,
Risk Assessment ,
UK
In this month’s Privacy & Cybersecurity Update, we examine the California Privacy Protection Agency’s revised draft regulations for the California Privacy Rights Act, the Federal Trade Commission’s settlement with a...more
12/6/2022
/ California Privacy Rights Act (CPRA) ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Privacy ,
Data Protection ,
Direct Marketing ,
Electronic Communications ,
Enforcement ,
Federal Trade Commission (FTC) ,
Notice Requirements ,
Opt-Outs ,
Personally Identifiable Information ,
Popular ,
Proposed Regulation ,
Regulatory Agenda ,
Rulemaking Process ,
UK
In this month’s Privacy & Cybersecurity Update, we examine President Biden’s executive order to implement an EU-U.S. data privacy framework, the European Commission’s draft Cyber Resilience Act, the U.S. Treasury’s request...more
In a recently published memorandum, Deputy Attorney General (DAG) Lisa Monaco announced important updates to the U.S. Department of Justice’s (DOJ’s) approach to investigating and prosecuting corporate crimes. In the...more
In this month’s Privacy & Cybersecurity Update, we review California’s settlement of the first-ever enforcement action under the California Consumer Privacy Act, as well as the state’s new child-focused privacy law and...more
In this month’s Privacy & Cybersecurity Update, we review the FTC’s proposed data privacy and cybersecurity rulemaking and the European Data Protection Board’s draft guidelines on the calculation of GDPR administrative fines....more
9/7/2022
/ Advanced Notice of Proposed Rulemaking (ANPRM) ,
Cybersecurity ,
Data Privacy ,
Data Protection ,
Data Security ,
Federal Trade Commission (FTC) ,
General Data Protection Regulation (GDPR) ,
Gramm-Leach-Blilely Act ,
Popular ,
Public Comment ,
Rulemaking Process
A flurry of legal and enforcement activity has arisen over the last two weeks across a wide range of areas in the Web3 space, including actions by the Securities and Exchange Commission, the Office of Foreign Assets Control,...more
8/25/2022
/ Bitcoin ,
Blockchain ,
CFTC ,
Cryptocurrency ,
Digital Assets ,
Digital Currency ,
Distributed Ledger Technology (DLT) ,
FDIC ,
Federal Trade Commission (FTC) ,
Financial Markets ,
FinTech ,
OCC ,
Office of Foreign Assets Control (OFAC) ,
Popular ,
Regulatory Oversight ,
Securities and Exchange Commission (SEC) ,
Smart Contracts ,
Virtual Currency