The Florida legislature passed a bill that provides immunity to companies that suffer a data breach. The immunity is conditioned on the company: (1) complying with the notice requirements of Florida’s data breach notification...more
The U.S. Department of Health and Human Services, Office for Civil Rights (OCR) recently announced its first settlement agreement related to a ransomware attack. But it was not the ransomware that triggered OCR’s enforcement...more
Shook lawyers explore some of the hottest privacy issues business owners and in-house counsel need to know to help mitigate exposure. Chief among them, website privacy litigation and pixel class actions. Shook Privacy and...more
Florida will not pass a comprehensive data privacy law for the second year in a row. It will be easy for some to speculate that the bill died because the House insisted on a private right of action. That speculation would be...more
Last week, HB 9 (the leading privacy bill on the House side of the Florida legislature) made its first of two committee stops in the House Commerce Committee. The bill passed unanimously. Just as important, however, the...more
The Florida House of Representatives has introduced its version of a comprehensive privacy law (HB 9 – no fancy acronym, unlike the FPPA in the Senate). This blog post will explain the key differences between the House and...more
This blog post will summarize Senate Bill 1864, released on Friday, which is the first “comprehensive” privacy bill to be released in advance of the 2022 Florida legislative session. This is a long post, so I begin with a...more
The Florida privacy legislation appears to be dead, and the best way to explain it is with the southern adage that “pigs get fat, hogs get slaughtered.” With a strong privacy bill in hand that gave privacy advocates 95% of...more
By a vote of 29-11, the Florida Senate passed its version of HB 969 and sent the bill back to the House for consideration of the rewritten version. At this point, there are only two legislative options remaining: (1) the...more
Within the week, we will know whether Florida will adopt the most aggressive privacy law in the country, something more moderate, or nothing at all. But an issue that has not received enough attention is the reason HB 969 and...more
The Florida House of Representatives has officially passed HB 969, which would create the most aggressive privacy law in the United States. The bill would apply to companies that generate $50 million or more in annual gross...more
The Florida Senate appears poised to hit the brakes on privacy legislation that has thus far soared through committees in both legislative chambers. The House version (HB 969) and the Senate Version (SB 1734) would have not...more
The Florida Senate’s version of a new comprehensive privacy law (a.k.a. the “Florida Privacy Protection Act” (FPPA)) passed unscathed out of the Senate’s Committee on Commerce and Tourism yesterday. The bill’s sponsor fought...more
The California Attorney General has approved some modifications to regulations of the California Consumer Privacy Act (CCPA). The four new changes, which become effective today, are described by the California AG as...more
The Florida Legislature is considering a comprehensive privacy law (HB 969) that would fundamentally change the landscape of how/whether companies do business in Florida. The bill is largely a “cut-and-paste” of the...more
Yesterday, the Governor of Florida threw his support behind a newly introduced consumer data privacy bill (HB 969) which is very similar to the California Consumer Privacy Act of 2018. The Governor’s support is a significant...more
Last week, in a 26-page opinion, the 11th U.S. Circuit Court of Appeals weighed in on two questions crucial to the viability of privacy and data breach litigation in federal court—and perhaps even in general. First, does a...more
2/16/2021
/ Article III ,
Corporate Counsel ,
Credit Cards ,
Cybersecurity ,
Data Breach ,
Data Privacy ,
Data Protection ,
Data Security ,
Point of Sale Terminals ,
Popular ,
Standing
Law Enforcement Finds Credible Evidence of Pre-Election Ransomware Attack-
Late yesterday, U.S. law enforcement authorities began warning of credible information suggesting there will be a widespread Ryuk ransomware attack...more
Beazley Cites Ransomware as the Top Threat for Cyber-Attacks in 2020 -
Insurance provider Beazley has issued a report (free registration required) detailing the landscape of cyber-attacks over the past year. The report...more
3/31/2020
/ Cyber Attacks ,
Cybersecurity ,
Data Privacy ,
Data Security ,
Health Care Providers ,
Information Technology ,
Malware ,
Personally Identifiable Information ,
Ransomware ,
Risk Management ,
Vulnerability Assessments
Shook Weighs in on Updated CCPA Regulations -
In response to extensive public comment, the California Attorney General’s office released modified draft regulations under the CCPA on February 7. Shook has provided initial...more
3/10/2020
/ Biometric Information ,
Board of Directors ,
C-Suite Executives ,
California Consumer Privacy Act (CCPA) ,
Class Action ,
Consumer Privacy Rights ,
Cyber Insurance ,
Cybersecurity ,
Data Breach ,
Data Collection ,
Data Management ,
Data Privacy ,
Data Protection ,
Data Protection Commissioner ,
Data Security ,
EHealth ,
EIOPA ,
EU ,
Federal Trade Commission (FTC) ,
General Data Protection Regulation (GDPR) ,
Health Care Providers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
HIPAA Security Rule ,
International Data Transfers ,
Ireland ,
LabMD ,
New Guidance ,
OCR ,
Opt-Outs ,
Personal Information ,
PHI ,
Popular ,
Privacy Laws ,
Proposed Legislation ,
Right to Delete ,
Third-Party Service Provider ,
Underwriting
California AG Updates CCPA Regulations -
The long wait—two excruciating months from the end of initial public comment—is over. The California Attorney General’s office, in a bid to ruin the weekend for privacy...more
2/12/2020
/ California Consumer Privacy Act (CCPA) ,
Comment Period ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Data Protection ,
Data Security ,
Personal Information ,
Privacy Laws ,
Public Comment ,
Regulatory Agenda ,
Regulatory Requirements ,
Rulemaking Process ,
State Attorneys General
States Consider Privacy and Data Security Legislation -
It’s that time of year again, when we see a flood of legislative activity at the state level on privacy and data security laws. A couple of recent examples are below....more
1/30/2020
/ Class Action ,
Consumer Privacy Rights ,
Cybersecurity ,
Data Breach ,
Data Management ,
Data Privacy ,
Data Protection ,
Data Security ,
Equifax ,
EU-US Privacy Shield ,
Expedia ,
Federal Trade Commission (FTC) ,
General Data Protection Regulation (GDPR) ,
Google ,
Information Commissioner's Office (ICO) ,
Information Governance ,
Legislative Agendas ,
Marriott ,
Motion to Dismiss ,
Online Safety for Children ,
Orbitz ,
Personal Data ,
Privacy and Electronic Communications Regulation 2003 (PECR). ,
Proposed Legislation ,
Regulatory Violations ,
Settlement ,
State and Local Government ,
UK
SDNY Rejects Standing under “Increased Risk” Theory Where Data Not Targeted or Stolen -
The Southern District of New York rejected a settlement that would have resolved a class action based on the unauthorized (and...more
12/18/2019
/ Arbitration ,
Article III ,
Best Practices ,
Brazil ,
Cable Television Providers ,
Class Action ,
Comcast ,
Data Breach ,
Data Security ,
Data Storage ,
Electronic Data Transmissions ,
Electronic Protected Health Information (ePHI) ,
Email ,
Encryption ,
Enforcement Actions ,
EU ,
EU-US Privacy Shield ,
European Commission ,
Federal Trade Commission (FTC) ,
Health Care Providers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
HIPAA Breach ,
Ireland ,
Legislative Agendas ,
Mobile Device Management ,
Mobile Devices ,
Motion to Dismiss ,
New Guidance ,
OCR ,
Personal Data ,
Personally Identifiable Information ,
PHI ,
Proposed Legislation ,
Ransomware ,
Regulatory Agenda ,
Right of Access ,
Risk Management ,
Settlement Agreements ,
Standing
EU Court Allows Class Action to Proceed, Sets Precedent for Future Data Breach Class Actions -
A class action brought against Google will be allowed to move forward after the plaintiff’s appeal was permitted, allowing him to...more
11/20/2019
/ California Consumer Privacy Act (CCPA) ,
Cayman Islands ,
Class Action ,
Comment Period ,
Compliance Management Systems ,
Consent ,
Cookies ,
Court of Justice of the European Union (CJEU) ,
Cybersecurity ,
Data Breach ,
Data Management ,
Data Protection ,
Data Protection Acts ,
Data Security ,
e-Privacy Directive ,
Electronic Protected Health Information (ePHI) ,
EU ,
European Data Protection Board (EDPB) ,
General Data Protection Regulation (GDPR) ,
Google ,
HIPAA Breach ,
Ireland ,
New Guidance ,
New Legislation ,
Notification Requirements ,
OCR ,
Personal Data ,
Popular ,
Regulatory Agenda ,
Regulatory Violations ,
Web Browsers ,
Web Tracking
British Data Protection Authority Flexes GDPR Enforcement Muscles -
No longer is the bark of sanctions for lax data protection practices worse than its bite. The Information Commissioner’s Office (ICO)—the United Kingdom's...more
7/17/2019
/ British Airways ,
Cybersecurity ,
Data Breach ,
Data Security ,
Enforcement Actions ,
General Data Protection Regulation (GDPR) ,
Information Commissioner's Office (ICO) ,
Marriott ,
Personal Data ,
Personally Identifiable Information ,
Popular ,
UK