Virginia has taken a step closer to becoming the second state (after Colorado) to enact comprehensive legislation addressing discrimination stemming from the use of artificial intelligence (AI), with the states taking...more
An online retailer was recently hit with the first class action under Washington’s consumer health data privacy law alleging that it used advertising software attached to certain third-party mobile phone apps to unlawfully...more
2/21/2025
/ Class Action ,
Consumer Privacy Rights ,
Consumer Protection Laws ,
Data Collection ,
Data Privacy ,
Internet Retailers ,
Location Data ,
Mobile Apps ,
Personal Data ,
PHI ,
Privacy Laws ,
State Privacy Laws ,
Third-Party Service Provider
The U.S. Department of Homeland Security (DHS) recently published new security requirements for certain restricted transactions covered by the U.S. Department of Justice’s (DOJ) sensitive data export rules. ...more
2/4/2025
/ Biden Administration ,
China ,
Corporate Counsel ,
Cybersecurity ,
Cybersecurity Information Sharing Act (CISA) ,
Data Privacy ,
Data Protection ,
Department of Homeland Security (DHS) ,
Department of Justice (DOJ) ,
Executive Orders ,
National Security ,
Restricted Transactions ,
Russia ,
Security and Privacy Controls
On December 24, 2024, New York Governor Kathy Hochul signed into law amendments to New York’s private-sector data breach notification law (General Business Law § 899-aa) and government agency data breach notification law (New...more
1/15/2025
/ Amended Legislation ,
Compliance ,
Corporate Counsel ,
Cybersecurity ,
Data Breach ,
Data Protection ,
Data Security ,
Notification Requirements ,
NYDFS ,
Personal Data ,
Private Sector ,
Sensitive Personal Information ,
State Privacy Laws
The U.S. Department of Health and Human Services (HHS) recently released a proposed rule to better protect electronic health data from cybersecurity threats. The proposed rule would apply to health plans, healthcare...more
The Consumer Financial Protection Bureau (CFPB) recently issued guidance that takes an aggressive position regarding the scope of the Fair Credit Reporting Act (FCRA) as covering certain employee monitoring and assessment...more
11/6/2024
/ Algorithms ,
Artificial Intelligence ,
Consumer Financial Protection Bureau (CFPB) ,
Consumer Reporting Agencies ,
Data Collection ,
Employee Monitoring ,
Fair Credit Reporting Act (FCRA) ,
New Guidance ,
Risk Management ,
Screening Procedures ,
Third-Party Service Provider
Signed into law at the beginning of 2024, colloquially known as the New Jersey Data Protection Act (NJDPA), N.J. Stat. § 56:8-166.4 et seq. will go into effect on January 15, 2025, as New Jersey joins eighteen other states...more
In an era when artificial intelligence (AI) is rapidly transforming the workplace, Illinois has joined the growing list of states taking legislative action to further regulate the use of AI in employment settings, which...more
These lawsuits make generalized allegations that business websites use software or tools to collect various types of device and browsing information from website visitors and that businesses then share such information with...more
8/23/2024
/ Analytics ,
CIPA ,
Consumer Privacy Rights ,
Cookies ,
Cybersecurity ,
Data Collection ,
Data Privacy ,
Data-Sharing ,
Penal Code ,
Retail Tracking ,
Social Media ,
State Data Privacy Laws ,
Web Tracking ,
Websites
The Federal Trade Commission (FTC) has a long-standing habit of creating legal obligations through blog posts. Recent communications from the FTC by way of its Office of Technology Blog evidence an aggressive expectation...more
8/19/2024
/ Anonymization ,
Corporate Counsel ,
Court of Justice of the European Union (CJEU) ,
Data Protection ,
De-Identification ,
Federal Trade Commission (FTC) ,
General Data Protection Regulation (GDPR) ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Personal Data ,
Safe Harbors ,
Subject Matter Experts (SMEs)
Twelve new state comprehensive data privacy laws are set to go into effect over the next two years as the United States continues to catch up to foreign jurisdictions like the European Economic Area (EEA), making a total of...more
On April 29, 2024, the U.S. Department of Labor’s (DOL) Wage and Hour Division (WHD) published new guidance clarifying employers’ obligations under federal labor laws as they pertain to use of automated systems and artificial...more
California Attorney General Rob Bonta has been actively enforcing the California Consumer Privacy Act (CCPA) since July 2023, when he announced an “investigative sweep” through inquiry letters sent to large California...more
3/5/2024
/ Administrative Fines ,
California Consumer Privacy Act (CCPA) ,
California Privacy Rights Act (CPRA) ,
Disclosure Requirements ,
Enforcement Actions ,
Enforcement Priorities ,
Joint and Several Liability ,
Personal Information ,
Regulatory Agencies ,
Regulatory Authority ,
Security and Privacy Controls ,
State Attorneys General ,
Statutory Violations
California has a long history of protecting privacy rights. Article I, Section 1, of the California Constitution expressly provides a right of privacy. Recently, the focus has been on compliance with the California Consumer...more
2/29/2024
/ Business & Professions Code ,
California Consumer Privacy Act (CCPA) ,
California Privacy Rights Act (CPRA) ,
CalOPPA ,
Compliance ,
Consumer Privacy Rights ,
Disclosure Requirements ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Invasion of Privacy ,
Minors ,
Personal Information ,
PHI ,
Privacy Laws ,
Security and Privacy Controls ,
Sensitive Personal Information ,
SOPIPA ,
State Constitutions ,
State Privacy Laws ,
Statutory Violations ,
Student Privacy ,
Unfair Competition Law (UCL) ,
Website Design ,
Websites
On February 14, 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the National Institute of Standards and Technology (NIST) published a new, final version of their guidance for...more
2/26/2024
/ Biden Administration ,
Cybersecurity ,
Department of Health and Human Services (HHS) ,
Electronic Protected Health Information (ePHI) ,
Final Guidance ,
Health Care Providers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
HIPAA Security Rule ,
NIST ,
OCR ,
Popular ,
Risk Assessment ,
Risk Management
In a significant ruling on February 9, 2024, the California Court of Appeal reversed a trial court judgment that had stayed enforcement of California Consumer Privacy Act (CCPA) regulations. This decision will make certain...more
The U.S. Department of Health and Human Services (HHS) has announced a plan to provide resources and incentives for the healthcare industry to adopt cybersecurity measures and to increase potential regulatory penalties for...more
On November 27, 2023, the California Privacy Protection Agency (CPPA) unveiled draft automated decisionmaking technology (ADMT) regulations that would set forth new consumer protections related to the profiling of consumers...more
11/30/2023
/ Artificial Intelligence ,
Automated Decision Systems (ADS) ,
California Consumer Privacy Act (CCPA) ,
California Privacy Protection Agency (CPPA) ,
Data Profiling ,
Employer Responsibilities ,
Notice Requirements ,
Opt-In ,
Opt-Outs ,
Personal Information ,
Proposed Regulation ,
Public Comment ,
Regulatory Authority ,
Right-To-Access ,
Risk Assessment ,
Tracking Systems
On July 26, 2023, the U.S. Securities and Exchange Commission (SEC) finalized new rules that mandate public companies to disclose material cybersecurity incidents and provide annual updates on their cybersecurity risk...more
On July 14, 2023, the California attorney general (AG) announced a surprising “investigative sweep” into employer compliance with the California Consumer Privacy Act of 2018 (CCPA) and its implementing regulations, sending a...more
In an unexpected turn of events, a California court postponed enforcement of the new California Consumer Privacy Act (CCPA) regulations until March 29, 2024. The court’s final decision came at the eleventh hour on June 30,...more