California Consumer Protection Act

Privacy Groups Urge California Lawmakers Not to Weaken California Consumer Privacy Act

• A variety of privacy groups, including the Electronic Frontier Foundation, the Digital Privacy Alliance and the Center for Digital Democracy, sent a letter to California lawmakers asking them not to “push[] California backward” when it comes to privacy rights and to continue amending the California Consumer Privacy Act (the CCPA) for the better.

• Touting California’s lead on consumer protection, the privacy groups suggested a variety of improvements to the CCPA, including defining and reining in data misuse and abuse, ensuring appropriate security protections for personal information, and providing meaningful redress to individuals, including by expanding the CCPA’s private right of action.

State AGs

New York Attorney General Reaches Largest COPPA Settlement

• The New York Attorney General’s office announced a $4.95M deal with Oath Inc., the successor to AOL Inc., for alleged violations of the Children’s Online Privacy Protection Act.
• According to the AG’s office, AOL conducted billions of online auctions for ad space on websites that Oath knew were directed at children under 13, in the process collecting, using and disclosing personal information from the websites’ users.
• In addition to the penalties, the company also agreed to adopt comprehensive reforms to protect children from improper online tracking.

AGs File First Ever Multistate Suit Under HIPAA in Indiana

• Attorneys General from a dozen states, including Arizona, Indiana, North Carolina and Wisconsin, joined forces to file suit against a medical software provider in the first ever multistate data breach suit alleging violations of the Health Insurance Portability and Accountability Act.
• The suit alleges that Medical Informatics Engineering Inc. and a subsidiary did not implement basic industry-standard security measures to protect electronic personal health information, leading to a 2015 data breach that exposed the sensitive personal information of almost 4 million people. This information included names, telephone numbers, mailing addresses, usernames, hashed passwords, security questions and answers, spousal information, email addresses, dates of birth, Social Security numbers, lab results, health insurance policy information, diagnoses and medical conditions.
• According to the complaint, the companies represented that they maintain appropriate safeguards to protect patients’ personal information, but in actuality, they “did not have appropriate security safeguards or controls in place to prevent exploitation of vulnerabilities within their system.”