After what appears to be a period of relative leniency in 2018/19, enforcement actions for violations of the EU General Data Protection Regulation (“GDPR”) have since intensified. In 2020, according to publically available information, supervisory authorities across the EU and the UK Information Commissioner’s Office (“ICO”) have issued over EUR 170 million worth of fines combined[1], with six of the top ten individual fines imposed being issued in 2020[2]. Continue Reading Ready to Pounce: Regulators Are Intensifying GDPR Enforcement

In a decision with potentially far-reaching implications, Alasaad v. Mayorkas, Nos. 20-1077, 20-1081, 2021 WL 521570 (1st Cir. Feb. 9, 2021), the First Circuit recently rejected First and Fourth Amendment challenges to the U.S. government agency policies governing border searches of electronic devices. These policies permit so-called “basic” manual searches of electronic devices without any articulable suspicion, requiring reasonable suspicion only when officers perform “advanced” searches that use external equipment to review, copy, or analyze a device.  The First Circuit held that even these “advanced” searches require neither probable cause nor a warrant, and it split with the Ninth Circuit in holding that searches need not be limited to searches for contraband, but may also be used to search for evidence of contraband or evidence of other illegal activity. This decision implicates several takeaways for company executives entering and leaving the United States, particularly if they or their employers are under active investigation.  In-house counsel in particular should consider the implications of the decision given obligations of lawyers to protect the confidentiality of attorney-client privileged information.

Continue Reading First Circuit Upholds Border Searches of Electronic Devices Without Probable Cause

Recently, the New York Department of Financial Services (“DFS”) issued two memoranda addressing the ongoing increase in cyberattacks.  The first recent guidance provides best practices for insurance entities with regard to cyber insurance.[1]  The second guidance deals with the surge in benefits fraud that has been ongoing since the beginning of the COVID-19 pandemic, with directions on how regulated entities can best secure data.[2] Continue Reading New York Department of Financial Services Issues New Guidance on Cyber Threats

Last month, in Guo Wengui v. Clark Hill, PLC, the United States District Court for the District of Columbia granted Plaintiff’s motion to compel production of Defendant’s third-party forensic investigation report following a cybersecurity incident.[1]  The court held that the forensic report was not covered by the attorney-client privilege or the work product doctrine, providing a cautionary tale for companies conducting post-breach investigations. Continue Reading D.C. District Court Rejects Privilege Claim for Post-Data Breach Forensic Report

On January 12, 2021, the United States District Court for the Central District of California granted Marriott’s motion to dismiss in Arifur Rahman v. Marriott International, Inc. et al[1], a class action filed against the company following its disclosure of a data breach in March 2020.  The court held that Plaintiff lacked standing to sue, breathing life into a defense that has been unsuccessful in several recent cases.

Background

The litigation against Marriott stemmed from its announcement that two employees of a Marriott franchise in Russia accessed personal information of 5.2 million guests.  The company further acknowledged that the compromised information included names, addresses, emails, phone numbers, and other personal details such as birth dates.  In April 2020, Plaintiff Arifur Rahman (“Plaintiff”), on behalf of a class, alleged six causes of action against Marriott International (“Defendant”): (1) negligence; (2) violation of the California Consumer Privacy Act; (3) breach of contract; (4) breach of implied contract; (5) unjust enrichment; and (6) violation of the California Unfair Competition Law. Continue Reading The Central District Court of California Grants Marriott International’s Motion to Dismiss in Data Breach Suit

Cybersecurity and data privacy, topics that were already top of mind for companies at the start of 2020, were pushed even further to the forefront due to the COVID-19 pandemic, significant data security enforcement actions, and the SolarWinds breach discovered in December.

The increased prevalence of remote work made it all the more critical for companies to manage cybersecurity risk. In a recent survey of business and technology executives, 96% of respondents said that they will shift their cybersecurity strategy due to COVID-19 and 50% say that they are more likely to consider cybersecurity in every business decision (up from 25% last year). While cyber and privacy risks were continuing to grow, 2020 also saw new legislation and regulations that increased both the cost and complexity of compliance and the penalties for failing to do so. And, on top of everything, cyber and privacy enforcement and litigation, already at high levels, were more active than ever.

In this Year in Review, we highlight the most significant cybersecurity and privacy developments of 2020 and predict key challenges and areas of focus for the coming year.

The following post was originally included as part of our recently published memorandum “Selected Issues for Boards of Directors in 2021”.

Cybersecurity, a topic that was already top of mind for boards and corporate stakeholders at the start of the year, was pushed even further to the fore in the wake of the COVID-19 pandemic. The increased prevalence of remote working made it all the more critical for companies to manage cybersecurity risk. In a recent survey of business and technology executives, 96% of respondents said that they will shift their cybersecurity strategy due to COVID-19, and 50% say that they will consider cybersecurity in every business decision (up from 25% last year). Boards in turn will take on an increasing role in managing oversight of this high-stakes issue.

To read the full post, please click here.

For a PDF of the full memorandum, please click here.

On January 6, 2021, a bipartisan group of state legislators introduced the “Biometric Privacy Act,” (Assembly Bill 27), which would make New York only the second state with a private right of action against entities that improperly use or retain biometric information.  This is the third time that New York lawmakers have proposed such a bill.

The bill would protect individuals’ biometric identifiers, defined as fingerprints, voiceprints, retina or iris scans, and scans of face or hand geometry, as well as information based on such identifiers used to identify an individual.[1]

Under the bill, private entities in possession of biometric identifiers or information would need to develop and comply with publicly available written policies establishing retention schedules and guidelines for permanently destroying the identifiers or information when the initial purpose for collecting or obtaining them has been satisfied or within three years of the individual’s last interaction with the entity, whichever occurs first.  Private entities would also be required to store, transmit, and protect from disclosure all biometric identifiers and information using the reasonable standard of care in their industry, and in a manner that is the same as or more protective than the manner in which they store, transmit, and protect other confidential and sensitive information. Continue Reading New York Lawmakers Introduce Biometric Privacy Bill with Private Right of Action

The following post was originally included as part of our recently published memorandum “Selected Issues for Boards of Directors in 2021”.

Patchwork and continually changing regulation continues to be the trend in data privacy law, with 2020 adding new legislation to the fray and striking down some existing privacy structures. 2021 will likely be a time of reflection for businesses trying to adjust to impending new requirements in the face of an increasingly remote workforce and customer base.

Boards and management will need to ensure that their businesses not only adjust to the legislation that entered into force in 2020, but are also preparing for the implementation of additional legislation on the horizon. As always, boards and management will need to continue to monitor the evolving privacy compliance landscape to ensure that they are mindful of privacy obligations and attendant risks when implementing their business objectives and oversight going into 2021.

To read the full post, please click here.

For a PDF of the full memorandum, please click here.

In July 2019, the UK Information Commissioner’s Office (“ICO”) issued two notices of intent (“NOIs”) to fine British Airways (“BA”) and Marriott International Inc. (“Marriott”) for violations of the EU General Data Protection Regulation (“GDPR”), both related to high-profile personal data breaches. The NOIs proposed staggering fines of £183.39 million and £99.2 million, respectively, which would have constituted the largest penalties levied under the GDPR to date. More than a year later, the UK ICO finally issued the long-awaited penalty notices in relation to both investigations, imposing in both cases fines that, while still significant, were greatly reduced from what had initially been indicated – £20 million in the case of BA (a massive reduction of more than £163 million), and £18.4 million in the case of Marriott (an equally surprising reduction of more than £79 million). Continue Reading UK ICO Data Breach Fines – What Can We Learn From British Airways and Marriott?