On Wednesday, March 11, 2020, the California Attorney General released a second set of modifications (the “March Revisions”) to the proposed regulations implementing the California Consumer Privacy Act of 2018 (the “CCPA”), including substantive changes to both the initial draft regulations issued in October (the “Initial Regulations”) and the revisions published Friday, February 7, 2020 (as supplemented on Monday, February 10, 2020, the “February Revisions”).

(We previously analyzed the CCPA here, the legislative amendments here, the Initial Regulations here, and the February Revisions here.)  While the March Revisions address several of the issues raised by stakeholders commenting upon the February Revisions, there are many issues that remain unaddressed.  Another round of modifications to the regulations may be issued following the conclusion of the public comment period on March 27, 2020.

This alert memorandum highlights certain notable changes to the proposed regulations, particularly with respect to service providers, requirements for privacy policies and other notices to consumers, and the processing of CCPA consumer rights requests.

Please click here to read the full alert memorandum.

Efforts to contain COVID-19 have resulted in many employees working remotely for potentially an extended period of time.  While such precautions are in place, it is important to stay vigilant of cybersecurity risks.  There are already reports of COVID-19 related phishing scams and a recent hack of the U.S. Health and Human Services Department amid its pandemic response.  Remote working can exacerbate these risks.  Below is a checklist of key issues to keep in mind on this subject: Continue Reading Managing Cyber Risk During COVID-19 Response

On February 19, 2020 the European Data Protection Board (“EDPB”) published its second statement on privacy in the context of corporate transactions.

The statement, the full text of which can be read here, highlights the existence of concerns related to the combination and accumulation of sensitive personal data and the possibility that such combinations could result in a high level of risk to the fundamental rights to privacy and  the protection of personal data. Continue Reading EDPB Publishes Statement on Privacy Implications of M&A Transactions

On Friday, February 7, 2020, the California Attorney General released an amended set of proposed regulations (supplemented on February 10, 2020) implementing the California Consumer Privacy Act of 2018 (the “CCPA”), including substantial changes to the draft regulations issued in October.  While the revised regulations eliminate certain requirements that businesses found to be onerous and provide clarification on several points of lingering ambiguity, they also impose additional new compliance obligations and still fail to address certain thorny issues.  Comments on the proposed regulations are due February 25, 2020.

This alert memorandum highlights certain notable changes that may affect the mechanisms and procedures businesses must implement in order to be in compliance with the CCPA, particularly  with respect to public privacy policies, other notices to consumers, receipt and processing of CCPA consumer rights requests and avoiding discriminatory practices.

Please click here to read the full alert memorandum.

On January 27, 2020, the U.S. Securities and Exchange Commission (“SEC”) Office of Compliance Inspections and Examinations (“OCIE”) issued examination observations related to cybersecurity and operational resiliency practices (“Examination Observations”). The observations highlight a set of best practices by market participants in the following areas:  (1) governance and risk management, (2) access rights and controls, (3) data loss prevention, (4) mobile security, (5) incident response and resiliency, (6) vendor management and (7) training and awareness.  Cybersecurity has been a key priority for OCIE since 2012.  Since then, it has published eight cybersecurity-related risk alerts, including an April 2019 alert addressing mobile security. OCIE has perennially included cybersecurity practices as part of its examination priorities (“Examination Priorities”) and listed all but mobile security as “particular focus areas” in the “information security” priority for 2020Continue Reading OCIE Cybersecurity and Resiliency Observations and Best Practices

In 2019, boards and senior management across a range of industries continued to cite cybersecurity as one of the most significant risks facing their companies.

At the same time, comprehensive data privacy regulation became a new reality in the United States as many companies implemented major revisions to their privacy policies and data systems to achieve compliance with California’s groundbreaking privacy legislation. New York also imposed for the first time affirmative cybersecurity obligations on companies, which go into effect in March 2020. European regulators announced several notable enforcement actions under the GDPR which confirmed that European authorities are willing to use the GDPR’s authorization to levy large fines, even outside the context of major breaches resulting in exposure of customer information.

In this 2019 Year in Review, we highlight the most significant cybersecurity and privacy developments of 2019 and predict key challenges and areas of focus for the coming year.

Please click here to read the full alert memorandum.

The UK Information Commissioner’s Office (“ICO”) issued its first penalty notice under the GDPR in December 2019.  Despite publishing notices of its intention to fine Marriott and British Airways in July 2019, the ICO has not yet taken its final enforcement action in these cases (and it is understood that the ICO has granted an extension for representations by the companies, until March 2020).  The £275,000 fine levied on Doorstep Dispensaree, a pharmaceutical company that provides various prescription medicines to care homes in the UK, therefore provides the first insight into the ICO’s approach to administrative fines under the GDPR (as further described below). Continue Reading UK ICO Finally Issues GDPR Fine

The European Commission (the “EC”) has published (see link here) slides from its Task Force for Relations with the United Kingdom regarding the future relationship with the UK, in connection with personal data protection. The slides discuss a possible “adequacy” decision for the UK’s data protection regime, to be delivered by the EC by the end of the “transition period” which, under the draft Agreement on the Withdrawal of the UK from the EU (the “Withdrawal Agreement”), is currently envisaged to be December 31, 2020.

The slides were used for internal “preparatory discussions” and were presented on January 10, 2020 to the European Council’s Ad hoc Working Party on Article 50. The slides are not binding and are stated as being for “presentational and information purposes only”. Continue Reading European Commission Provides Further Hints at Post-Brexit Adequacy Decision for the UK

The following post was originally included as part of our recently published memorandum “Selected Issues for Boards of Directors in 2020”.

According to a 2019 survey, Chief Legal Officers ranked data breaches as the most important issue keeping them “up at night.” Cybersecurity also remained top of mind for boards and other corporate stakeholders, particularly given the increasing reputational, regulatory and litigation consequences that often follow from a significant cybersecurity incident.

To read the full post, please click here.

For a PDF of the full memorandum, please click here.

The following post was originally included as part of our recently published memorandum “Selected Issues for Boards of Directors in 2020”.

Increased regulation continues to be the trend in data privacy law, with 2019 bringing forth a host of new regulations and guidance on existing laws. This year, the pace will not likely slow, with January 1, 2020, having marked the official arrival of robust data privacy law in the United States as the California Consumer Privacy Act (CCPA) came into effect.

Boards and management will need to continue to monitor the evolving privacy compliance landscape to ensure that they are considerate of privacy obligations and attendant risks when implementing their business objectives and oversight going into 2020.

To read the full post, please click here.

For a PDF of the full memorandum, please click here.