Archives: Data Privacy

Subscribe to Data Privacy RSS Feed

Privacy Concerns Lead OSHA to Rescind its Electronic Filing Requirement

In response to concerns raised by employers and to protect worker privacy, the Occupational Health & Safety Administration (OSHA) recently amended its recordkeeping regulations to eliminate the requirement that larger employers submit certain information electronically. The final rule rescinds the mandate that establishments with 250 or more employees had to electronically submit information from OSHA Form … Continue Reading

CCPA Part 2 – What Does Your Business Need to Know? Consumer Requests and Notice to Consumers of Personal Information Collected

This week we continue our series of articles on the California Consumer Privacy Act of 2018 (CCPA). We’ve been discussing the broad nature of this privacy law and answering some general questions, such as what is it? Who does it apply to? What protections are included for consumers? How does it affect businesses? What rights … Continue Reading

California AG’s Office Begins CCPA Rulemaking Process with Series of Public Forums

On January 8, 2019, the California Department of Justice hosted the first in a series of six public forums on the California Consumer Protection Act (CCPA). The forums offer the public an opportunity for comment in advance of the drafting of regulations by the state Attorney General’s office. These regulations are seen as being particularly … Continue Reading

Data Privacy and Security in the Cannabis Industry

In November, cannabis won big in the midterm elections–in Michigan, the legalization of recreational cannabis passed, the legalization of medical cannabis passed in Utah and Missouri, and several states elected governors who back legislation for legalization of cannabis. Now, there are 33 states that allow some form of medical marijuana and 10 states (plus D.C.) … Continue Reading

Fourth Circuit Expands Title IX Liability for Harassment Through Anonymous Online Posts

The Fourth Circuit recently held that universities could be liable for Title IX violations if they fail to adequately respond to harassment that occurs through anonymous-messaging apps. The case, Feminist Majority Foundation v. Hurley, concerned messages sent through the now-defunct app Yik Yak to the individual plaintiffs, who were students at the University of Mary … Continue Reading

SSD Hardware and BitLocker Encryption

Security researchers at Radboud University in the Netherlands have discovered a flaw in several manufacturers’ solid state hard drive firmware that can be exploited to read data from self-encrypting drives (SED). The researchers published their findings in a paper on November 5th. The authors identified several methods they were able to use to bypass hardware … Continue Reading

Apple CEO Calls for Comprehensive US Privacy Laws

Tim Cook, Apple CEO, recently delivered the keynote address for a privacy conference, attended by policy experts and European Union (EU) lawmakers in Brussels, Belgium, where he advocated for new data privacy laws in the United States, similar to the EU’s General Data Protection Regulation (GDPR). Cook said that modern technology has led to the … Continue Reading

Amended California Privacy Law Sent to Governor for Signature

We have previously reported on the anticipated impact of the new California Privacy Law—the California Consumer Privacy Act (“the Act”) [view related post]. The first amendment to the Act, (most likely be the first of many amendments) recently obtained approval from state lawmakers and is on its way to Governor Jerry Brown for signature. The … Continue Reading

Industry Groups Push for Modifications to California Consumer Privacy Act

As previously detailed, the California Consumer Privacy Act of 2018 was hastily passed by the California legislature as a compromise designed to avoid a more far-reaching ballot initiative. Recognizing the need to clarify various drafting errors, the drafters are currently working on Senate Bill 1121, intended to clarify certain provisions of the Act and to … Continue Reading

MLB to Use Biometrics to Replace Traditional Ticketing

Traditional tickets (paper, that is) have already been replaced with mobile tickets for many Major League Baseball (MLB) stadiums across the country, but now, MLB has teamed up with CLEAR, which provides biometric authentication, to implement biometric ticketing at select stadiums. CLEAR will allow baseball fans to use their fingerprints, and eventually facial recognition, to … Continue Reading

Virginia Data Breach Law Amended to Include Income Tax Preparers

We have frequently reported about how devastating and widespread tax fraud is in the U.S.—in the past affecting hundreds of thousands of U.S. taxpayers [view related privacy tip]. Income tax preparers are at risk for cyber intrusions because they hold highly sensitive personal information of their clients, which can be used by criminals to commit … Continue Reading

California Enacts “GDPR-Esque” Privacy Law

On June 28, 2018, the California State Legislature passed, and Governor Jerry Brown signed, the California Consumer Privacy Act of 2018, bringing to the United States many of the rights and compliance obligations currently being applied by the European Union through its General Data Protection Regulation (GDPR). Effective January 1, 2020, the Act gives California … Continue Reading

Data Sharing in Connected Cars

In the age of web-connected vehicles, the consumer’s relationship with the vehicle’s manufacturer takes on a whole new meaning. Not only does the relationship exist for the purpose of vehicle maintenance or future repairs, but the consumer also serves as a rolling information bank to the manufacturer. Indeed, nearly every new vehicle is by default … Continue Reading

Smile and Say “Cheese” — When is a Photo an Educational Record under FERPA?

As the myriad of Family Educational Rights and Privacy Act  (FERPA) interpretation issues continues to cloud many educators’ understanding of what is permissible and not permissible under the statute, some assistance was recently provided by the U.S. Department of Education. The Family Policy Compliance Office (FPCO) advises that as with any other “education record,” a photo or video of a student … Continue Reading

California Consumer Privacy Act Likely to Appear on Ballot in November

Businesses are understandably focused this week on the looming effective date for the European Union’s General Data Protection Regulation (GDPR). For U.S. businesses, however, a proposed law closer to home would raise similar compliance burdens and create potential litigation risks. This November, voters in California will likely vote on whether to pass a ballot initiative, … Continue Reading

Facebook and the English Data Firm Cambridge Analytica (CA) Face Intense Scrutiny for Possible Misuse of Facebook User Data

Facebook and the English data analytics firm Cambridge Analytica (CA) are facing intense scrutiny in response to numerous reports about the possible misuse of data of 50 million Facebook accounts. The data was originally collected through a third party personality test app and later reportedly improperly transferred to CA and/or its parent company Strategic Communications … Continue Reading

European Commission Releases GDPR Guidance

All privacy professionals, whether in the EU or the U.S., need to have an understanding of the implications of General Data Privacy Regulation (GDPR) compliance, particularly since the fines and penalties that could be imposed for non-compliance are intimidating. GDPR goes into effect on May 25, 2018, and many companies are struggling to become compliant … Continue Reading

Federal Trade Commission Approves Settlement with Lenovo Over Ad Software

The Federal Trade Commission (FTC) has approved its proposed settlement with Lenovo, Inc. over the installation of pre-installed advertising software called VisualDiscovery onto Lenovo laptops. According to the FTC, the pre-installed software “interfered with how a user’s browser interacted with websites and created serious security vulnerabilities.” The settlement requires Lenovo to not misrepresent the features … Continue Reading

Compliance With New York’s Cybersecurity Regulation 23 NYCRR Part 500

On March 1, 2017, New York’s Cybersecurity Regulation (23 NYCRR Part 500)[1] became effective.  The regulation is the first of its kind in the nation and requires certain companies, including banks, insurance companies and other financial services institutions regulated by the Department of Financial Services (“Covered Entities”), to have: a cybersecurity program designed to protect … Continue Reading
LexBlog