A plan for an enforcement program under the California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA) (collectively CCPA) is on its way from the California Privacy Protection Agency (CPPA). Despite a recent court ruling that the enforcement of some of the amendments under the CPRA cannot begin until March 2024, last week the CPPA
Colorado AG Updates Draft Rules for Colorado Privacy Act
By Linn Foster Freedman on
Posted in Data Privacy, Websites
Colorado Attorney General Phil Weiser’s office recently published an updated version of the draft rules governing the Colorado Privacy Act, which goes into effect on July 1, 2023. The updates build upon the original draft rules published on October 10, 2022, and are based on input received by the AG’s office through December 2, 2022.…
Samsung Sued Under CCPA
By Robinson+Cole's Data Privacy + Cybersecurity Team on
Posted in Enforcement + Litigation
A class action lawsuit, Seirafi et al v. Samsung Electronics America, Inc., Case 4:22-cv-05176-KAW, filed recently in the Northern District of California, alleges that Samsung’s unnecessary personal information collection, and failure to secure that information, violate the California Consumer Privacy Act (CCPA). This lawsuit was inspired by two recent data breaches that allegedly included personal…
Sephora Settles with California AG for CCPA Violations over Sale of Data
By Kathryn Rattigan on
Posted in Enforcement + Litigation, Websites
In the first of its kind under the California Consumer Privacy Act (CCPA), Sephora settled an enforcement action with the California Attorney General for violation of the CCPA. Sephora must pay $1.2 million in penalties and implement a CCPA compliance program. The enforcement action alleged that Sephora permitted third parties to create customer profiles that…
What’s in the American Data Privacy and Protection Act?
By Robinson+Cole's Data Privacy + Cybersecurity Team on
Posted in Data Privacy, Websites
Congress is considering omnibus privacy legislation, and it reportedly has bipartisan support. If passed, this would be a massive shake-up for American consumer privacy, which has been left to the states up to this point. So, how does the American Data Privacy and Protection Act (ADPPA) stack up against existing privacy legislation such as the…
Utah Consumer Privacy Act Newest State Privacy Act Signed into Law
By Linn Foster Freedman on
The newest state data privacy law, the Utah Consumer Privacy Act (the Act), was signed into law by Utah Governor Spencer J. Cox on March 24, 2022. This makes Utah the fifth state to pass its own privacy law instead of waiting for the federal government to enact a nationwide federal law.
There are other…
California Attorney General’s Opinion States that Consumers’ Right to Know Includes Inferences
By Robinson+Cole's Data Privacy + Cybersecurity Team on
Posted in CCPA, Data Privacy
We all know businesses collect our data. But did you know that businesses can draw inferences from those data to determine whether a consumer is married, or is a homeowner, or is a likely voter? Recently, the question arose whether those inferences constitute personal information under the California Consumer Privacy Act of 2018 (CCPA or…
At Least 22 States Have Consumer Privacy Legislation Pending – Will 2022 Be the Year for More State Privacy Laws?
By Robinson+Cole's Data Privacy + Cybersecurity Team on
Posted in Data Privacy
California is the gold standard for state privacy laws, having recently enacted the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Virginia and Colorado also have enacted comprehensive privacy laws, which will take effect in 2023. Recently, the International Association of Privacy Professionals (IAPP) released its state privacy legislation tracker.…
Data Minimization: What Is It and Why Practice It?
By Robinson+Cole's Data Privacy + Cybersecurity Team on
The European Union’s General Data Protection Regulation (GDPR) first launched the concept of data minimization, which states that a data controller should limit the collection of personal information to what is directly relevant and necessary to accomplish a specified purpose. This seems like a simple concept: an entity should only collect personal information that is…
CAAG Announces Investigative Sweep of Loyalty Programs’ Compliance with CCPA
By Linn Foster Freedman on
California Attorney General Rob Bonta is serious about compliance with the California Consumer Privacy Act (CCPA). So serious, that on January 28, 2022, also known as Data Privacy Day, he announced that his office was commencing an investigative “sweep” of “businesses operating loyalty programs in California” and sent notices of noncompliance to businesses requiring them…