Uncategorized

Subscribe to Uncategorized via RSS

The Commonwealth of Virginia is on the verge of becoming the second state with a consumer data protection law. The Consumer Data Protection Act (“CDPA”), which awaits signature by Governor Northam (who is expected to sign the bill into law), would go into effect on January 1, 2023. Like California’s CCPA (and CPRA, also set to take effect January 1, 2023), the CDPA establishes a “comprehensive” framework for the collection and use of personal data of Virginia residents while also (and ironically) not applying to companies across the board. The CDPA would apply “to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.” Unlike CCPA, the CDPA does not contain an “annual revenue” threshold.
Continue Reading States Are “Stepping Up” to the Privacy Plate. Who’s Next? Virginia.

With the adoption of more stringent privacy laws across the globe, we have seen an exponential increase in privacy technology (or “tech”) vendors offering automated privacy compliance solutions. Among other things, privacy tech vendors provide software and services to assist companies with a whole range of services, including data inventory and mapping, privacy assessments, compliance reports and risk management, as well as policies, individual rights automation and other records that may be required as part of an organization’s compliance obligations. Many privacy tech vendors pitch their solutions to organizations as designed to “easily” assist with ongoing global compliance with the aid of automation and/or algorithms. Depending on the price that you are willing to pay, relying on these solutions can indeed be helpful to automate certain aspects of privacy compliance, including data mapping, consent mechanisms, records of processing or individual rights management. However, in their marketing materials, many privacy tech vendors – big or small, paid or free – caution companies that using legal professionals for privacy compliance will simply be too costly. Based on our experience, this is misleading at best, and a recent situation really reveals just that.
Continue Reading Lessons on Hidden Costs of Privacy Tech Vendors

As we (remotely) head back to school, we thought it timely to post our “annual” reminder that collecting, using and/or disclosing children’s personal information comes with some restrictions (see last year’s post here). With this unprecedented back-to-school season, nearly all children’s activities, products and services are moving online for the foreseeable future. As such, now more than ever organizations should really take the time to determine whether they collect any data from children (or have actual knowledge of doing so), and ensure that they are taking the proper steps to comply with applicable rules.
Continue Reading Children’s Privacy Check-Up

I recently co-wrote the following client alert with one of my colleagues, Monique Jewett-Brewster. Monique advises creditors, commercial landlords and tenants, and asset purchasers in business bankruptcies and in all other aspects of insolvency law.

As we move closer to a global recession caused by the current pandemic, some companies will find themselves in the unfortunate position of having to seek bankruptcy relief. This may have some important and often overlooked privacy implications. There is no question that in this day and age, one of a business’ most valuable assets is the personal information that it has collected from its customers and/or end-users – often more so than any of its tangible assets. Increasingly, as business shifts online, this is true not only of technology companies but also of “brick and mortar” companies.

However, when a business becomes a debtor, the sale of personal information can be problematic. Section 363(b) of the US Bankruptcy Code provides that a debtor that has a privacy notice prohibiting the transfer of personally identifiable information (“personal information”) may not use, sell or lease such information other than in the ordinary course of business unless (1) the use, sale or lease is consistent with the terms of the privacy notice or (2) after the appointment of a consumer privacy ombudsman (“CPO”) the court finds, after giving due consideration to the facts, circumstances, and conditions, that the sale or lease would not violate applicable non-bankruptcy law. These restrictions only apply if the debtor disclosed to its customers a privacy notice prohibiting the transfer of personal information to persons not affiliated with the debtor and the policy was in effect on the date of the bankruptcy filing.
Continue Reading Privacy Issues in Bankruptcy Sales

While this post may not fit under the header of the “Privacy Hacker”, I wanted to step aside from privacy and security and share some insight on common issues and topics with which we are assisting clients during this unprecedented time.

Contract Interpretation and Updates

Clients are seeking our guidance on contract interpretation, including the ability to terminate contracts. With the supply chain disruptions that flow through the entire chain, force majeure clauses are now being closely scrutinized.  Depending on the law that governs the contract, force majeure events may or may not excuse performance: factors hinge on whether the event causing the failure to perform was foreseeable and if performance is truly impossible (as opposed to much more difficult or expensive to perform). Notably, not being able to pay generally is not considered a breach that can be excused due to a force majeure event.

While some force majeure clauses are written broadly and refer to “events beyond the reasonable control” of a party to the contract, other clauses refer to an enumerated list of events. It is questionable how courts will interpret the broad clauses and whether or not a pandemic or quarantine will be read into the clause if there is only a broad catch-all statement. Again, this will depend on the law that governs the contract, a fact-specific analysis and of course how the language actually reads. Even when a contract lacks a force majeure clause, common law defenses to performance, such as impossibility, impracticability and frustration of purpose, should be considered. Without question, this is an intertwined, case-by-case analysis.
Continue Reading A Spectrum of Issues in the Time of COVID-19

As businesses struggle to navigate the new reality created by Covid-19, there are a few things to keep in mind both in the short and long term, when it comes to privacy and security.

Security & WFH.

With employees working remotely, now more than ever organizations are at risk of cybersecurity incidents. Malicious players will seek to exploit increased vulnerabilities in this age of WFH, and with IT teams scrambling to ensure that all of their employees can connect remotely and remain productive, some of the most obvious risks should not be overlooked:

  • A large number of organizations had not anticipated the need for laptops or other devices for ALL of their employees. As such, many workers across the country are now using their personal devices to perform their jobs, which may include handling proprietary and/or personal information. However, a number of these personal devices will not only lack some of the basic security tools and software (e.g., firewalls or antivirus software) and controls on what can be downloaded, but may also already contain some unsavory software or applications that increase the risk or malware distribution. In fact, some personnel may shortcut and use personal email accounts to transfer documents, which adds yet another level of risk, as further noted below. Add to this mix the exchange, transfer, and processing of proprietary and personal information, and this could lead to some very problematic unintended or unauthorized disclosures.
  • To connect and get work done, workers need a WiFi network, and unfortunately, some employees may be using unsecured WiFi networks. This could potentially be a very big problem if employees are accessing information via an unsecured or vulnerable WiFi network – such as a neighbor’s unsecure network. Some of the many risks of using unsecured WiFi networks include eavesdropping – which enables malicious players to access and capture everything remote workers are doing online including login credentials, emails, and other or proprietary information – as well as exposure to malicious attacks. No doubt, it is important to ensure that employees are using secure WiFi networks coupled with company VPN’s to prevent any malicious scanning activity.
  • Many organizations lack specific policies that specifically warn employees NOT to use personal email or messaging applications lacking encryption when they exchange the organization’s confidential information. Some of these policies, also commonly referred to as “BYOD” policies, are intended to inform workers of what they can and cannot do with their devices. Consider Bob sending a personal email to a friend and colleague that Mike in marketing tested positive for COVID-19 (i.e., sensitive health information) or an employee transferring customer lists with personal data via unencrypted messages. WFH devices aside, employees should also be reminded not to toss confidential documents in household garbage bins, to turn off smart devices that are voice-activated, and to take calls that involve confidential information in a “private area” of the home. Failing to clarify policies with personnel is very risky. Now would be a good time to remind employees of how they should minimize these risks.

Ensuring that your organization’s  IT and legal teams are working closely together to develop policies and procedures will help identify and minimize these increasing cybersecurity risks.
Continue Reading SHORT AND LONG TERM PRIVACY CONSIDERATIONS TO NAVIGATE OUR NEW REALITY

Gone are the days of thinking your business only needs to comply with certain privacy laws if it’s a “tech” company – or one that handles particularly sensitive information such as health information. Under the California Consumer Privacy Protection Act (“CCPA”), which went into effect on January 1, 2020, even brick and mortar companies must provide notices of their privacy practices at the point of collection, and this includes a number of retailers, wineries and restaurants (or restaurant groups).

Not so long ago, technology and the restaurant industry were worlds apart. If you wanted a reservation, you’d leave a voicemail that would be transcribed only to be deleted shortly thereafter. Loyalty cards were punch cards with no name attached. And if the wait for brunch was too long, you’d add your first name to a scrappy list that was discarded at the end of the day, or be handed a small buzzing device to let you know when your table was ready. Those “carefree” (or data-free) days have been replaced with a multitude of interconnected applications that all require the collection of personal information in some way – and importantly, that hang on to this information for longer periods. Restaurants and restaurant groups that collect the personal information of California residents and meet any one of the CCPA thresholds (i.e., over $25 million in annual revenue, collection of data on more than 50,000 consumers or 50% of revenue from sales) must comply with California’s stringent new law. Because the definition of personal information under CCPA is very broad and includes online identifiers, email addresses, and location data, as well as offline data (just to name a few), many successful restaurant groups are likely to fall within these thresholds and be subject to the CCPA.
Continue Reading How CCPA Affects Brick & Mortar Industries: Restaurants