Search results for: ccpa

Consistent with California’s history of prioritizing consumer privacy protections, Proposition 24 (full text here), a.k.a the California Privacy Rights Act (“CPRA”), was placed on the November ballot and handily approved by voters last week. The measure’s background itself indicates that the CPRA was being put forward to make privacy more transparent to users, similar to “ingredient labels on foods.” Background information also indicates a willingness to strengthen privacy rights over time rather than diluting them (particularly as regards to children), and in fact this push for increased transparency and protection is consistent with how certain platforms are requiring clearer policies (we discuss Apple’s new requirements here). While the CPRA will be fully effective and enforceable January 1, 2023, certain provisions take effect earlier and have a look-back provision. Businesses should start to familiarize themselves with the new or updated definitions and additional requirements contained in the CPRA. Continue Reading Voters Approve the California Privacy Rights Act: What Businesses Need to Know

The Federal Trade Commission has broadly relied on Section 5 of the Federal Trade Commission Act (FTC Act) to investigate and enforce against consumer protection violations, including in the context of data privacy and security. Specifically, Section 5 of the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce. With respect to data privacy and security, the FTC has repeatedly taken the position that under Section 5 of the FTC Act, a company’s failure to implement and maintain appropriate measures to protect consumers’ information may constitute an unfair practice. Likewise, making false or misleading representations (including omissions) about a company’s data privacy and security practices – notably in consumer-facing privacy notices – has been deemed by the FTC to constitute a deceptive trade practice. In its enforcement actions for data privacy and security violations, the FTC has sought – and obtained – both injunctive and equitable monetary relief (e.g., restitution or disgorgement) against companies whose practices violated Section 5 of the FTC Act. But how the FTC obtains equitable monetary relief – and whether it may even continue to do so under Section 13(b) of the FTC Act – is now before the Supreme Court. Continue Reading How the FTC’s Enforcement of Data Privacy and Security May be Impacted by the U.S. Supreme Court’s Upcoming Review of the FTC’s Use of Section 13(b)

As we (remotely) head back to school, we thought it timely to post our “annual” reminder that collecting, using and/or disclosing children’s personal information comes with some restrictions (see last year’s post here). With this unprecedented back-to-school season, nearly all children’s activities, products and services are moving online for the foreseeable future. As such, now more than ever organizations should really take the time to determine whether they collect any data from children (or have actual knowledge of doing so), and ensure that they are taking the proper steps to comply with applicable rules. Continue Reading Children’s Privacy Check-Up

With the Covid-19 crisis, many companies that may have traditionally only done business offline are transitioning and expanding into e-commerce. Others are starting new businesses and innovating new technologies and platforms. There are a multitude of considerations that go into these new ventures, an important one of which is security. Continue Reading Data Security and the New York SHIELD Act: Going Beyond New York Companies

At the Worldwide Developers Conference on June 23, Apple announced an assortment of new privacy features – some quite significant for developers – that will be included as part of iOS 14. Some of the new privacy features include added protections against user tracking on apps and websites, as well as transparency measures to prevent apps from using cameras or microphones without a user’s knowledge. How location data is collected will also be impacted: iOS already enables users to block specific apps from collecting data about their location, but now users will be able to share approximate location data.

One very significant change is that app developers will now be required to disclose the types of data that their app collects, and importantly, call out specific information that could be used to track users across platforms. Inspired by nutrition labels that are typically affixed to food products, these new disclosure mandates from Apple will require developers to complete a specific form (showcased at the Worldwide Developers Conference). When users search for an app, the summary of collected data will appear alongside other information about the app. Continue Reading Apple’s iOS 14 Transformative Privacy Announcements

As businesses struggle to navigate the new reality created by Covid-19, there are a few things to keep in mind both in the short and long term, when it comes to privacy and security.

Security & WFH.

With employees working remotely, now more than ever organizations are at risk of cybersecurity incidents. Malicious players will seek to exploit increased vulnerabilities in this age of WFH, and with IT teams scrambling to ensure that all of their employees can connect remotely and remain productive, some of the most obvious risks should not be overlooked:

  • A large number of organizations had not anticipated the need for laptops or other devices for ALL of their employees. As such, many workers across the country are now using their personal devices to perform their jobs, which may include handling proprietary and/or personal information. However, a number of these personal devices will not only lack some of the basic security tools and software (e.g., firewalls or antivirus software) and controls on what can be downloaded, but may also already contain some unsavory software or applications that increase the risk or malware distribution. In fact, some personnel may shortcut and use personal email accounts to transfer documents, which adds yet another level of risk, as further noted below. Add to this mix the exchange, transfer, and processing of proprietary and personal information, and this could lead to some very problematic unintended or unauthorized disclosures.
  • To connect and get work done, workers need a WiFi network, and unfortunately, some employees may be using unsecured WiFi networks. This could potentially be a very big problem if employees are accessing information via an unsecured or vulnerable WiFi network – such as a neighbor’s unsecure network. Some of the many risks of using unsecured WiFi networks include eavesdropping – which enables malicious players to access and capture everything remote workers are doing online including login credentials, emails, and other or proprietary information – as well as exposure to malicious attacks. No doubt, it is important to ensure that employees are using secure WiFi networks coupled with company VPN’s to prevent any malicious scanning activity.
  • Many organizations lack specific policies that specifically warn employees NOT to use personal email or messaging applications lacking encryption when they exchange the organization’s confidential information. Some of these policies, also commonly referred to as “BYOD” policies, are intended to inform workers of what they can and cannot do with their devices. Consider Bob sending a personal email to a friend and colleague that Mike in marketing tested positive for COVID-19 (i.e., sensitive health information) or an employee transferring customer lists with personal data via unencrypted messages. WFH devices aside, employees should also be reminded not to toss confidential documents in household garbage bins, to turn off smart devices that are voice-activated, and to take calls that involve confidential information in a “private area” of the home. Failing to clarify policies with personnel is very risky. Now would be a good time to remind employees of how they should minimize these risks.

Ensuring that your organization’s  IT and legal teams are working closely together to develop policies and procedures will help identify and minimize these increasing cybersecurity risks. Continue Reading SHORT AND LONG TERM PRIVACY CONSIDERATIONS TO NAVIGATE OUR NEW REALITY

 

If it’s not already, security should be a top priority for all companies that collect and hold personal data. Companies subject to the California Consumer Privacy Act (CCPA), effective since January 1, should be even more concerned given the new consumer right of action in the event of certain security incidents, and the increase in class actions to which this will inevitably lead (more on that below).

And yet…

During a recent discussion with friends in the hospitality/travel industry, I was surprised to hear of shockingly poor security practices when they described how travelers’ information was shared and transmitted on a daily basis. I learned, for instance, that travelers’ information – especially when it comes to groups – is often sent in unprotected, unencrypted documents, such as excel spreadsheets or pdfs, to equally insecure email addresses, with multiple recipients copied. These documents, which circulate freely among various players in the ecosystem, contain hyper-sensitive information, such as passport numbers, credit card information, location, and travel dates and addresses. We are not talking about a name and a device ID, here, but troves of data that hackers would love to get their hands on. Continue Reading Staying on Top of Security Practices

Similar to the months before the GDPR went into effect at the end of May 2018, companies are now actively preparing for compliance with the California Consumer Privacy Act (CCPA).  As California leads the pack of states in terms of privacy and technology laws, other states have followed suit, including Nevada.

The Nevada statute (SB 220) is an amendment to Nevada’s existing law, which requires website operators to have a privacy policy with certain disclosures. Continue Reading From the Golden State to the Silver State – Privacy Law in Nevada

As part of our blog, from time to time we will share some of the most frequently asked questions that we receive from organizations across different industries regarding data privacy and security, and more specifically GDPR and CCPA. This is the first FAQ in our series.

What’s the Deal with the Data Protection Officer?

Not to be confused with a CPO (Chief Privacy Officer) or EU Representative, the role of data protection officer (DPO) has specific legal meaning under the GDPR. The primary role of a DPO is to ensure that the organization to which it is appointed processes the personal data of its staff, customers or any other individuals (i.e., data subjects) in accordance with applicable data protection rules. Many, but not all organizations subject to GDPR, are required to appoint a DPO, but given the unique nature of the DPO, the why, when and how of this topic is definitely at the top of our US clients’ FAQs. Continue Reading Privacy FAQ #1