Singapore may soon mandate data breach notifications and data portability via amendments to the Singapore Personal Data Protection Act, or PDPA. The PDPA applies to all organizations that collect, use and disclose data in Singapore, and the PDPA has extraterritorial effect as it applies to all organizations collecting, using or disclosing personal data from individuals in Singapore (whether or not the company has a physical presence in Singapore).

APEC, Asia, Cybersecurity, Data Breaches, Information Security, Legislation, Policy

The New Congress Turns to an Old Issue – The Possibility of Comprehensive Federal Privacy Legislation

Mar 18 2019

Christopher Fonzone and Kristen Bartolotta

Even a few short years ago, it seemed unlikely that Congress would enact comprehensive privacy legislation. But a series of high profile data breaches; increasing concerns about data practices, particularly when connected to political micro-targeting; fears about the rise of autonomous, and potentially invisible, decision-making; and the passage of far-reaching foreign and now State privacy laws have all changed the zeitgeist. Congress has taken notice, and, for the past year, Data Matters has been closely following the Legislative Branch’s moves as it a federal privacy bill looks more likely than it has in a generation.

Legislation, Online Privacy, Policy, US State Privacy Laws

FTC Announces Record-Setting $5.7M COPPA Penalty

Mar 14 2019

Colleen Theresa Brown, Dean C. Forbes and Gabrielle Whitehall

On February 27, 2019, the Federal Trade Commission (“FTC”) announced a record-setting $5.7 million civil penalty against makers of the popular free video creation and sharing app, Musical.ly (now known as TikTok), for violations of U.S. children’s privacy rules. This is the largest civil penalty the FTC has issued concerning violations of the Children’s Online Privacy Protection Act (“COPPA”).

Children’s Privacy, Enforcement, FTC, Online Privacy, SEC

FTC Seeks Comment on Proposed Changes to its GLBA Safeguards and Privacy Rules

Mar 12 2019

Christopher Fonzone, Seferina Berch and Snezhana Stadnik

Over the last few years, States have enacted increasingly aggressive legislation concerning data privacy and security, raising concerns that companies will be subject to a patchwork of different standards. Congress has recently taken notice, convening hearings on potential federal privacy legislation, with the possibility of preemption a hot topic during the hearings. Last week, the Federal Trade Commission (“FTC”) got into the act as well, releasing two notices of proposed rulemaking (“NPRM”) on potential changes to its the Standards for Safeguarding Customer Information (“Safeguards Rule”) and Privacy of Consumer Financial Information Rule (“Privacy Rule”) under the Gramm-Leach-Bliley Act. The proposed amendments – and particularly the proposed changes to the Safeguard Rule – signal the FTC’s desire to align its rules with those of key states and to further protect customer information held by financial institutions.

Cybersecurity, Enforcement, Financial Privacy, FTC, Information Security, Policy

FCA Publishes Wholesale Banks and Asset Management Cyber Multi-Firm Review Findings

Feb 28 2019

William RM Long and Eleanor Dodding

The UK Financial Conduct Authority (“FCA”) has carried out a multi-firm review of cybersecurity practices with a sample of 20 firms in the wholesale banking and asset management sectors (the “Report”). The review aimed to look more closely at how wholesale banking and asset management firms oversee and manage their cybersecurity, including the extent to which firms identify and mitigate relevant cyber risks and their current capability to respond to and recover from data security incidents.

Cybersecurity, Data Breaches, Enforcement, European Union, Financial Privacy, Information Security, International

NERC $10,000,000 Fine of Public Utility Highlights the Need for Cybersecurity Preparedness and CIP Compliance Programs

Feb 26 2019

Emily Mallen, Colleen Theresa Brown, Curtis Hart and Jon Dugan

On January 25, 2019, the North American Electric Reliability Corporation (“NERC”) asked the Federal Energy Regulatory Commission (“FERC”) to approve a settlement issuing a record $10 million fine against an unidentified utility resulting from violations of critical infrastructure protection standards (“CIP”) occurring mostly between 2015 and 2018 (referred to hereafter as the “Settlement Agreement”). Although none of the violations resulted in any reported outages, NERC concluded that the cumulative effect of the violations posed a serious risk to the reliability of the bulk U.S. power grid because “many of the violations involved long durations, multiple instances of noncompliance, and repeated failures to implement physical and cyber security protections.” Settlement Agreement at 12.

Cybersecurity, Energy, Enforcement, Information Security, National Security

Important Changes to the Singapore Data Privacy Regime

The New Congress Turns to an Old Issue – The Possibility of Comprehensive Federal Privacy Legislation

FTC Announces Record-Setting $5.7M COPPA Penalty

FTC Seeks Comment on Proposed Changes to its GLBA Safeguards and Privacy Rules

FCA Publishes Wholesale Banks and Asset Management Cyber Multi-Firm Review Findings

NERC $10,000,000 Fine of Public Utility Highlights the Need for Cybersecurity Preparedness and CIP Compliance Programs

Categories

Archives

Contacts

Upcoming Events

Women in Privacy