Data Matters Privacy Blog Home Page - Data Matters Privacy Blog

*This article was first published by Bloomberg Law in August 2019

Companies doing business with California consumers are impacted by the California Consumer Privacy Act (effective Jan. 1, 2020). The CCPA’s private right of action provision gives California residents the right to sue companies when their personal information is subject to unauthorized access and exfiltration, theft, or disclosure due to a company’s failure “to implement and maintain reasonable security procedures and practices.”

Under this provision, consumers may seek actual damages, declaratory or injunctive relief, and statutory damages, which begin at $100 and continue up to $750 “per consumer per incident.” The potential aggregated exposure through consumer class actions could be significant, and companies are searching for ways to mitigate private lawsuits.

CCPA, Cybersecurity, Data Breaches, Enforcement, Information Security, Litigation, U.S. State Law

New York Enacts Stricter Data Cybersecurity Laws

Aug 05 2019

Alan Charles Raul, Colleen Theresa Brown and Snezhana Stadnik Tapia

The flurry of state legislative activity in the wake of the enactment of the California Consumer Protection Act (CCPA) continues with the New York legislature recently passing two bills to increase accountability for the processing of personal information. On July 25, 2019, Governor Cuomo signed the two bills into law, one which amended the state’s data breach notification law, and another that created additional obligations for data breaches at credit reporting agencies. Together, the new laws require the implementation of reasonable data security safeguards, expand breach reporting obligations for certain types of information, and require that a “consumer credit reporting agency” that suffers a data breach provide five years of identity theft prevention services for impacted residents. Meanwhile, the more comprehensive New York Privacy Act, which many viewed as even more expansive than the CCPA, failed to gather the necessary support in the most recent legislative session.

CCPA, Cybersecurity, Data Breaches, Information Security, Legislation, Policy, U.S. State Law

FERC Enhances Reporting Requirements for Cyber Attacks on Power Grid

Jul 19 2019

Emily Mallen, Curtis Hart and Robin Wright Cleary

On June 20, 2019, the Federal Energy Regulatory Commission (“FERC”) approved a North American Electric Reliability Corp. (“NERC”) petition to adopt Reliability Standard CIP-008-6 to strengthen the reporting requirements for attempts to compromise the operation of the United States’ bulk electric system. The prior Critical Infrastructure Protection (“CIP”) Reliability Standards only required reporting where an incident compromised or disrupted one or more reliability tasks. The new standard applies to all registered entities subject to the CIP Reliability Standards.

Cybersecurity, Data Breaches, Energy, Enforcement, Information Security, National Security, Policy

A Closer Look at California Privacy Law Bar on Two Contract Clauses

Jul 16 2019

Alexis Miller Buese and Rachel R. Goldberg

*This article first appeared in Law360 on July 8, 2019

In September of 2018, California passed a significant new consumer privacy law, the California Consumer Privacy Act, which is the first U.S. law to regulate how businesses with a presence in California collect, share, and use consumer data. The CCPA not only imposes significant compliance obligations on companies conducting business with California residents but also incentivizes class action litigation through both the CCPA’s private right of action and California’s Unfair Competition law.

READ MORE

CCPA, Litigation

Navigating the CCPA’s ‘Notice and Cure’ Provision

New York Enacts Stricter Data Cybersecurity Laws

FERC Enhances Reporting Requirements for Cyber Attacks on Power Grid

A Closer Look at California Privacy Law Bar on Two Contract Clauses

Categories

Archives

Contacts