Emerging Technology and the Law Blog
New U.S. Privacy Laws Follow GDPR Trend With the approval of the CPRA citizen’s initiative (Consumer Privacy Reform Act amending the CCPA – Proposition 24) and the introduction of new privacy legislation in New York and elsewhere all moving toward a U.S. equivalent of GDPR, it is time to face the fact that U.S. privacy compliance obligations are here to stay. When GDPR enforcement began in 2018, many U.S. businesses that were not operating in the EU considered it something that was happening “over there.” Enforcement of the California CCPA (California Consumer Privacy Act) began in January 2020. Now, …
Under the European Union GDPR privacy compliance obligations, Data Protection Impact Assessments (DPIA) are mandatory for data processing “likely to result in a high risk to the rights and freedoms of data subjects.” Failure to conduct such a risk assessment is a breach of the GDPR that is subject to significant fines. Whether an organization is required to comply with the GDPR is beyond the scope of this article but if your organization processes any of the following types of “risky” Personal Data of EU or UK citizens listed in the table below, now is the time to find out. …
Privacy and cybersecurity compliance issues are inextricably linked. In one sense, they are peas in a pod. A security breach can leak all sorts of information assets, from useless server logs to trade secrets to sensitive personally identifiable information, or PII. At the heart of many privacy compliance obligations is the recognition of a duty to make “reasonable” efforts to protect PII through technical and organizational means. Such balancing tests are necessarily a key aspect of enterprise risk management. The massive SolarWinds supply chain hack is a case in point. On January 12, 2021, security research company CrowdStrike reported discovery …
On July 16, 2020, the European Court of Justice (ECJ – the European Union’s high court) invalidated the EU-US Privacy Shield Framework as a potential mechanism for meeting the GDPR’s cross-border personal data transfer restrictions. Effective immediately, U.S. companies that process EU “personal data” can no longer rely on registration under the Privacy Shield and must establish an alternative legal basis for any continued EU-US transfers. Previously, cross-border transfers to the US were permitted under three mechanisms: 1) the Privacy Shield (http://privacyshield.gov), 2) Standard Contractual Clauses (SCC), and 3) Binding Corporate Rules (BCR). The Privacy Shield was originally developed in response to a 2005 ECJ decision invalidating the “US-EU Safe Harbor Framework,” an earlier agreement to permit U.S. companies to process EU personal data in a way that protected EU privacy rights. Privacy Shield, administered by the Federal Trade Commission, allowed companies self-certify compliance and was generally considered a workable GDPR solution for U.S. companies that processed (touched) EU personal data. Impacts The decision has made waves not just because it declares that any cross-border transfer of personal data under the Privacy Shield is illegal but because it has immediate effect. According to a FAQ issued by the European Data …
In the wake of the Cambridge Analytica scandal, restrictions on monetization of personal information (aka PI or PII) are coming to California in 2020. The California legislature unanimously passed a historic bill to adopt many of the core privacy principles of the EU General Data Protection Initiative (GDPR) for California consumers. The bill was fast-tracked into law in order to avoid the likely passage of a more rigorous ballot initiative in the November election. The key difference between the ballot initiative and the adopted law is that the legislative version can be more easily amended to avoid unintended consequences. Indeed, the industry lobbying has already begun. A statement by the Internet Association immediately criticized the legislation: It is critical going forward that policymakers work to correct the inevitable, negative policy and compliance ramifications this last-minute deal will create for California’s consumers and businesses alike. The significance of this new law on U.S. businesses will be far reaching. The state of California is now recognized as the world’s 5th largest economy, surpassing the United Kingdom. California’s 40 million “consumers” have just gained privacy rights quite similar to those recently afforded to EU citizens by the General Data Protection Regulation (GDPR). Unlike …
The California Consumer Privacy Act of 2018 is a ballot initiative that has gained more than enough signatures to appear on the November 6, 2018 general election ballot. If approved by the voters, the Act will greatly expand privacy rights in California. It will apply to larger companies that do business in California as well as entities that collect substantial amounts of Personal Information from California residents. California has in the past led the US in various trends and regulations, good and bad. Freeways, Beach Boys, hippies, hipsters, car culture, bikers, early Burning Man, the music industry, and Hollywood helped define US culture. Well-known regulations and restrictions on air quality such as CARB (CA Air Resources Board), on “chemicals known to the state to cause cancer or reproductive toxicity” such as Proposition 65, and on offshore drilling have been very influential. Facebook, Google, Apple, AirBnB, Tesla, and yes, Theranos are all California companies. Beauty is in the eye of the beholder In 1976, a wealthy acquaintance in the Bel Air hills invited me for drinks to survey the skyline overlooking Los Angeles at dusk from his poolside perch. Like the successful Mr. McGuire in The Graduate urging Ben to steer his career towards the …
On May 25th, Senators Edward J. Markey (D-Mass.), Dick Durbin (D-Ill.), Richard Blumenthal (D-Conn.), and Bernie Sanders (I-Vt.) introduced a Senate resolution calling for U.S. companies and institutions covered by the European Union’s (EU) new privacy law, the General Data Protection Regulation (GDPR), to provide Americans with privacy protections included in the European law. The 5 page Resolution summarizes the GDPR as requiring: that data processors have a legal basis for processing the data of users; and that opt-in, freely given, specific, informed, and unambiguous consent from users is a primary legal basis. The Resolution is not a bill and has not yet been debated or adopted. However, it was symbolically introduced on the very same day that European GDPR became law. Many US enterprises are impacted by the new EU law, because they control or process the personal data of people in the EU. Some US companies have announced full compliance with the GDPR for all people worldwide. Others have geofenced and blocked EU data subjects. Others, like the Washington Post, have erected a supposedly compliant paywall to provide GDPR-compliant and ad-free access to the EU countries. The Markey Resolution “encourages entities” already covered by the impact of the …
Does GDPR Apply in the US? Yes. GDPR (European Union General Data Protection Regulation) is a comprehensive new law protecting the data privacy of EU citizens. GDPR takes effect on May 25, 2018. It consists of 99 articles and will have sweeping impact on U.S. enterprises. It requires that all personal data be handled according to the GDPR Data Protection Principles. These includes the famous “right to be forgotten,” as well as transparency, data portability, breach notification, information security, etc. If you have a public facing website that collects user data and operates in EU countries, it is not too late to get advice. Watch this space as we roll out solutions for enterprises that are not ready.
The GDPR protects “personal data” of EU citizens. So, if you are only doing business outside the European Union then you don’t have to consider it at all, right? Think again. What about any business with a website?
In December 2015, the electronic discovery provisions of the Federal Rules of Civil Procedure (FRCP) were amended to substantially expand the Safe Harbor against sanctions for destruction of electronic data. In my November 2015 white paper, C-Level Guide to Covering Your Information Governance Assets, I predicted that the amended rules signaled a pivot away from one of the main sources of eDiscovery uncertainty – the inconsistent imposition of severe sanctions for the loss of electronically stored information (ESI) relevant to dispute resolution. The prediction holds. The prior Safe Harbor under the 2006 FRCP provided modest protections against sanctions where ESI was lost due to routine and automatic deletion. Because of the inconsistent standards previously applied by courts around the country, organizations fearful of doomsday sanctions would over-preserve. The new discovery rules greatly expand this protection. A cursory review of sanctions cases decided under the new rules in influential U.S. District Courts indicates that the Federal bench is successfully applying the new rules as the Rules Advisory Committee intended – limiting judicial discretion to impose case-killing sanctions to situations where a party intentionally deprives its opponent of documents covered by a “legal hold.” An excerpt from a Northern District of California …