Emerging Technology and the Law Blog

California Dreamin’ – A Blueprint for CCPA/CPRA Compliance

By Steven J. O'Neill
California coastal photo

  New U.S. Privacy Laws Follow GDPR Trend With the approval of the CPRA citizen’s initiative (Consumer Privacy Reform Act amending the CCPA – Proposition 24) and the introduction of new privacy legislation in New York and elsewhere all moving toward a U.S. equivalent of GDPR, it is time to face the fact that U.S. privacy compliance obligations are here to stay. When GDPR enforcement began in 2018, many U.S. businesses that were not operating in the EU considered it something that was happening “over there.” Enforcement of the California CCPA (California Consumer Privacy Act) began in January 2020. Now, the hope of avoiding strict privacy compliance obligations “over here” is now only a dream. The CPRA amended and strengthened the CCPA, moving it closer to the protections afforded to EU citizens, and post-Brexit, to UK citizens. (Proposition 24 approved November 2020; Effective 1/1/23.) it is time to face the fact that U.S. privacy compliance obligations are here to stay There are privacy bills pending before the New York Assembly that like CCPA/CPRA adopt many of the key privacy principles staked out by the GDPR: Consent, Privacy by Design, Data Minimization, Lawful Purpose, and Information Security. In addition, both the California …

Read more

RISKY BUSINESS: Technologies Requiring a Data Protection Impact Assessment (DPIA) under the GDPR

By Steven J. O'Neill
Roulette Wheel seen from space

Under the European Union GDPR privacy compliance obligations, Data Protection Impact Assessments (DPIA) are mandatory for data processing “likely to result in a high risk to the rights and freedoms of data subjects.” Failure to conduct such a risk assessment is a breach of the GDPR that is subject to significant fines. Whether an organization is required to comply with the GDPR is beyond the scope of this article but if your organization processes any of the following types of “risky” Personal Data of EU or UK citizens listed in the table below, now is the time to find out. …

Read more

Solar Winds Supply Chain Hack Wins Password Contest

By Steven J. O'Neill
In this picture, the Sun's surface is quite dark. A frame from a movie recorded on November 9th by the orbiting TRACE telescope, it shows coronal loops lofted over a solar active region. Glowing brightly in extreme ultraviolet light, the hot plasma entrained above the Sun along arching magnetic fields is cooling and raining back down on the solar surface.

Privacy and cybersecurity compliance issues are inextricably linked. In one sense, they are peas in a pod. A security breach can leak all sorts of information assets, from useless server logs to trade secrets to sensitive personally identifiable information, or PII. At the heart of many privacy compliance obligations is the recognition of a duty to make “reasonable” efforts to protect PII through technical and organizational means. Such balancing tests are necessarily a key aspect of enterprise risk management. The massive SolarWinds supply chain hack is a case in point. On January 12, 2021, security research company CrowdStrike reported discovery …

Read more

US-EU Privacy Shield Perforated – GDPR after Schrems II

By Steven J. O'Neill
Ajax lower left holding a shield aloft, at the right stands Agamemnon surrounded by his soldiers (1540–50).

On July 16, 2020, the European Court of Justice (ECJ – the European Union’s high court) invalidated the EU-US Privacy Shield Framework as a potential mechanism for meeting the GDPR’s cross-border personal data transfer restrictions. Effective immediately, U.S. companies that process EU “personal data” can no longer rely on registration under the Privacy Shield and must establish an alternative legal basis for any continued EU-US transfers. Previously, cross-border transfers to the US were permitted under three mechanisms: 1) the Privacy Shield (http://privacyshield.gov), 2) Standard Contractual Clauses (SCC), and 3) Binding Corporate Rules (BCR). The Privacy Shield was originally developed in response to a 2005 ECJ decision invalidating the “US-EU Safe Harbor Framework,” an earlier agreement to permit U.S. companies to process EU personal data in a way that protected EU privacy rights. Privacy Shield, administered by the Federal Trade Commission, allowed companies self-certify compliance and was generally considered a workable GDPR solution for U.S. companies that processed (touched) EU personal data. Impacts The decision has made waves not just because it declares that any cross-border transfer of personal data under the Privacy Shield is illegal but because it has immediate effect. According to a FAQ issued by the European Data …

Read more

California Consumer Privacy Act – GDPR Principles Arrive in the U.S.

By Steven J. O'Neill
Big Sur California ocean view from Cafe Kevah

In the wake of the Cambridge Analytica scandal, restrictions on monetization of personal information (aka PI or PII) are coming to California in 2020. The California legislature unanimously passed a historic bill to adopt many of the core privacy principles of the EU General Data Protection Initiative (GDPR) for California consumers. The bill was fast-tracked into law in order to avoid the likely passage of a more rigorous ballot initiative in the November election. The key difference between the ballot initiative and the adopted law is that the legislative version can be more easily amended to avoid unintended consequences. Indeed, …

Read more

Eureka – Privacy Discovered in California?

By Steven J. O'Neill

The California Consumer Privacy Act of 2018 is a ballot initiative that has gained more than enough signatures to appear on the November 6, 2018 general election ballot. If approved by the voters, the Act will greatly expand privacy rights in California. It will apply to larger companies that do business in California as well as entities that collect substantial amounts of Personal Information from California residents. California has in the past led the US in various trends and regulations, good and bad. Freeways, Beach Boys, hippies, hipsters, car culture, bikers, early Burning Man, the music industry, and Hollywood helped define US …

Read more

GDPR Privacy by Default – Will the US Senate Follow Europe?

By Steven J. O'Neill

On May 25th, Senators Edward J. Markey (D-Mass.), Dick Durbin (D-Ill.), Richard Blumenthal (D-Conn.), and Bernie Sanders (I-Vt.) introduced a Senate resolution calling for U.S. companies and institutions covered by the European Union’s (EU) new privacy law, the General Data Protection Regulation (GDPR), to provide Americans with privacy protections included in the European law. The 5 page Resolution summarizes the GDPR as requiring: that data processors have a legal basis for processing the data of users; and that opt-in, freely given, specific, informed, and unambiguous consent from users is a primary legal basis. The Resolution is not a bill and …

Read more

The GDPR is Coming

By Steven J. O'Neill

  Does GDPR Apply in the US? Yes. GDPR (European Union General Data Protection Regulation) is a comprehensive new law protecting the data privacy of EU citizens. GDPR takes effect on May 25, 2018.  It consists of 99 articles and will have sweeping impact on U.S. enterprises. It requires that all personal data be handled according to the GDPR Data Protection Principles. These includes the famous “right to be forgotten,” as well as transparency, data portability, breach notification, information security, etc. If you have a public facing website that collects user data and operates in EU countries, it is not too late to …

Read more

The Top 10 Things to Know About GDPR

By Steven J. O'Neill
Graphic showing GDPR and padlock

The GDPR protects “personal data” of EU citizens. So, if you are only doing business outside the European Union then you don’t have to consider it at all, right? Think again. What about any business with a website?

Green Light for Defensible Data Remediation

By Steven J. O'Neill

In December 2015, the electronic discovery provisions of the Federal Rules of Civil Procedure (FRCP) were amended to substantially expand the Safe Harbor against sanctions for destruction of electronic data.  In my November 2015 white paper, C-Level Guide to Covering Your Information Governance Assets, I predicted that the amended rules signaled a pivot away from one of the main sources of eDiscovery uncertainty – the inconsistent imposition of severe sanctions for the loss of electronically stored information (ESI) relevant to dispute resolution.  The prediction holds. The prior Safe Harbor under the 2006 FRCP provided modest protections against sanctions where ESI …

Read more