On April 18, 2024, Legislative Bill 1074 for the Data Privacy Act was approved by the Governor of Nebraska. In particular, the Act lays down consumer rights, controller and processor obligations, and grants the Nebraska Attorney General power to enforce the provisions of the Act. ...
On April 11, 2024, Legislative Bill 1074 for the Data Privacy Act passed its final reading in the Nebraska State Legislature and was signed by the President/Speaker of the Legislature on the same date. This follows the bill's introduction on January 9, 2024. ...
On April 2, 2024, the California Privacy Protection Agency's (CPPA) Enforcement Division published enforcement advisory No. 2024-01 titled 'Applying Data Minimization to Consumer Requests.' The enforcement advisory addresses data minimization as a foundational principle of the California Consumer Privacy Act (CCPA) and emphasizes its...
On April 2, 2024, the California Privacy Protection Agency's (CPPA) Enforcement Division published enforcement advisory No. 2024-01 titled 'Applying Data Minimization to Consumer Requests.' The enforcement advisory addresses data minimization as a foundational principle of the California Consumer Privacy Act (CCPA) and emphasizes its...
On March 21, 2024, Jamaica’s Prime Minister, Andrew Holness, in his 2024 Budget Debate speech, indicted that Jamaica’s Data Protection Act is a key element in the rollout of Jamaica’s national ID program. “A functional Data Protection Act and operational body is a prerequisite...
On February 28, 2024, President Biden signed Executive Order 14117 (the Order) aimed at protecting Americans’ sensitive personal data and U.S. Government-related data from exploitation by “countries of concern.” This move constitutes a transformative overhaul in the U.S. approach to data regulation and creates the...
On February 28, 2024, the European Data Protection Board (EDPB) launched its 2024 coordinated enforcement action, which will focus on the right of access. In particular, the EDPB explained that in order to gauge how organizations are complying with the right of access....
The cybersecurity framework was originally aimed at critical infrastructure organizations, but it has been widely used and widely recommended and NIST highlighted that CSF 2.0 is designed to help all organizations reduce risks, regardless of sector, size, or level of security sophistication. ...
The Federal Trade Commission will require software provider Avast to pay $16.5 million and prohibit the company from selling or licensing any web browsing data for advertising purposes to settle charges that the company and its subsidiaries sold such information to third parties after promising...
The California Attorney General (AG), Rob Bonta, announced, on February 21, 2024, that they had reached a $375,000 settlement with DoorDash, Inc. (DoorDash), in relation to allegations that the company violated the California Consumer Privacy Act (CCPA) and California Online Privacy Protection Act (CalOPPA)....
US Privacy Law Updates Nebraska: Legislative Bill 308 which concerns an Act to adopt the Genetic Information Privacy Act passed the final reading in the Nebraska State Legislature and was presented to the Governor of Nebraska for signature. Virginia: House Bill 707 to amend Consumer Data Protection...
On February 9, 2024, the Third Appellate District of California vacated a trial court’s decision that held that enforcement of the California Privacy Protection Agency’s (CPPA) regulations could not commence until one year after the finalized date of the regulations. As DPSA previously reported, the...
In a shocking turn of events, a Superior Court for the County of Sacramento issued a ruling on June 30, 2023, enjoining the enforcement of the California Privacy Protection Agency’s (the “Agency’s”) California Privacy Rights Act (CPRA) modifications to the California Consumer Privacy Act (CCPA)...
The Dutch Data Protection Authority (AP) is imposing a fine of €10 million on Uber Technologies, Inc. and Uber B.V. (‘Uber’). The fine is in response to the company's failure to disclose the full details of its retention periods for data concerning European drivers, or...
UK ICO warns organizations to proactively make advertising cookies compliant after positive response to November call to action...
On January 23, 2024, the French data protection authority (CNIL) published Decision No. SAN-2023-021, as issued on December 27, 2023, in which it imposed a fine of €32 million on Amazon France for violation of the General Data Protection Regulation (GDPR) following an investigation....
Senate Bill 255 for An Act relative to the expectation of privacy was introduced, on 19 January 2023, to the New Hampshire State Senate, and thereafter referred, on 24 January 2023, to the New Hampshire Senate Judiciary Committee....
On January 8, New Jersey’s General Assembly and Senate passed a consumer privacy bill, S332, which would grant New Jersey residents several rights, and obligate controllers and processors of New Jersey residents to take action. The law is similar to consumer privacy laws passed last...
The California Privacy Protection Agency (CPPA) released its draft strategic plan on January 11, 2024, as a part of its meeting material for its board meeting on January 12, 2024. The draft plan is meant to protect consumers' privacy, ensure that businesses and consumers are...
In 2023 we saw a lot happen in the data protection and data security space. The landscape of data protection has reached new heights of complexity and importance, especially since Artificial Intelligence (AI) has taken over the spotlight. As we begin moving into 2024, it's...
In an era dominated by digital interactions and information exchange, the importance of safeguarding sensitive data has never been more critical. Data privacy breaches can lead to severe consequences, including financial losses, damage to reputation, and legal ramifications. To address these concerns, organizations are increasingly...
The California Privacy Protection Agency (CPPA) published, on 4 April 2023, the revised California Consumer Privacy Act of 2018, as amended (CCPA) Regulations, following its announcement that the California Office of Administrative Law had approved the same....
Iowa has become the sixth state in the United States to implement comprehensive consumer privacy legislation, joining California, Virginia, Colorado, Nevada, and Maine. The new law, called the Iowa Consumer Privacy Act (ICPA), was signed by Governor Kim Reynolds on March 23, 2023, and will...
California’s Attorney General, Rob Bonta, announced the state has reached a settlement of $1.2 million with beauty retailer Sephora for breaching the California Consumer Privacy Act (CCPA) where the retailer sold people’s data without informing them. After conducting an enforcement sweep of online retailers,...
The United States and the European Commission have committed to a new Trans-Atlantic Data Privacy Framework, which will foster trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union when it struck down in 2020 the Commission’s adequacy...
In a much-anticipated announcement last week, the FTC amended the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, and proposed a further amendment requiring certain financial institutions to provide the FTC with notice in the event of certain security events. Although these changes were announced after FTC...
Amendments to the federal Safeguards Rule will require U.S. auto dealerships to toughen up their information systems security to protect consumer data. In late October, the Federal Trade Commission passed amendments to the rule that made five key changes....
In a much-anticipated announcement last week, the FTC amended the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, and proposed a further amendment requiring certain financial institutions to provide the FTC with notice in the event of certain security events. Although these changes were announced after FTC...
The Court of Justice of the European Union ('CJEU') announced, on 16 July 2020, that it had issued its judgment ('the Judgment') in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('the Schrems II Case')....
U.S. Senators Roger Wicker, R-Miss., chairman of the Senate Committee on Commerce, Science, and Transportation, John Thune, R-S.D, chairman of the Subcommittee on Communications, Technology, Innovation, and the Internet, Jerry Moran, R-Kan., chairman of the Subcommittee on Consumer Protection, Product Safety, Insurance and Data Security,...
The EDPB has adopted a pragmatic stance in light of the severity of this pandemic. The EDPB has recognized the processing of special categories of personal data – specifically, information relating to individuals’ health – may be necessary to combat the outbreak, but has reminded...
On Wednesday March 11, 2020, the California Attorney General released the third draft of proposed CCPA regulations for public comment. This draft contains a series of technical corrections as well as several important changes to the 2nd draft. It should be noted, the limited number...