Source: https://buckleyfirm.com/resource-centers/privacy-and-data-security-resource-center
Timestamp: 2019-10-21 12:24:26
Document Index: 384684861

Matched Legal Cases: ['art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'arty\n9', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500', 'art 500']

Privacy and Data Security Resource Center | Buckley LLP
On September 24, the European Court of Justice held that Europe’s “right to be forgotten” online privacy law — which allows individuals to request the deletion of personal information from online sources that the individual believes infringes on their right to privacy—can be applied only in the...
Courts, Privacy/Cyber Risk & Data Security, European Union, Of Interest to Non-US Persons
On September 18, the U.S. District Court for the Northern District of California dismissed with prejudice a class action suit brought against an online payments firm and associated entities and individuals (collectively, “defendants”) for allegedly misleading investors (plaintiffs) about a 2017...
Courts, Class Action, Privacy/Cyber Risk & Data Security, Data Breach
On September 12, the CFTC issued an order against an Illinois-based futures commission merchant imposing a $1.5 million fine for allegedly failing to protect its systems from cybersecurity threats and not alerting its customers in a reasonable timeframe after a breach occurred. According to the...
Federal Issues, CFTC, Enforcement, Privacy/Cyber Risk & Data Security, Data Breach, Civil Money Penalties
State Issues, CCPA, Privacy/Cyber Risk & Data Security, Special Alerts
On September 9, the U.S. District Court for the Northern District of California entered a final judgment against a debt collection agency that was found guilty of violating the TCPA by making more than 500,000 unsolicited robocalls using autodialers. The court’s final judgment is consistent with...
Courts, TCPA, Debt Collection, Robocalls, Autodialer
On September 6, the National Institute of Standards and Technology (NIST) released a preliminary draft of the NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management to help organizations assess and reduce risks. The draft framework is designed to align with NIST’s...
Privacy/Cyber Risk & Data Security, NIST
On September 9, the U.S. District Court for the Northern District of California granted in part and denied in part a social media company’s motion to dismiss a multidistrict class action alleging the company failed to prevent third parties from accessing and misusing private data of its users, in...
Courts, Privacy/Cyber Risk & Data Security, Class Action, State Issues, Standing
On September 6, the FTC voted 5-0 to approve a final settlement under which a software provider agreed to better protect the data it collects, resolving allegations that the company failed to implement reasonable data security measures and exposed personal consumer information obtained from its...
Federal Issues, FTC, Privacy/Cyber Risk & Data Security, FTC Act, Enforcement, Settlement, Consent Order, Gramm-Leach-Bliley
On September 3, the U.S. District Court for the District of New Jersey denied a medical laboratory’s motion to dismiss, ruling that the company cannot use a Supreme Court ruling to avoid a proposed TCPA class action suit concerning allegations that it made unsolicited calls using an “autodialer.”...
Courts, TCPA, Class Action, U.S. Supreme Court, Autodialer
On September 4, the FTC and the New York Attorney General announced (see here and here ) a combined $170 million proposed settlement with the world’s largest online search engine and its video-sharing site subsidiary concerning alleged violations of the Children’s Online Privacy Protection Act (...
Federal Issues, FTC, State Attorney General, Enforcement, Privacy/Cyber Risk & Data Security, COPPA
On August 27, the U.S. District Court for the Central District of California denied a car manufacturer’s motion to dismiss a class action alleging that it violated the TCPA by sending unwanted automated text messages. According to the opinion, after a consumer visited a car dealership, she...
Courts, TCPA, Robocalls, Autodialer, Class Action
On August 28, the U.S. Court of Appeals for the 11th Circuit held that receiving one unsolicited text message is not enough of a concrete injury to establish standing under the TCPA. According to the opinion, a former client of an attorney received an unsolicited “multimedia text message” from the...
Courts, Appellate, Eleventh Circuit, Spokeo, Standing, Class Action, TCPA
FFIEC urges standardized cybersecurity approach
On August 28, the FFIEC issued a press release emphasizing the benefits of implementing a standardized cybersecurity preparedness approach. The FFIEC noted that firms who adopt a standardized approach are “better able to track their progress over time, and share information and best practices with...
Agency Rule-Making & Guidance, FFIEC, Privacy/Cyber Risk & Data Security
On August 20, the U.S. District Court for the District of New Jersey dismissed without prejudice a proposed class action alleging consumer fraud claims. Specifically, in 2017, the plaintiffs filed a complaint alleging that smart televisions manufactured by the defendants surreptitiously collected...
Courts, Class Action, Privacy/Cyber Risk & Data Security
On August 22, North Carolina Attorney General Josh Stein announced a bipartisan agreement between 51 state attorneys general and 12 voice service providers, adopting eight principles for fighting illegal robocalls and preventing consumer fraud. Under the principles, the voice providers will: (i)...
Privacy/Cyber Risk & Data Security, State Attorney General, Robocalls, FCC
On August 21, the U.S. District Court for the Central District of California issued an order granting final approval of a settlement reached between a class of California consumers and a mortgage company. The approval of the settlement resolves allegations that the company contacted delinquent...
On August 21, the Conference of State Bank Supervisors (CSBS) launched three online tools designed to assist financial institutions navigate the state regulatory landscape and protect against cyber risks. The tools are: (i) a portal of state agency guidance for nonbank financial services companies...
State Issues, CSBS, Vision 2020, Fintech, Privacy/Cyber Risk & Data Security
On August 21, the U.S. District Court for the District of Oregon upheld a $925 million jury verdict against a direct sales company in a TCPA class action lawsuit, denying the company’s motion to decertify the class. According to the opinion, the named plaintiff brought the 2015 class action lawsuit...
Courts, TCPA, Robocalls, Class Action, FCC
On August 19, the U.S. District Court for the Western District of Michigan held that a Pennsylvania-based student loan servicing agency violated the TCPA by calling the plaintiffs’ cell phones over 350 times using an automatic telephone dialing system (autodailer) after consent was revoked...
Courts, Ninth Circuit, Appellate, ACA International, TCPA, Privacy/Cyber Risk & Data Security, Student Lending
On August 9, the Illinois governor signed SB 1624 , which requires that a single data breach involving the personal information of more than 500 Illinois residents must be reported to the state attorney general. The notice must include: (i) a description of the nature of the breach of security or...
State Issues, State Legislation, Privacy/Cyber Risk & Data Security, Data Breach, State Attorney General
On August 15, the U.S. District Court for the Northern District of California entered a final approval order and judgment to resolve class action allegations claiming a security system company and its third-party dealer violated the TCPA through the use of an automatic telephone dialing system and...
Courts, TCPA, Settlement, Autodialer, Privacy/Cyber Risk & Data Security
On August 8, the U.S. Court of Appeals for the 9th Circuit affirmed a district court order certifying a class action suit that alleged a social media company’s face-scanning practices violated the Illinois Biometric Information Privacy Act (BIPA). The court found that the plaintiffs alleged a...
Courts, Ninth Circuit, Appellate, Privacy/Cyber Risk & Data Security, Class Action, Spokeo
On August 1, the FCC announced the adoption of new rules that will extend the Truth in Caller ID’s prohibitions against robocalls to caller ID spoofing of text messages and international calls, and implement measures passed last year in the RAY BAUM’s Act. As previously covered by InfoBytes , the...
Privacy/Cyber Risk & Data Security, FCC, Robocalls
On July 24, the FTC and the DOJ officially announced (see here and here ) that the world’s largest social media company will pay a $5 billion penalty to settle allegations that it mishandled its users’ personal information. As previously covered by InfoBytes , it was reported on July 12 that the...
Privacy/Cyber Risk & Data Security, FTC, DOJ, Settlement, SEC, FTC Act
U.K.’s ICO fines real estate management company for data security failures
On July 19, the United Kingdom’s Information Commissioner’s Office (ICO) issued a £80,000 fine against a London-based real estate management company for allegedly leaving over 18,000 customers’ personal data exposed for almost two years. According to the ICO, when the company transferred personal...
Privacy/Cyber Risk & Data Security, GDPR, Information Commissioner's Office
On July 18, the U.S. District Court for the Northern District of Illinois granted a rental car company’s (defendant) motion to strike class allegations in a TCPA suit over alleged robocalls. The plaintiff, whose telephone number was listed on a rental contract between his mother and the defendant...
Courts, TCPA, Autodialer, Robocalls, Class Action
On July 12, it was reported that the FTC has approved a $5 billion penalty against the world’s largest social media company for allegedly mishandling its users’ personal information. The reported settlement would be the largest privacy penalty ever levied by the agency. According to reports, the...
Privacy/Cyber Risk & Data Security, FTC, Settlement
On July 17, the FTC released a notice seeking comment on a wide range of issues related to the Children’s Online Privacy Protection Rule (COPPA Rule). The FTC last amended COPPA in 2013, and while the FTC usually reviews its rules every 10 years, the FTC notes that “[r]apid changes in technology,...
Agency Rule-Making & Guidance, FTC, COPPA, Privacy/Cyber Risk & Data Security
8th Circuit affirms reduction in TCPA statutory damages from $1.6 billion to $32 million
On July 16, the U.S. Court of Appeals for the 8th Circuit affirmed a district court’s decision to reduce a $1.6 billion award in statutory damages for TCPA violations to $32.4 million after the court determined the original award violated the Fifth Amendment’s Due Process Clause. The named...
Courts, Privacy/Cyber Risk & Data Security, Robocalls, Eighth Circuit, Appellate, TCPA, Class Action
U.K.’s ICO announces two GDPR data breach actions
On July 8 and 9, the United Kingdom’s Information Commissioner’s Office (ICO) issued two notices of its intention to fine companies for infringements of the General Data Protection Regulation (GDPR). On July 8, the ICO announced it intended to fine a U.K.-based airline £183.39M for a September 2018...
Privacy/Cyber Risk & Data Security, GDPR, Information Commissioner's Office, Of Interest to Non-US Persons
On July 8, FCC Chairman Ajit Pai proposed rules supported by a bipartisan group of more than 40 state attorneys general that would extend prohibitions against robocalls to caller ID spoofing of text messages and international calls, implementing measures passed last year in the RAY BAUM’s Act...
Privacy/Cyber Risk & Data Security, FCC, Robocalls, Ray Baum's Act
On July 2, the U.S. Court of Appeals for the D.C. Circuit reversed a district court’s ruling that a consumer lacked Article III standing to allege a violation of the Fair and Accurate Credit Transaction Act (FACTA) when a merchant included all 16 digits of her credit card account number, her full...
Courts, D.C. Circuit, Appellate, Privacy/Cyber Risk & Data Security, FACTA, Spokeo
On June 27, the FTC held its fourth annual PrivacyCon, which hosted research presentations on a wide range of consumer privacy and security issues. Following opening remarks by FTC Chairman Joseph Simons, the one-day conference featured four plenary sessions covering a number of hot topics: Session...
Privacy/Cyber Risk & Data Security, FTC, Research, COPPA, GDPR, Gramm-Leach-Bliley
On June 12, the FTC announced a settlement under which a software provider agreed to better protect the data it collects, resolving allegations that the company failed to implement reasonable data security measures and exposed personal consumer information obtained from its auto dealer clients in...
Federal Issues, FTC, Privacy/Cyber Risk & Data Security, FTC Act, Enforcement, Settlement, Consent Order
Maine enacts consumer privacy law for internet service providers
On June 6, the Maine governor signed S.P. 275/L.D. 946 , which requires certain broadband Internet access services to receive express, affirmative consent from a customer before disclosing, selling, or permitting access to a customer’s personal information. Among other things, the provisions...
State Issues, State Legislation, Privacy/Cyber Risk & Data Security, Consumer Protection
On June 6, the FCC approved a Declaratory Ruling and Notice of Proposed Rulemaking to address unwanted robocalls to consumers. The Declaratory Ruling affirms that voice service providers may block unwanted robocalls “based on reasonable call analytics, as long as their customers are informed and...
Agency Rule-Making & Guidance, Federal Issues, FCC, Robocalls
NYDFS creates Cybersecurity Division
On May 22, NYDFS announced its newly created Cybersecurity Division, led by Justin Herring as Executive Deputy Superintendent, that is, according to NYDFS, “the first of its kind to be established at a banking or insurance regulator.” The new division will focus on enforcing and issuing guidance on...
Privacy/Cyber Risk & Data Security, NYDFS
On May 28, the U.S. Court of Appeals for the 3rd Circuit, in a consolidated action, affirmed summary judgment that a health care provider database company’s (defendant) unsolicited fax did not violate the TCPA. According to the opinion, the defendant updated its database by sending unsolicited...
Courts, Appellate, Third Circuit, TCPA
On May 8, the FTC Commissioners participated in a subcommittee hearing before the House Committee on Energy and Commerce entitled, “Oversight of the Federal Trade Commission: Strengthening Protections for Americans’ Privacy and Data Security.” During the hearing, the Commissioners were questioned...
Federal Issues, FTC, U.S. House, Hearing, Privacy/Cyber Risk & Data Security, CCPA
On May 10, the New Jersey governor signed S 52 , which amends the state’s data breach notification provisions. The amendments expand the definition of “personal information” to include “user name, email address, or any other account holder identifying information, in combination with any password...
Indiana sues credit reporting agency over 2017 data breach
On May 6, the Indiana Attorney General announced a lawsuit filed against a national credit reporting agency in response to its 2017 data breach, alleging the company “chose increasing revenue over protecting the safety of consumers’ sensitive personal information.” According to the complaint , the...
State Issues, Credit Report, Privacy/Cyber Risk & Data Security, Data Breach, State Attorney General
On April 30, the Maryland governor signed HB 1154 to amend current law related to security breach notification requirements. Among other provisions, HB 1154 (i) requires businesses that own, license, or maintain computerized data that includes a resident’s personal information to conduct a...
State Issues, State Legislation, Privacy/Cyber Risk & Data Security, Data Breach
On April 30, the U.S. Court of Appeals for the 2nd Circuit held that the receipt of unsolicited text messages, absent any additional injury, is sufficient to demonstrate injury-in-fact in a TCPA class action. According to the opinion, consumers filed a class action lawsuit against a retail store...
Courts, TCPA, Appellate, Second Circuit, Spokeo, Privacy/Cyber Risk & Data Security, Class Action
On April 24, the FTC announced separate settlements with the operators of an online rewards website and a dress-up games website to resolve allegations concerning poorly implemented data security measures and Children’s Online Privacy Protection Act (COPPA) violations. According to the FTC, the...
Federal Issues, FTC, Privacy/Cyber Risk & Data Security, Data Breach, COPPA, Settlement
On April 22, the U.S. Court of Appeals for the 11th Circuit affirmed a district court’s ruling that including too many digits of a consumer’s credit card account number on a receipt was sufficient to constitute a concrete injury even if the consumer’s identity was not stolen. Under the Fair and...
Courts, Appellate, FACTA, Privacy/Cyber Risk & Data Security, Eleventh Circuit, Class Action, Settlement, Spokeo
On April 24, the U.S. Court of Appeals for the 4th Circuit vacated a district court’s decision to grant summary judgment in favor of the FCC, concluding that an exemption under the TCPA that allows debt collectors to use an autodialer to contact individuals on their cell phones when collecting...
Courts, Fourth Circuit, Appellate, TCPA, Autodialer, FCC
On April 16, the U.S. District Court for the Eastern District of Pennsylvania granted in part and denied in part a telemarketing company’s motion to dismiss, concluding that the plaintiff did not have standing to bring some of his claims under the TCPA. According to the opinion, the plaintiff filed...
Courts, TCPA, Do Not Call Registry, Autodialer
On April 16, the U.S. District Court for the Northern District of California granted final approval to a $7.5 million class action settlement resolving allegations that a payment processor and its sales representative violated the TCPA by using an autodialer for telemarketing purposes without first...
Courts, TCPA, Payment Processors, Class Action, Settlement, Autodialer
On April 4, the Arkansas governor signed SB 514 , which establishes a process for state regulation of telecommunications service providers and third-party spoofing providers, and stiffens criminal penalties for persons who engage in illegal robocalling and spoofing practices. The act reclassifies “...
State Issues, State Legislation, Privacy/Cyber Risk & Data Security, Robocalls, State Attorney General
Maryland Financial Consumer Protection Commission to disband June 30
On April 2, 10 out of the 11 Maryland Senate Finance Committee members voted in favor of a motion to consider SB 786 as “unfavorable.” The bill would have extended the effectiveness of the Maryland Financial Consumer Protection Commission (MFCPC) through June 30, 2021; however, because the bill...
State Issues, State Legislation, Consumer Protection
On March 29, the U.S. District Court for the Northern District of Illinois granted a telecommunication company’s summary judgment motion in a putative TCPA class action involving text messages. The plaintiff asserted that the company sent him text messages asking survey questions, even though he...
Courts, TCPA, Class Action, Autodialer, ACA International
District Court: “Ringless” voicemail is a “call” under the TCPA
On March 25, the U.S. District Court for the Southern District of Florida granted in part and denied in a part a motion to dismiss a putative class action alleging that an auto dealer violated the TCPA by using a “ringless” voicemail platform to leave pre-recorded telemarketing voicemails on...
Courts, TCPA, First Amendment, Spokeo, Class Action
On March 26, the FTC announced settlements issued against four separate operations for allegedly placing billions of illegal robocalls to consumers selling auto warranties, debt-relief services, home security systems, veterans’ charities and Google search results services. The actions are part of...
Federal Issues, FTC, Settlement, Robocalls, Deceptive, Debt Relief, Autodialer, FTC Act, Telemarketing Sales Rule
North Dakota expands personal identifying information law
On March 20, the North Dakota governor signed SB 2262 , which, among other things, amends the state’s law covering the unauthorized use of personal identifying information (PII). Specifically, the bill expands the definition of PII to include, (i) an individual’s payment card information; (ii) an...
Virginia requires breach of personal information notification
On March 18, the Virginia governor signed HB 2396 , which amends the Code of Virginia and requires an individual or entity owning or licensing computerized data that includes personal information to disclose all data breaches without “unreasonable delay” to the Virginia Attorney General and any...
On March 15, the FTC released its annual report highlighting the agency’s privacy and data security work in 2018. Among other items, the report highlights consumer-related enforcement activities in 2018, including: an expanded settlement with a global ride-sharing company over allegations that the...
Privacy/Cyber Risk & Data Security, FTC, Enforcement, Settlement, FCRA, Consumer Finance
On March 5, Attorneys General from all 50 states, as well as from the District of Columbia, Guam, Puerto Rico, and the U.S. Virgin Islands, sent a letter to the Senate Committee on Commerce, Science, and Transportation supporting a recently introduced bipartisan bill to combat illegal robocalls...
Privacy/Cyber Risk & Data Security, State Attorney General, State Issues, Consumer Complaints, FCC, Federal Legislation, Robocalls, Consumer Protection
On March 5, the FTC released proposed amendments to two rules that protect the privacy and security of customer data held by financial institutions. The agency seeks comments on proposed changes to the Safeguards Rule and the Privacy Rule under the Gramm-Leach-Bliley Act. The Safeguards Rule...
Federal Issues, FTC, Consumer Finance, Privacy/Cyber Risk & Data Security, Gramm-Leach-Bliley, Safeguards Rule, Privacy Rule, Dodd-Frank
On February 26, the U.S. District Court for the Middle District of Florida granted final approval and class certification, following a final approval hearing, to a settlement resolving class action allegations concerning a data breach involving an international fast-food chain. According to the...
Courts, Privacy/Cyber Risk & Data Security, Data Breach, Class Action, Settlement
On February 25, the California Attorney General announced a legislative proposal that would amend several aspects of the California Consumer Privacy Act (CCPA). The CCPA was originally enacted in June 2018 (covered by a Buckley Special Alert ) and subsequently amended in September 2018 (covered by...
State Issues, Privacy/Cyber Risk & Data Security, State Legislation, State Attorney General, CCPA
On February 27, the FTC announced a $5.7 million settlement with the operators of a video social networking app concerning alleged violations of the Children’s Online Privacy Protection Act (COPPA). Among other things, the FTC claims the operators failed to provide parents notice of its information...
Federal Issues, FTC, Enforcement, Settlement, Civil Money Penalties, COPPA, Privacy/Cyber Risk & Data Security
On February 14, the FCC released a notice of proposed rulemaking intended to strengthen its rules against caller ID spoofing and expand the agency’s enforcement efforts against illegal spoofed text messages and phone calls, including those from overseas. The proposed rules would enact requirements...
Privacy/Cyber Risk & Data Security, FCC, Robocalls, Enforcement, Truth in Caller ID Act
On February 13, Senate Committee on Banking, Housing, and Urban Affairs Chairman Mike Crapo (R-ID) and Ranking Member Sherrod Brown (D-OH) invited stakeholder feedback on “the collection, use and protection of sensitive information from financial regulators and private companies” as a means of...
Privacy/Cyber Risk & Data Security, Senate Banking Committee, Federal Legislation, Consumer Protection, Fair Credit Reporting Act
On February 13, the U.S. District Court for the District of Nevada rejected a cloud communication company’s motion to dismiss a TCPA class action. According to the opinion, the plaintiffs’ alleged the company “collaborated as to the development, implementation, and maintenance of [a] telemarketing...
Courts, TCPA, State Issues, Standing, Privacy/Cyber Risk & Data Security, FCC
On February 11, a bipartisan group of 29 state Attorneys General, the District of Columbia Attorney General, and an official from the Hawaii Office of Consumer Protection, responded to the FTC’s request for comment on whether the agency should make changes to its identity theft detection rules (the...
State Issues, FTC, Identity Theft, RFI, State Attorney General, Privacy/Cyber Risk & Data Security
On February 8, the U.S. District Court for the Eastern District of Virginia granted final approval to a $2.5 million putative class action settlement resolving allegations that a student loan servicer violated the TCPA by using an autodialer to contact student borrowers’ credit references without...
Courts, Student Lending, Autodialer, Settlement, Attorney Fees
On February 1, the U.S. District Court for the Eastern District of Missouri issued an order referring the parties in a putative TCPA class action to mediation. The plaintiff’s complaint alleges that the defendant’s insurance company sent her text messages without her consent using an automatic...
Courts, TCPA, Autodialer, Mediation, FCC, Privacy/Cyber Risk & Data Security
On February 2, NYDFS updated its answers to FAQs regarding 23 NYCRR Part 500, which established cybersecurity requirements for banks, insurance companies, and other financial services institutions. (See here for previous InfoBytes coverage on updates to the FAQs.) Among other things, the update...
Privacy/Cyber Risk & Data Security, NYDFS, 23 NYCRR Part 500, State Issues, Compliance
On January 31, NYDFS issued a reminder for regulated entities that the final deadline for implementing NYDFS’s cybersecurity regulation ends March 1. Under the new regulation, banks, insurance companies, mortgage companies, money transmitters, licensed lenders and other financial services...
Privacy/Cyber Risk & Data Security, NYDFS, 23 NYCRR Part 500, State Issues, Third-Party
On January 28, the U.S. District Court for the Northern District of California denied preliminary approval of a proposed class action settlement after identifying several deficiencies with the deal. The proposed settlement was intended to resolve allegations concerning security failures by a global...
Courts, Class Action, Settlement, Data Breach
On January 22, the Financial Industry Regulatory Authority (FINRA) issued new guidance on areas member firms should consider when seeking to improve their compliance, supervisory, and risk management programs. The 2019 FINRA Risk Monitoring and Examination Priorities Letter (2019 Priorities Letter...
Agency Rule-Making & Guidance, Fintech, FINRA, Cryptocurrency, Examination, FinCEN, CDD Rule, Privacy/Cyber Risk & Data Security, Bank Secrecy Act
On January 16, the U.S. District Court for the Southern District of California granted in part and denied in part a ride-sharing company’s motion to dismiss a proposed TCPA class action, holding that the plaintiff sufficiently alleged the company is vicariously liable for the sent text messages but...
Courts, TCPA, Class Action, Autodialer
On January 10, the Massachusetts Governor signed HB 4806 , following the House and Senate’s adoption of amendments to the bill. The bill, which is effective April 10, amends current law related to security breaches and the protection of consumer financial and credit information. Among other...
State Issues, State Legislation, Credit Reporting Agency, Privacy/Cyber Risk & Data Security, Security Freeze, Data Breach
On January 8, the U.S. District Court for the Northern District of Illinois denied a bank’s motion to dismiss claims that it had obtained a credit report without a permissible purpose, ruling that the allegations rise above a mere procedural violation of the FCRA. According to the opinion, the...
Courts, Privacy/Cyber Risk & Data Security, Spokeo, Credit Report, FCRA
On January 8, a national retailer reached a $1.5 million multistate settlement with 43 states and the District of Columbia to resolve an investigation following a 2013 data breach of customer payment card information. According to the Illinois Attorney General’s announcement , the retailer will...
State Issues, Privacy/Cyber Risk & Data Security, State Attorney General, Credit Cards, Data Breach, Settlement
On December 31, 2018, the U.S. District Court for the District of Utah granted in part and denied in part a national bank’s motion to dismiss putative class action claims concerning the bank’s use of confidential customer information to open deposit and credit card accounts as part of its incentive...
Courts, Incentive Compensation, Privacy/Cyber Risk & Data Security, Spokeo
On December 20, the U.S. District Court for the District of New Jersey granted a student loan company’s motion for summary judgment, holding that the plaintiff failed to establish the company’s phone system qualified as an automated telephone dialing system (autodialer) under the TCPA. The...
Courts, TCPA, Autodialer, Student Lending, Appellate, Third Circuit
On December 19, the Massachusetts Attorney General announced a $155,000 settlement with a California-based payment processor resolving allegations that the company exposed consumers’ personal information online in violation of consumer protection and data security laws. According to the...
State Issues, State Attorney General, Data Breach, Privacy/Cyber Risk & Data Security, Settlement
On December 10, the U.S. District Court for the District of New Jersey denied a medical laboratory’s motion to dismiss a putative TCPA class action against the company, holding the plaintiff sufficiently alleged the equipment used to make unsolicited calls qualified as an “autodialer.” According to...
Courts, TCPA, Autodialer, Class Action, Third Circuit, Appellate
On December 13, the Department of Veterans Affairs (VA) released Circular 26-18-28 , which outlines the VA’s Loan Guaranty Service Red Flag Rules Policy to aid in the detection, prevention, and mitigation of identity theft for certain loans financed by the VA (known as, “Vendee loans”), Native...
Agency Rule-Making & Guidance, Department of Veterans Affairs, FTC, Identity Theft, Privacy/Cyber Risk & Data Security
New York Attorney General settles with five companies over mobile app security failures
On December 14, the New York Attorney General announced settlements with five companies, including a global payment processor, a credit reporting agency, and a credit score company, whose mobile apps allegedly failed to secure sensitive user data. As part of the Attorney General’s initiative to...
State Issues, State Attorney General, Privacy/Cyber Risk & Data Security, Settlement
On December 6, Virginia Attorney General Mark Herring announced he is joining a bipartisan group of 40 state Attorneys General to stop or reduce “annoying and dangerous” robocalls. The multistate group is reviewing, through meetings with several major telecom companies, the technology the companies...
On November 6, the FCC announced that it sent letters to voice providers urging them to participate in “traceback” efforts to help the FCC identify the source of illegal spoofed robocalls. The FCC released copies of the letters that it sent to eight voice providers that are not currently assisting...
Federal Issues, FCC, Robocalls, Enforcement, Privacy/Cyber Risk & Data Security
On November 5, the Federal Financial Institutions Examination Council (FFIEC) members issued a joint statement alerting financial institutions to the potential impact that the U.S. Treasury Department’s Office of Foreign Assets Control’s (OFAC) recent actions under its Cyber-Related Sanctions...
Financial Crimes, OFAC, Sanctions, FFIEC, OCC, Russia, International, Third-Party, Privacy/Cyber Risk & Data Security
On October 30, a third-party debt collector and its affiliates (defendants) entered into a stipulated final judgment in the Superior Court of California to settle a consumer protection lawsuit brought by the state of California over allegedly illegal debt collection calling practices. According to...
Courts, State Issues, Debt Collection, FDCPA, TCPA, Autodialer
On October 30, the U.S. District Court for the Western District of Wisconsin denied a company’s motion to dismiss allegations that it violated the TCPA when it used a predictive dialer to try to collect a debt from the plaintiff. According to the opinion, the plaintiff alleged the company called...
Courts, Robocalls, TCPA, Autodialer, ACA International
On October 26, the FTC announced it will hold four days of public hearings in December 2018 and February 2019 to examine the Commission’s authority to deter unfair and deceptive conduct in data security and privacy matters as part of its broader series of hearings on “Competition and Consumer...
Privacy/Cyber Risk & Data Security, FTC, Consumer Protection, State Attorney General
On October 25, NYDFS provided a new update to its answers to FAQs relating to 23 NYCRR Part 500, which took effect March 1, 2017, and establishes cybersecurity requirements for banks, insurance companies, and other financial services institutions. The original promulgation of the FAQs was covered...
Privacy/Cyber Risk & Data Security, NYDFS, 23 NYCRR Part 500, State Issues
On October 26, the FTC announced its final approval of an expanded settlement with a global ride-sharing company over allegations that the company violated the FTC Act by deceiving consumers regarding the company’s privacy and data practices. Specifically, the company allegedly failed to closely...
Privacy/Cyber Risk & Data Security, FTC, Settlement, Data Breach, FTC Act, Third-Party
On October 17, as part of its fall 2018 rulemaking agenda , the FTC announced that it plans to review potential updates to federal privacy rules on how banks protect consumer data. The planned recommendation —scheduled to be presented to FTC commissioners at the end of November—will incorporate...
Agency Rule-Making & Guidance, FTC, Rulemaking Agenda, Privacy/Cyber Risk & Data Security, Safeguards Rule, Gramm-Leach-Bliley, EGRRCPA
On October 10, the Senate Committee on Commerce, Science, and Transportation held the second in a series of hearings on the subject of consumer data privacy safeguards. The hearing entitled “Consumer Data Privacy: Examining Lessons From the European Union’s General Data Protection Regulation and...
Privacy/Cyber Risk & Data Security, Data Breach, U.S. Senate, GDPR, State Attorney General, State Legislation, Enforcement, CCPA
On October 8, a collation of 35 state Attorneys General submitted reply comments in response to a public notice seeking ways the FCC could create rules that will enable telephone service providers to block illegal robocalls. In their comments to the FCC, the coalition encourages the FCC to...
State Issues, State Attorney General, FCC, Robocalls, Privacy/Cyber Risk & Data Security
On October 3, the FCC’s Consumer and Governmental Affairs Bureau released a notice seeking comment on the interpretation of the TCPA in light of a recent 9th Circuit decision, which broadened the definition of an automatic telephone dialing system (autodialer) under the TCPA. As previously covered...
Federal Issues, FCC, Autodialer, TCPA, Ninth Circuit, Appellate, ACA International
On September 28, the DOJ issued updated guidance originally presented the day before at a cybersecurity roundtable discussion on best practices for companies when responding to and reporting cybersecurity incidents. Officials from the DOJ, National Security Council, and the Department of Homeland...
Privacy/Cyber Risk & Data Security, DOJ, Data Breach
On September 26, the SEC announced a settlement with an Iowa-based broker-dealer and investment advisement company, which agreed to pay $1 million to resolve allegations that the company violated the Safeguards Rule and the Identity Theft Red Flags Rule arising out of the company’s failure to...
Privacy/Cyber Risk & Data Security, SEC, Enforcement, Settlement
On September 26, the Senate Committee on Commerce, Science, and Transportation held a hearing entitled “Examining Safeguards for Consumer Data Privacy” to discuss whether federal lawmakers should write a broad federal online privacy law in the wake of the European Union’s General Data Protection...
Privacy/Cyber Risk & Data Security, U.S. Senate, Data
On September 26, the California Attorney General announced that a global ride-sharing company reached a joint settlement with all 50 state Attorneys General and the District of Columbia for $148 million to resolve allegations that the company failed to safeguard user data and to notify authorities...
State Issues, Privacy/Cyber Risk & Data Security, State Attorney General, Settlement, Data Breach
Department of Commerce requests comments on new federal approach to consumer privacy rules
On September 26, the National Telecommunications and Information Administration (NTIA) published a notice and request for comments on behalf of the Department of Commerce seeking input from stakeholders on ways to address consumer privacy concerns while protecting prosperity and innovation. The...
Federal Issues, Department of Commerce, Privacy/Cyber Risk & Data Security, GDPR, FTC
On September 26, the FCC announced that it fined a telemarketer and associated companies more than $82 million for using allegedly illegal caller ID spoofing to market and generate leads for health insurance sales in violation of the Truth in Caller ID Act (the Act). The Act prohibits telemarketers...
Federal Issues, FCC, Robocalls, Lead Generation, Marketing, Privacy/Cyber Risk & Data Security
On September 26, the OCC’s Committee on Bank Supervision released its bank supervision operating plan (Plan) for fiscal year 2019. The Plan outlines the agency’s supervision priorities and specifically highlights the following supervisory focus areas: (i) cybersecurity and operational resiliency; (...
Federal Issues, OCC, Risk Management, Bank Secrecy Act, Anti-Money Laundering, Bank Compliance, Privacy/Cyber Risk & Data Security
On September 23, the California governor signed SB 1121 , a bill amending the California Consumer Privacy Act of 2018 (the Act) enacted on June 28. (See Buckley Sandler Special Alert here .) The Act, which carries an effective date of January 1, 2020, on most provisions, sets forth various...
Privacy/Cyber Risk & Data Security, State Issues, State Legislation, Data Breach, State Attorney General, CCPA
Court sends class action TCPA suit against global ride-sharing company to arbitration
On September 20, the U.S. District Court for the Northern District of Illinois granted a global ride-sharing company’s motion for summary judgment, ruling that a user had consented to arbitrate any disputes when he signed up for an account with the company. Specifically, the named plaintiff of the...
Courts, Arbitration, TCPA, Class Action
On September 19, the California governor signed AB 1859 , which requires a credit reporting agency “that owns, licenses, or maintains personal information about a California resident” or a third party that maintains such personal information on behalf of a credit reporting agency to implement...
State Issues, State Legislation, Credit Reporting Agency, Privacy/Cyber Risk & Data Security, Data Breach
On September 24, the U.S. District Court for the Middle District of Florida held that a hotel calling system, which required human intervention before a call was placed, does not qualify as an automatic telephone dialing system (autodialer) under the TCPA. The plaintiff filed the putative class...
On September 20, the U.S. Court of Appeals for the 9th Circuit vacated the district court’s order granting summary judgment in a TCPA action, in light of the recent D.C. Circuit opinion in ACA International v. FCC (covered by a Buckley Sandler Special Alert ). The case arises from a plaintiff’s...
Courts, ACA International, Ninth Circuit, TCPA, Autodialer, D.C. Circuit, Appellate
On September 21, the FTC announced the nationwide availability of free security freezes and one-year fraud alerts, which were authorized under the Economic Growth, Regulatory Relief, and Consumer Protection Act (EGRRCPA). Specifically, Section 301 of EGRRCPA prohibits a national credit reporting...
Federal Issues, FTC, Security Freeze, Fraud, Credit Reporting Agency, EGRRCPA, S. 2155, Privacy/Cyber Risk & Data Security
On September 12, the New Mexico Attorney General announced the filing of a lawsuit against a group of technology companies for allegedly designing and marketing mobile gaming applications (apps) targeted towards children that contain illegal tracking software. The complaint asserts that the...
Privacy/Cyber Risk & Data Security, State Issues, State Attorney General, COPPA
California governor signs amendments requiring the furnishing of customer account information associated with certain crime reports
On September 6, the governor of California signed amendments to the California Right to Financial Privacy Act to provide various state and local agencies—including the police, sheriff’s department, or district attorney in the state—the authorization to request information from financial...
New Jersey Attorney General announces settlement with data management software company over auto dealer data breach claims
On September 7, the New Jersey Attorney General announced a settlement with an Iowa-based data management software company related to an alleged data breach that exposed the personally identifiable information (PII) of auto dealership customers across the country. According to the consent order ,...
State Issues, Privacy/Cyber Risk & Data Security, Data Breach, State Attorney General
Court approves $8.5 million class action settlement with global money service for alleged TCPA violations
On August 31, the U.S. District Court for the Northern District of Illinois approved an $8.5 million class action settlement resolving allegations that a global money service violated the Telephone Consumer Protection Act (TCPA) by sending unsolicited text messages to class members. While the court...
Courts, Settlement, TCPA, Autodialer, Privacy/Cyber Risk & Data Security
NYDFS launches online registration form for credit reporting agencies to comply with new regulation
On August 22, the New York Department of Financial Services (NYDFS) announced an online registration form for credit reporting agencies (CRAs) to comply with the state’s final regulation that requires CRAs with significant operations in New York to register with NYDFS and to comply with New York’s...
State Issues, NYDFS, Credit Reporting Agency, Privacy/Cyber Risk & Data Security
Court approves $115 million settlement for health insurer data breach
On August 15, the U.S. District Court for the Northern District of California issued final approval for a $115 million class action settlement to resolve claims stemming from a large health insurer’s 2015 data breach. As previously covered by InfoBytes , in June 2017, the health insurer and...
Privacy/Cyber Risk & Data Security, Courts, Data Breach, Settlement
On August 8, the New York Department of Financial Services (NYDFS) issued a reminder for regulated entities required to comply with the state’s cybersecurity requirements under 23 NYCRR Part 500 that the third transitional period ends September 4. Banks, insurance companies, and other financial...
State Issues, NYDFS, Privacy/Cyber Risk & Data Security, 23 NYCRR Part 500
On August 2, the U.S. District Court for the District of New Jersey denied a mortgage company’s motions to dismiss in two putative class actions (opinions available here and here ) alleging violations of the Telephone Consumer Protection Act (TCPA) for unsolicited phone calls. In both cases, the...
Courts, ACA International, TCPA, Autodialer, Class Action
On August 10, the CFPB issued final amendments to Regulation P, which implements the Gramm-Leach-Bliley Act and provides, among other things, exemptions for financial institutions from sending annual privacy notices to consumers provided they meet certain conditions. The final rule —originally...
Agency Rule-Making & Guidance, CFPB, Regulation P, Gramm-Leach-Bliley, Privacy/Cyber Risk & Data Security
FTC seeks comments on possible adjustments to privacy and data security rulemaking authority
On August 6, the FTC published a request for comments in the Federal Register —in advance of a series of 15 to 20 public hearings scheduled to start this September—on whether the agency should make adjustments to competition and consumer protection law, enforcement priorities, and policy in light...
Privacy/Cyber Risk & Data Security, FTC, Federal Register, FTC Act
On July 12, the Conference of State Bank Supervisors (CSBS) issued a statement to the Senate Banking Committee, offering support for legislation that would “enhance state and federal regulators’ ability to coordinate examinations of, and share information on, banks’ [third-party technology service...
State Issues, State Regulators, CSBS, Federal Legislation, Third-Party, Privacy/Cyber Risk & Data Security
On July 2, the FTC announced it had reached a settlement with a California-based company over allegations that it falsely claimed participation in the European Union-U.S. Privacy Shield framework, EU-U.S. Privacy Shield . According to the FTC, the company’s false claim that it was in the process of...
Privacy/Cyber Risk & Data Security, FTC, Enforcement, Settlement
Privacy/Cyber Risk & Data Security, State Issues, Special Alerts, CCPA
On June 27, the New York Department of Financial Services (NYDFS) announced that a major credit reporting agency has agreed to cybersecurity and internal control corrective action following its 2017 data breach, which reportedly affected 143 million American consumers. The consent order , which was...
Privacy/Cyber Risk & Data Security, State Issues, Data Breach, NYDFS
On June 25, the New York governor announced the issuance by the New York Department of Financial Services (NYDFS) of a final regulation that requires consumer credit reporting agencies (CRAs) with significant operations in New York to register with NYDFS and to comply with New York’s cybersecurity...
District Court grants preliminary approval of TCPA class action settlement
On June 25, the U.S. District Court for the Northern District of California issued an order preliminarily approving a class action settlement between class members and a student loan management enterprise (defendants) accused of violating the Telephone Consumer Protection Act (TCPA) by using an...
Courts, Student Lending, Settlement, TCPA, Class Action
On June 26, the U.S. Court of Appeals for the 3rd Circuit affirmed summary judgment for a global internet media company holding that the plaintiff failed to show the equipment the company used fell within the definition of “automatic telephone dialing system” (autodialer) based the recent holding...
Courts, TCPA, Autodialer, FCC, Third Circuit, Appellate, ACA International
On June 14, the governor of Rhode Island signed S2562 , which prohibits consumer reporting agencies from charging a fee for security freeze services, including the placement, removal, or temporary lifting of a security freeze for a consumer. The law also prohibits the charging of a fee in...
Privacy/Cyber Risk & Data Security, Security Freeze, State Issues, State Legislation, Credit Reporting Agency
On June 13, the U.S. Court of Appeals for the 8th Circuit affirmed the district court’s ruling approving a $17 million class settlement to resolve consumer claims related to a 2013 data breach, which resulted in the compromise of at least 40 million credit cards and theft of personal information of...
Courts, Appellate, Eighth Circuit, Class Action, Data Breach, Privacy/Cyber Risk & Data Security
On June 8, the Illinois governor approved HB 4095 , which amends the Consumer Fraud and Deceptive Business Practices Act to prohibit consumer reporting agencies (CRAs) from charging consumers a fee for placing, removing, or temporarily lifting a security freeze. The act takes effect immediately...
Privacy/Cyber Risk & Data Security, State Issues, State Legislation, Security Freeze, Data Breach, Credit Reporting Agency
On June 6, the U.S. District Court for the Southern District of Florida granted the FTC’s request for preliminary injunction against an individual defendant and the company he owns and manages (stipulating defendants) for allegedly violating the FTC Act by making robocalls to small business owners...
Courts, FTC, Robocalls, Privacy/Cyber Risk & Data Security, FTC Act
On June 6, the U.S. Court of Appeals for the 11th Circuit vacated an FTC cease and desist order (Order) that directed a Georgia-based medical testing laboratory to overhaul its data security program, ruling that the Order was unenforceable because it lacked specifics on how the overhaul should be...
Courts, FTC, Privacy/Cyber Risk & Data Security, Eleventh Circuit, Appellate, FTC Act
On June 5, the FTC announced charges filed against two individuals and their related operations (defendants) for allegedly facilitating billions of robocalls to consumers across the country through a telephone dialing platform in violation of the FTC Act, the Telemarketing and Consumer Fraud and...
Privacy/Cyber Risk & Data Security, FTC, Robocalls, FTC Act, Telemarketing Sales Rule, Telemarketing and Consumer Fraud and Abuse Prevention Act
On May 29, the Colorado governor signed HB1128 , which significantly expands Colorado’s consumer data protection laws to include a broader definition of personal information and a 30-day notice requirement regarding data breaches. The law, which is effective on September 1, requires covered...
Privacy/Cyber Risk & Data Security, State Issues, State Legislation, Data Breach, Consumer Protection
On May 20, the Louisiana governor signed SB361 to amend the state’s existing data breach notification law. The amendments require entities conducting business in the state or that own or license computerized data to (i) “implement and maintain reasonable security procedures and practices...
Privacy/Cyber Risk & Data Security, State Issues, State Legislation, Security Freeze, Data Breach
On May 21, the U.S. District Court for the Southern District of California denied a plaintiff’s motion for summary judgment against a solar company that she claimed made multiple unwanted robocalls to her cell phone, holding that questions remained about the accuracy of a report identifying the...
Courts, TCPA, Class Action, Robocalls, Privacy/Cyber Risk & Data Security
On May 22, a Vermont bill, established to regulate data brokers and provide consumers with protections against companies that collect, analyze, and sell their personal information, was enacted without the governor’s signature. Among other things, H.764 : (i) requires data brokers to pay a $100 fee...
Privacy/Cyber Risk & Data Security, State Issues, State Legislation, Data Breach, Data Brokers
On May 19, the Minnesota governor signed HF1243 , which, effective immediately, prohibits credit reporting agencies for charging a fee for the placement, removal, or temporary lift of a security freeze. The law previously allowed for a fee of $5.00. Additionally, effective January 1, 2019, the law...
State Issues, Credit Reporting Agency, Security Freeze, State Legislation, Privacy/Cyber Risk & Data Security
On May 15, the Maryland governor signed SB 202 , which prohibits consumer reporting agencies from charging consumers, or protected consumers’ representatives, a fee for the placement, removal, or temporary lift of a security freeze. Previously, Maryland allowed for a fee, in most circumstances, of...
State Issues, State Legislation, Credit Reporting Agency, Security Freeze, Privacy/Cyber Risk & Data Security
On May 14, the U.S. District Court for the District of Arizona granted an internet domain provider’s motion for summary judgment, holding that the platform used by the company to send text message advertisements did not qualify as an “autodialer” under the Telephone Consumer Protection Act (TCPA)...
Courts, TCPA, Privacy/Cyber Risk & Data Security, Autodialer, ACA International
On April 27, the U.S. Court of Appeals for the D.C. Circuit dismissed a challenge to a November 2016 FTC staff letter , which announced the FTC would treat calls using soundboard technology as robocalls. According to the D.C. Circuit opinion, the FTC’s 2016 staff letter rescinded a 2009 staff...
Courts, D.C. Circuit, Appellate, FTC, Robocalls, Privacy/Cyber Risk & Data Security
Court preliminarily approves $80 million settlement for shareholders after global internet company data breach
On May 9, the U.S. District Court for the Northern District of California granted a preliminary approval of a settlement between a global internet media company and its shareholders over alleged securities law violations related to cybersecurity breaches in 2013 and 2014. The $80 million settlement...
Privacy/Cyber Risk & Data Security, Securities, Data Breach, Settlement, SEC
On May 8, Maryland governor Larry Hogan signed HB848 , which expands Maryland’s authority over Credit Reporting Agencies (CRAs) by requiring CRAs to develop a secure system to process electronic requests for placing, lifting, or removing a security freeze. Additionally, the law expands the...
State Issues, Credit Reporting Agency, Security Freeze, Privacy/Cyber Risk & Data Security
On May 7, FDIC Chairman, Martin J. Gruenberg, spoke at the Forum on the Use of Technology in the Business of Banking about the importance of understanding the ways in which emerging technology is positively affecting banking operations, while also recognizing associated risk management challenges...
Fintech, FDIC, Consumer Finance, Risk Management
FTC settles with cellphone manufacturer over data security issues
On April 30, the FTC and a Florida cellphone manufacturer entered into a settlement over allegations that the manufacturer allowed third party data collection from customer phones after falsely claiming data collection was limited only to information needed by the third parties to perform requested...
Privacy/Cyber Risk & Data Security, Federal Issues, FTC, Third-Party
9th Circuit denies online retailer’s petition for full panel review of decision on standing in data breach case
On April 20, the U.S. Court of Appeals for the 9th Circuit denied an online retailer’s request to have the full bench reconsider the court’s March 8 ruling, which ruling held that the increased risk of fraud or identity theft from a data breach gave consumers Article III standing to sue. As...
Courts, Ninth Circuit, Appellate, Privacy/Cyber Risk & Data Security, Data Breach, Class Action, U.S. Supreme Court
On April 16, the FDIC’s Office of Inspector General (OIG) released its Special Inquiry Report —“The FDIC’s Response, Reporting, and Interactions with Congress Concerning Information Security Incidents and Breaches”—which contains findings from an examination of the FDIC’s practices and policies...
Privacy/Cyber Risk & Data Security, FDIC, OIG, Data Breach, Congress, Senate Banking Committee
On April 18, the House passed H.R. 2905 by a vote of 403-3. The “Justice for Victims of IRS Scams and Identity Theft Act of 2017,” would direct the DOJ and the Treasury Department to submit reports to Congress detailing identity theft prosecutions. The DOJ’s report must contain the number of...
Federal Issues, Federal Legislation, Privacy/Cyber Risk & Data Security, U.S. House, Identity Theft
On April 16, the National Institute of Standards and Technology (NIST) announced the release of enhancements to its cybersecurity framework guidance that critical infrastructures, including the financial services industry, should voluntarily follow to mitigate cybersecurity risk. Updates to...
Privacy/Cyber Risk & Data Security, NIST, Risk Management
On April 12, the Kansas governor signed HB 2580 , which amends existing law to prohibit consumer reporting agencies (CRAs) from charging a fee to a consumer for placing, temporarily lifting, or removing a security freeze on his or her credit report. Moreover, it prevents CRAs from charging fees for...
Privacy/Cyber Risk & Data Security, State Issues, State Legislation, Data Breach, Security Freeze
On April 11, the Arizona governor signed HB 2154 to amend the state’s existing data breach notification law. The amendments require entities conducting business in the state that maintain, own, or licenses unencrypted and unredacted computerized data to conduct a reasonable investigation of...
On April 10, the Federal Financial Institutions Examination Council (FFIEC) members issued a joint statement advising financial institutions to consider the role of cyber insurance as a component of their overall risk management programs in light of the increasing number of sophisticated cyber-...
Federal Issues, FFIEC, Privacy/Cyber Risk & Data Security, Cyber Insurance, Risk Management
9th Circuit amended opinion holds company not vicariously liable under TCPA
On April 4, the U.S. Court of Appeals for the 9th Circuit issued an amended opinion to further affirm a district court’s decision to grant summary judgment in favor of a defendant concerning allegations that it was vicariously liable for telemarketing activity in violation of the Telephone Consumer...
Privacy/Cyber Risk & Data Security, Courts, TCPA, Appellate, Ninth Circuit
On April 2, a state court judge denied a credit reporting agency’s motion to dismiss claims for violations of state data security regulations. The court stated that while the “mere existence of data breach” does not translate into violations of the state data security regulations, the Massachusetts...
Privacy/Cyber Risk & Data Security, Courts, State Attorney General, State Issues, Data Breach, Credit Reporting Agency
On March 29, the Colorado governor signed HB 1233 , which authorizes a parent or legal guardian to request a credit reporting agency place a security freeze on a protected consumer’s credit file; the law defines protected person to include a minor under 16 years of age or an individual who is a...
State Issues, State Legislation, Security Freeze, Data Breach, Privacy/Cyber Risk & Data Security, Credit Reporting Agency
On March 28, the Alabama governor signed SB 318 , The Alabama Data Breach Notification Act of 2018 (Act), which requires entities doing business in the state to (i) notify consumers within 45 days if their personal data has been compromised in a data breach; and (ii) notify the state Attorney...
On March 23, the Treasury Department’s Office of Foreign Assets Control (OFAC), in coordination with the DOJ, imposed additional sanctions on an Iranian entity and 10 Iranian nationals, pursuant to Executive Order 13694 , for conducting malicious cyberattacks against hundreds of U.S. and third-...
Financial Crimes, OFAC, Sanctions, International, Department of Treasury, Privacy/Cyber Risk & Data Security, Iran
On March 23, the New York Department of Financial Services (NYDFS) provided a second update to its answers to FAQs relating to 23 NYCRR Part 500, which took effect March 1, 2017 and establishes cybersecurity requirements for banks, insurance companies, and other financial services institutions. The...
Privacy/Cyber Risk & Data Security, State Issues, NYDFS, Compliance, 23 NYCRR Part 500
On March 23, the Governor of Tennessee signed HB 1486 , which prohibits credit reporting agencies from charging a fee to a consumer for the placement or removal of a security freeze if the need to place or remove the security freeze was caused by the credit reporting agency. Tennessee already...
State Issues, Security Freeze, Credit Reporting Agency, Data Breach, State Legislation, Privacy/Cyber Risk & Data Security
On March 19, the Illinois Attorney General, along with 30 other state Attorneys General and the Executive Director of the Hawaii Office of Consumer Protection, issued a letter to selected members of Congress opposing the Data Acquisition and Technology Accountability and Security Act (the DATAS Act...
Privacy/Cyber Risk & Data Security, State Issues, State Attorney General, Data Breach, Security Freeze
On March 21, the Florida governor signed HB 953 , which prohibits credit reporting agencies from charging any fee to consumers or their representatives for “placing, removing, or temporarily lifting” security freezes on a credit report. Previously the state allowed for a fee of up to $10 to use the...
State Issues, Security Freeze, Credit Reporting Agency, Data Breach, Privacy/Cyber Risk & Data Security
On March 21, the South Dakota governor signed SB 62 , which requires companies that hold consumers’ personal information to (i) notify consumers within 60 days of a data breach; and (ii) notify the state Attorney General if more than 250 consumers are affected. Notice must be provided to consumers...
Privacy/Cyber Risk & Data Security, Courts, Damages, Data Breach, Credit Reporting Agency, Security Freeze, State Legislation
On March 16, the FTC and three Utah-based movie companies (defendants) agreed to a proposed stipulated final order settling charges that they violated the FTC Act and the Telemarketing Sales Rule (TSR). In 2011, the DOJ filed a complaint on behalf of the FTC, which alleged defendants engaged in...
Privacy/Cyber Risk & Data Security, FTC, DOJ, FTC Act, Telemarketing Sales Rule, Settlement
On March 19, the Michigan governor signed legislation, HB 5094 , which amends the Michigan Security Freeze Act to prohibit consumer reporting agencies (CRAs) from charging a fee for “placing, temporarily lifting, or removing a security freeze” on a credit report. Previously, the state allowed for a...
State Issues, Credit Reporting Agency, Privacy/Cyber Risk & Data Security, Data Breach, Security Freeze, State Legislation
On March 13, the Washington governor signed Senate Bill 6018 , which amends sections of the state’s Fair Credit Reporting Act addressing the removal of security freezes. Among other things, the amended act prohibits credit reporting agencies (CRAs) from charging a fee for placing, temporarily...
On March 14, by a vote of 67-31, the Senate passed the Economic Growth, Regulatory Relief, and Consumer Protection Act (S. 2155) (the bill)—a bipartisan regulatory reform bill crafted by Senate Banking, Housing, and Urban Affairs Committee Chairman Mike Crapo, R-Idaho—that would repeal or modify...
Federal Issues, Federal Legislation, Bank Regulatory, Dodd-Frank, S. 2155, CFPB, HMDA, Mortgages, Licensing, TILA, TRID, Servicemembers, Volcker Rule, Student Lending, Consumer Finance, Bank Holding Companies, Community Banks, Privacy/Cyber Risk & Data Security, EGRRCPA
On March 5, the New York Department of Financial Services (NYDFS) published FAQs for regulated entities that have not yet filed cybersecurity certifications of compliance (Certification of Compliance) required under 23 NYCRR 500. The deadline to file was February 15 and notices recently were sent...
Virginia governor enacts amendment relating to security freeze fees
On March 9, the governor of Virginia signed House Bill 1027 , which amends sections of the Code of Virginia relating to security freezes and lowers the maximum amount that a credit reporting agency may charge to place, remove, or lift a security freeze on a protected consumer’s credit report from $...
State Issues, State Legislation, Data Breach, Privacy/Cyber Risk & Data Security, Security Freeze
On March 9, the U.S. District Court for the Northern District of California partially granted a motion to dismiss limiting plaintiffs’ ability to seek certain punitive damages for data breaches. The court also held that the plaintiffs cannot seek claims under the California Customer Records Act (...
Privacy/Cyber Risk & Data Security, Courts, Damages, Data Breach
9th Circuit reinstates class action data breach lawsuit against online retailer
On March 8, the U.S. Court of Appeals for the 9th Circuit reinstated a putative class action lawsuit against an online retailer, concluding that the increased risk of identity theft resulting from a 2012 data breach affecting over 24 million shoppers gave consumers Article III standing to sue. The...
Courts, Ninth Circuit, Appellate, Privacy/Cyber Risk & Data Security, Data Breach, Class Action
On March 7, the House Financial Services Subcommittee on Financial Institutions and Consumer Credit held a hearing entitled “Legislative Proposals to Reform the Current Data Security and Breach Notification Regulatory Regime” to discuss data security and breach notification rules and cybersecurity...
Privacy/Cyber Risk & Data Security, House Financial Services Committee, Data Breach, FCRA, Federal Legislation, Security Freeze
On March 5, Pennsylvania Attorney General filed a lawsuit against a ride-sharing company for violating Pennsylvania’s Breach of Personal Information Notification Act (BPINA) because of its failure to disclose a 2016 data breach caused by hackers. The complaint alleges that after the company became...
State Issues, Privacy/Cyber Risk & Data Security, Data Breach, State Attorney General, Courts
On March 2, the U.S. District Court for the Northern District of California denied a motion to dismiss an action for lack of standing in a lawsuit brought under the Illinois Biometric Information Privacy Act (BIPA) against a social media company (defendant) for allegedly collecting and storing non-...
Courts, Privacy/Cyber Risk & Data Security, Class Action, State Issues
New York Attorney General settles HIPAA allegations with a health insurance company
On March 6, the New York Attorney General announced a settlement with a healthcare provider for an alleged violation of the Health Insurance Portability Accountability Act (HIPAA) concerning a mailing error, which resulted in the disclosure of over 80,000 social security numbers. According to the...
Nebraska, South Dakota enact legislation relating to security breaches and credit freezes
On March 1, the governor of South Dakota signed House Bill 1078 to revise certain provisions addressing the removal of credit security freezes. The amended act states that a security freeze will remain in place until a consumer requests the removal from the consumer reporting agency. The consumer...
On March 1, the FTC issued its annual summary on consumer complaints received by the agency over the past year, highlighting trends in various categories such as fraud and identity theft. The report, Consumer Sentinel Network Data Book 2017 (2017 Data Book), provides category breakdowns and...
Federal Issues, FTC, Consumer Finance, Consumer Complaints, Consumer Education, Fraud, Privacy/Cyber Risk & Data Security
On February 23, the FTC announced a proposed settlement with a global online payments system company (company) to resolve a complaint filed in 2016 concerning allegations that its payment and social networking service (service) violated the FTC Act when it, among other things, failed to adequately...
Privacy/Cyber Risk & Data Security, FTC, Peer-to-Peer, Settlement, Gramm-Leach-Bliley, FTC Act
On February 21, the New York Department of Financial Services (NYDFS) updated its answers to FAQs relating to 23 NYCRR Part 500, which was last updated in December 2017 . As previously covered in InfoBytes , 23 NYCRR Part 500 took effect March 1, 2017, and establishes cybersecurity requirements for...
Privacy/Cyber Risk & Data Security, NYDFS, State Issues, 23 NYCRR Part 500
FCC publishes Restoring Internet Freedom Order overturning net neutrality
On February 22, the FCC formally published its Restoring Internet Freedom Order (Order) to overturn the 2015 Title II Order (known as, “Net Neutrality” rules). As previously covered in InfoBytes , the FCC voted last December to remove the restrictions barring internet service providers (ISPs) from...
Agency Rule-Making & Guidance, FCC, Net Neutrality, Federal Register
On February 21, the SEC released Cybersecurity Interpretive Guidance designed to provide assistance to public companies when preparing disclosures about cybersecurity risks and incidents. According to a press release , the commissioners voted unanimously on February 20 to approve the guidance,...
Privacy/Cyber Risk & Data Security, SEC
On February 20, U.S. Attorney General Jeff Session announced plans to create a Cyber-Digital Task Force (Task Force) designed to combat global cyber threats. According to the DOJ’s press release, Attorney General Sessions stated that the Task Force will “advise me on the most effective ways that...
Privacy/Cyber Risk & Data Security, DOJ
On February 20, the U.S. Supreme Court denied without comment a medical insurance company’s petition for writ of certiorari to challenge an August 2017 D.C. Circuit Court of Appeals decision, which reversed the dismissal of a data breach suit filed by the company’s policyholders in 2015. According...
Courts, Privacy/Cyber Risk & Data Security, Spokeo, Class Action, U.S. Supreme Court, Appellate, D.C. Circuit, Data Breach
House Financial Services Committee holds hearing on current data security regulatory regime
On February 14, the House Financial Services Subcommittee on Financial Institutions and Consumer Credit held a hearing entitled “Examining the Current Data Security and Breach Notification Regulatory Regime” to discuss opportunities to reform data security regulations at the federal and state level...
Privacy/Cyber Risk & Data Security, House Financial Services Committee, Data Breach
On February 9, a federal judge for the U.S. District Court for the District of Montana denied a plaintiff’s motion for summary judgment, which sought to overturn the State of Montana’s statutory restrictions on robocalls. Among other things, the plaintiff—a Michigan-based political consulting firm...
Privacy/Cyber Risk & Data Security, Robocalls, State Legislation, Courts
On February 14, the Alabama Attorney General’s Office announced the establishment of the Cybercrime Lab, which was created in partnership with the U.S. Secret Service, the Federal Bureau of Investigation, U.S. Department of Homeland Security Investigations, the Alabama Fusion Center, the Alabama...
State Issues, State Attorney General, Data Breach, Privacy/Cyber Risk & Data Security
On February 12, the White House released its fiscal 2019 budget request, Efficient, Effective, Accountable, an American Budget (2019 budget proposal), along with Major Savings and Reforms (MSR) and an Appendix . The mission of the President’s budget sets forth priorities, including imposing fiscal...
Federal Issues, Budget, Trump, CFPB, CFTC, FSOC, Privacy/Cyber Risk & Data Security, Flood Insurance, HUD, SEC, Student Lending, Department of Treasury
On February 7, the SEC’s Office of Compliance Inspections and Examinations (OCIE) released its 2018 Examination Priorities , which includes cryptocurrency and Initial Coin Offerings (ICOs) for the first time. According to the document, the OCIE’s 2018 priorities reflect “certain practices, products...
Securities, Initial Coin Offerings, Privacy/Cyber Risk & Data Security, Anti-Money Laundering, Fintech, SARs, Financial Crimes
Massachusetts attorney general launches data breach reporting portal
On February 1, Massachusetts Attorney General Maura Healey launched a Data Breach Reporting Online Portal , which is available through the agency’s Security Breaches site . Organizations can use the online portal to provide notice to the attorney general’s office of a data breach as required by the...
Privacy/Cyber Risk & Data Security, State Issues, State Attorney General, Credit Reporting Agency, Data Breach
FTC issues comments on FCC’s robocall blocking rules
On January 31, the FTC submitted a comment letter in response to the FCC’s request for input on its November adoption of rules allowing phone companies to proactively block illegal robocalls originating from certain types of phone numbers. (See previous InfoBytes coverage here .) Calling the...
Privacy/Cyber Risk & Data Security, FTC, FCC, Robocalls
Maryland issues bipartisan consumer protection recommendations
On January 26, the Maryland Financial Consumer Protection Commission (the “Commission”) and ranking officials from the Maryland legislature announced bipartisan “Interim Recommendations” of the Commission for State and local action in response to the federal government’s “efforts to change or...
State Issues, State Legislation, Consumer Finance, Data Breach, Payday Lending, Arbitration, Virtual Currency, Fintech, Credit Reporting Agency, Security Freeze
On January 24, New York Governor Andrew M. Cuomo signed an executive order to protect net neutrality in his state, while earlier on January 22, Montana Governor Steve Bullock signed his own executive order designed to “safeguard internet freedom.” Both executive orders have been issued in response...
Privacy/Cyber Risk & Data Security, State Issues, Net Neutrality
On January 22, the New York Department of Financial Services (NYDFS) issued a reminder to all NYDFS-regulated banks, insurance companies, and other financial services institutions that the deadline to file cybersecurity certifications of compliance is February 15, 2018. Mandated by NYDFS’...
Privacy/Cyber Risk & Data Security, State Issues, NYDFS, Bank Compliance, 23 NYCRR Part 500
On January 16, a coalition of 22 state attorneys general filed a protective petition for review in the D.C. Circuit Court of Appeals against the Federal Communications Commission (FCC) and the United States to block the FCC’s Declaratory Ruling, Report and Order released last December to rollback...
Privacy/Cyber Risk & Data Security, State Issues, State Attorney General, FCC, FTC, Net Neutrality, Congressional Review Act
On January 18, the FTC released its annual report on the agency’s privacy and data security work performed in 2017. Among other items, the report highlights consumer-related enforcement activities in 2017, including: a settlement with a ride-sharing company over allegations that it violated the FTC...
Privacy/Cyber Risk & Data Security, FTC, Compliance, Enforcement, State Attorney General
On January 18, the OCC announced the release of its Semiannual Risk Perspective for Fall 2017 , identifying key risk areas for national banks and federal savings associations. Top supervisory priorities will focus on credit, operational, and compliance risk. As previously discussed in the spring...
Federal Issues, Agency Rule-Making & Guidance, OCC, Risk Management, Bank Regulatory, Third-Party, Bank Secrecy Act, HMDA, Military Lending Act, Vendor Management, Anti-Money Laundering, Privacy/Cyber Risk & Data Security
On January 10, the U.S. Court of Appeals for the Ninth Circuit affirmed that three payday lenders and two marketing companies (together, the defendants) did not indirectly violate the Telephone Consumer Protection Act (TCPA) by accepting marketing help from a separate lead generator company that...
Privacy/Cyber Risk & Data Security, Courts, Ninth Circuit, Appellate, TCPA, Payday Lending
Recently, the New York Department of Financial Services (NYDFS) updated its answers to FAQs relating to 23 NYCRR Part 500. As previously covered in InfoBytes , 23 NYCRR Part 500 took effect March 1 and establishes cybersecurity requirements for banks, insurance companies, and other financial...
Privacy/Cyber Risk & Data Security, State Issues, NYDFS, 23 NYCRR Part 500
On December 14, the FCC voted 3-2 to overturn the 2015 Open Internet Order rules (known as, “Net Neutrality” rules) which mandate that internet service providers (ISPs) treat all web content equally. The FCC released a draft order in November, which outlined the new framework for ISPs, including...
Agency Rule-Making & Guidance, FCC, Privacy/Cyber Risk & Data Security, FTC, Net Neutrality
On Tuesday, New York State adopted emergency regulations intended to “provide consumers with the means to protect themselves against identity theft” and assist those consumers who have fallen victim to such theft. The New York Department of State’s Division of Consumer Protection (the Division),...
Privacy/Cyber Risk & Data Security, State Issues, Data Breach, NYDFS, Credit Reporting Agency, 23 NYCRR Part 500
On November 29, the FTC announced it had approved final settlements with three companies over allegations that they falsely claimed participation in the European Union-U.S. Privacy Shield ( EU-U.S. Privacy Shield ) framework. ( See previous InfoBytes coverage here .) The settlements mark the FTC’s...
Ride-Sharing Company Announces Data Breach; State Attorneys General Launch Investigations
On November 21, a ride-sharing company disclosed via press release a 2016 data breach that exposed the personal data of 57 million riders and drivers. According to the company, an outside forensic investigation revealed that in October 2016 hackers obtained approximately 600,000 driver names and...
State Issues, Privacy/Cyber Risk & Data Security, Data Breach, State Attorney General, FTC, Class Action, Settlement, Courts
On November 16, Federal Reserve Governor Lael Brainard spoke at a fintech conference sponsored by the University of Michigan regarding consumers’ right to understand and control how their financial data is used by third-party aggregators, and in developing fintech technology. “There's an increasing...
Fintech, Federal Reserve, Consumer Finance, Privacy/Cyber Risk & Data Security, EFTA, CFPB, Third-Party
On November 16, the FCC approved new rules allowing phone companies to proactively block illegal robocalls originating from certain types of phone numbers. Pursuant to the report and order released on November 17, providers may block calls that: (i) are made from telephone numbers that are not...
On November 15, the SEC Division of Enforcement released a report highlighting the division’s priorities for the coming year and summarizing the enforcement actions from FY 2017. Division Co-Directors Stephanie Avakian and Steven Peikin identify and discuss the five core principles that guide their...
Federal Issues, SEC, Privacy/Cyber Risk & Data Security, Enforcement, Financial Crimes
On November 13, Missouri Attorney General Joshua Hawley announced that his office has issued a civil investigative demand (CID) to a major California-based technology company as part of an investigation into suspected violations of the Missouri Merchandising Practices Act and the state’s antitrust...
State Issues, Privacy/Cyber Risk & Data Security, Consumer Data, State Attorney General, Third-Party
On November 10, plaintiffs, and the members of the class and subclasses they seek to represent, filed a complaint in the Northern District of Georgia against a major credit reporting company, consolidating individual suits filed against the company since September in each of the 50 states and the...
Privacy/Cyber Risk & Data Security, Data Breach, Consumer Finance, Class Action, State Issues, Security Freeze
House Energy and Commerce Subcommittee Examines Consumer Data Security
On November 1, the House Subcommittee on Digital Commerce and Consumer Protection (Subcommittee) held a hearing entitled “Securing Consumers’ Credit Data in the Age of Digital Commerce” to examine: (i) the legal and regulatory framework for consumer reporting agencies, including the Gramm-Leach-...
Federal Issues, Privacy/Cyber Risk & Data Security, House Energy and Commerce Committee, Data Breach
On October 23, District of Columbia Mayor Muriel Bowser signed emergency legislation ( Act 22 155 ) that prohibits credit reporting agencies (CRAs) from charging consumers fees for security credit freezes. The Credit Protection Fee Waiver Emergency Amendment Act of 2017 requires CRAs to provide...
Privacy/Cyber Risk & Data Security, Credit Reporting Agency, Consumer Finance, State Legislation, Data Breach, Security Freeze
On October 18, the CFPB published guidelines entitled “ Consumer Protection Principles ” (Principles), which are “intended to reiterate the importance of protecting consumers” when companies, including “fintech” firms, banks, and other financial institutions, get authorization from consumers to...
Privacy/Cyber Risk & Data Security, Consumer Finance, CFPB, Vendor Management, Third-Party, Fintech, eCommerce
On October 13, G-7 finance ministers and central bank governors released a report titled G-7 Fundamental Elements for Effective Assessment of Cybersecurity in the Financial Sector to provide guidance on G-7 countries’ (Canada, France, Germany, Italy, Japan, the United Kingdom, and the United States...
Privacy/Cyber Risk & Data Security, Department of Treasury, G-7
Coalition of State Attorneys General Urge Credit Reporting Agencies to Offer No-Fee Credit Freeze
On October 10, a coalition of 37 state attorneys general sent letters ( here and here ) to the CEOs of two major credit reporting agencies (CRAs), urging them to stop charging fees to consumers seeking credit freezes as a measure to protect against identity theft in light of a third CRA’s massive...
Privacy/Cyber Risk & Data Security, State Attorney General, Consumer Finance, Security Freeze
Federal Issues, Privacy/Cyber Risk & Data Security, FTC, Telemarketing Sales Rule, U.S. Senate, State Attorney General
FTC to Hold Informational Injury Workshop
On September 29, the FTC announced it will host an “informational injury” workshop on December 12 to examine the types of injuries consumers face when information about them is misused , as well as the tradeoffs when collecting, using, or sharing consumers’ personal information. In preparation for...
Privacy/Cyber Risk & Data Security, FTC, Enforcement
On September 30, President Trump issued a Proclamation announcing October 2017 as National Cybersecurity Awareness Month. As part of the initiative, the Department of Homeland Security (DHS) issued tools and resources for both consumers and organizations to manage cybersecurity risk. As previously...
Privacy/Cyber Risk & Data Security, Federal Issues, Risk Management, Trump, Department of Homeland Security, Executive Order
On September 27, interim CEO, Paulino do Rego Barros Jr., spoke out for the first time since a major credit reporting agency (agency) appointed him to the role the previous day. In addition to issuing an apology, Barros stated that the agency is extending the deadline to sign up for their credit...
Privacy/Cyber Risk & Data Security, Credit Reporting Agency, Data Breach, Senate Judiciary Subcommittee, Consumer Finance
On September 25, the SEC announced the expansion of its Enforcement Division’s focus on cyber-related misconduct with the creation of a Cyber Unit and a Retail Strategy Task Force. The Cyber Unit will focus on areas such as (i) market manipulation schemes involving electronically-transferred false...
Privacy/Cyber Risk & Data Security, SEC, Enforcement, Fintech, Distributed Ledger, Initial Coin Offerings, Retail Banking
Privacy/Cyber Risk & Data Security, Credit Reporting Agency, State Attorney General, NYDFS, Enforcement, Data Breach, Security Freeze, 23 NYCRR Part 500
Privacy/Cyber Risk & Data Security, State Issues, NYDFS, Credit Reporting Agency, 23 NYCRR Part 500
Financial Crimes, Sanctions, Department of Treasury, OFAC, DOJ, Indictment, Privacy/Cyber Risk & Data Security
Privacy/Cyber Risk & Data Security, Data Breach, Class Action, State Attorney General
Privacy/Cyber Risk & Data Security, State Attorney General, Enforcement, Settlement, FTC Act
State Issues, Privacy/Cyber Risk & Data Security, NYDFS, Compliance, Bank Regulatory, 23 NYCRR Part 500
Privacy/Cyber Risk & Data Security, FTC, Enforcement, Gramm-Leach-Bliley, Regulation P, Safeguards Rule, FTC Act
Privacy/Cyber Risk & Data Security, FTC, UDAAP, Settlement, Vendor Management, FTC Act
Privacy/Cyber Risk & Data Security, Settlement, State Attorney General
Privacy/Cyber Risk & Data Security, NYDFS, State Issues, Bank Regulatory, Compliance, 23 NYCRR Part 500
State Issues, Debt Collection, Fraud, Privacy/Cyber Risk & Data Security, State Legislation, Credit Reporting Agency
Agency Rule-Making & Guidance, Privacy/Cyber Risk & Data Security, State Attorney General, Disclosures
Fintech, BAFT, Blockchain, Privacy/Cyber Risk & Data Security, Payments, Distributed Ledger
Federal Issues, Fintech, OCC, House Energy and Commerce Committee, Blockchain, Digital Commerce, Privacy/Cyber Risk & Data Security, Virtual Currency, Distributed Ledger
On June 8, Vermont Governor Phil Scott signed into law legislation (S. 135), which would, among other things, allow for broader business and legal application of blockchain technology to promote economic development. Additionally, S. 135 requires the Center for Legal Innovation at Vermont Law...
Fintech, Privacy/Cyber Risk & Data Security, State Attorney General, State Legislation, Blockchain, Distributed Ledger
Privacy/Cyber Risk & Data Security, Securities, FBI, Department of Treasury, SEC
Privacy/Cyber Risk & Data Security, Enforcement, State Attorney General
Privacy/Cyber Risk & Data Security, FTC, Enforcement, State Attorney General, DOJ
Elizabeth E. McGinn Authored a Westlaw Journal Article, "Data Security Breach Litigation Post-Spokeo"
Privacy/Cyber Risk & Data Security, State Issues, Data Breach, State Attorney General
On April 3, President Trump signed into law a measure ( S.J.Res. 34 ) rescinding the new Federal Communications Commission (FCC) broadband privacy rules related to Internet service providers (ISPs). As previously covered on InfoBytes , the privacy rules— passed last year in a 3-2 party-line vote...
Privacy/Cyber Risk & Data Security, NYDFS, State Issues, Special Alerts, 23 NYCRR Part 500
Elizabeth E. McGinn, Thomas A. Sporkin