Archives: Consumer Privacy

Subscribe to Consumer Privacy RSS Feed

CPRA Series: New, Expanded and Modified Consumer Rights

On November 3, 2020, Californians approved another significant piece of privacy rights legislation, the California Privacy Rights Act, or the CPRA.  The CPRA amends and expands the already (almost) infamous CCPA (California Consumer Privacy Act), which is the privacy law that went into effect in the Golden State last year. New Rights under CPRA The … Continue Reading

TCPA Is Unenforceable Since 2015 – Federal Courts in Louisiana and Ohio Rule

In late September, the United States District Court for the Eastern District of Louisiana issued a first of its kind  ruling regarding the Telephone Consumer Privacy Act (“TCPA”). The court held that TCPA provision,  47 U.S.C. § 227(b)(1)(A)(iii) – which prohibits calls (and messages) made using an Automatic Telephone Dialing Systems (“ATDS”)to any cellular telephone number … Continue Reading

CPRA Series: Impacts On Notice At Collection And Privacy Policy

Already at the cutting edge of U.S. privacy law, California jumped even further ahead of the pack with the recent approval by State voters of the California Privacy Rights Act (“CPRA”).  The CPRA, which builds upon the already extensive framework of privacy rights and obligations established in the California Consumer Privacy Act (“CCPA”), is likely … Continue Reading

CPRA Series: Extension of CCPA’s Anti-Discrimination/Retaliation Provision to Employees, Applicants, and Independent Contractors

During the California Consumer Privacy Act’s (“CCPA”) amendment process prior to enactment, personal information in the employment context was highly contested and has continued to be a point of deliberation even after the CCPA’s effective date last January 1, 2020.  CCPA excludes certain employment-related personal information from most of the act’s requirements until January 1, … Continue Reading

California Passes Prop 24: Here Comes CCPA 2.0

It goes without saying that November 3rd 2020 was an important day for the future of the nation, but it was also a significant day for the future of California privacy law.  On Tuesday, a strong majority of California voters supported Proposition 24, a ballot measure which aims to expand and enhance the California Consumer … Continue Reading

Federal Agencies Issue Joint Alert on Imminent Cybercrime Threat to Healthcare Providers

The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the U.S. Department of Health and Human Services (HHS) have issued a joint cybersecurity advisory stating they have credible information of an increased and imminent cybercrime threat to U.S. hospitals and healthcare providers. The advisory describes the tactics, techniques, and procedures … Continue Reading

Hacked Healthcare Provider Refuses to Pay Ransom, Attackers Target Psychotherapy Patients

Earlier this year, we reported on an evolution in the form of cyberattack known as ransomware –attackers transitioning from denying affected users access to critical data by encrypting it to removing data from the compromised systems and threatening public release in exchange for payment. These attacks typically target the companies maintaining the data. However, attackers … Continue Reading

Eleventh Circuit rejects incentive awards for class plaintiffs

Co-Author: Eric R. Magnus The Eleventh Circuit Court of Appeals recently ruled that “incentive” or “service” awards to lead plaintiffs in Rule 23 class actions are unlawful. It is the first circuit court of appeals to expressly invalidate such awards as a matter of law. (Johnson v. NPAS Solutions, LLC, No. 18-12344, September 17, 2020). … Continue Reading

California DOJ Announces a Third Set of Modifications to the CCPA Regulations

Back in August, after much anticipation and several rounds of review and modification, the California Consumer Privacy Act (CCPA) regulations finally became effective. This was long awaited by businesses and their service providers looking for compliance guidance and clarity on key issues related to facilitation of consumer rights.  This week, the California Department of Justice … Continue Reading

The CCPA’s “B2B” Exemption Is Also Extended by Governor Newsom

By signing AB 1281 into law on September 29th, 2020, California Governor Gavin Newsom amended the California Consumer Privacy Act (“CCPA”) to extend until January 1, 2022, not only the current exemption on employee personal information from most of the CCPA’s protections, but also the so-called “B2B” exemption. Welcomed by many “B2B” (business to business) … Continue Reading

California Governor Newsom Signs into Law Extension to CCPA Employee Personal Information Exemption, Vetoes Another Privacy Bill

On September 29th, California Governor Gavin Newsom signed into law AB 1281, an amendment to the California Consumer Privacy Act (“CCPA”) that would extend the current exemption on employee personal information from most of the CCPA’s protections, until January 1 2022. The exemption on employee personal information was slated to sunset on December 31, 2020.  … Continue Reading

House Passes Internet of Things Cybersecurity Improvement Act

The House of Representatives recently passed the Internet of Things (IoT) Cybersecurity Improvement Act of 2020 (the Act).  The Act has been moved to the Senate for consideration. The legislation sets minimum security standards for all IoT devices purchased by government agencies. IoT refers to the myriad of physical devices that are connected to the … Continue Reading

Will the Passing of Justice Ginsburg Impact the Future of the TCPA?

The passing of U.S. Supreme Court Justice Ruth Bader Ginsburg will likely bring with it many shifts in the Court on key issues, among which are matters regarding the Telephone Consumer Protection Act (TCPA), most imminently –  what qualifies as an auto dialer. The TCPA has been ever evolving in recent years as courts and … Continue Reading

Indiana AG Proposed Regulations Creating Corrective Action Plan Requirement and Cybersecurity Safe Harbor

A proposal by Indiana’s Attorney General Curtis Hill on Wednesday would add a significant step in the incident response process for responding to breaches of security affecting Indiana residents. On Wednesday, during a U.S. Chamber of Commerce virtual event, he announced his proposed rule designed to better protect Hoosiers from cyberattacks. It is expected that … Continue Reading

OCR Releases New Guidance on HIPAA for Mobile Health Technology

Over the past few years, and particularly during the COVID-19 pandemic, the Department of Health and Human Services Office for Civil Rights in Action (OCR) has made countless efforts to enhance its Health Insurance Portability and Accountability Act (HIPAA) guidance and other related resources on its website. Last week, the OCR launched a new feature … Continue Reading

Massachusetts Attorney General Creates Data Privacy and Security Division

The Massachusetts Office of the Attorney General has created a new Data Privacy and Security Division. This Division is charged with protecting consumers from the threats to the privacy and security of their data. The Attorney General, Maura Healey, announced “The Data Privacy and Security Division will build on our office’s commitment to empowering Massachusetts … Continue Reading

Michigan Considers Enhanced Data Breach Notification Law

Privacy and security continue to be at the forefront for legislatures across the nation, despite (or perhaps because of) the COVID-19 pandemic.  In late May, with back-to-back amendments, Washington D.C. and Vermont significantly overhauled their data breach notification laws, including expansion of the definition of personal information, and heightened notice requirements.  Now, Michigan may follow … Continue Reading

California Assembly Passes CCPA Amendment: Employee Personal Information Exemption Extension

The California Consumer Privacy Act (“CCPA”) has only been in effect since January, but amendments are already on the horizon. Personal information in the employment context was highly contested during the CCPA’s amendment process prior to enactment and has continued to be a point of deliberation even after the CCPA’s effective date. In its current … Continue Reading

NSA Releases Helpful Guidance for Limiting Location Data Exposure

The National Security Agency (NSA) recently released helpful guidance on how to effectively limit location data exposure for its staffers, which also can be helpful information for the general public. Businesses likely will have different perspectives about location data than the NSA, which is trying to protect its staffers and its vital national security missions. … Continue Reading

National Biometric Information Privacy Act, Proposed by Sens. Jeff Merkley and Bernie Sanders

Whether it is facial recognition technology being used in connection with COVID-19 screening tools and in law enforcement, continued use of fingerprint-based time management systems, or the use of various biometric identifiers for physical security and access management, applications involving biometric identifiers and information in the public and private sectors continue to grow. Concerns about … Continue Reading

Will the Public Health Emergency Privacy Act Make it into the Next Stimulus Package?

Despite several attempts, Congress has struggled to push forward a federal consumer privacy law over the past few years. But the COVID-19 pandemic, which has raised concerns regarding location monitoring, GPS tracking and use of health data, has heightened the urgency for federal consumer privacy legislation. In May, a group of Democrats from the U.S. … Continue Reading

Transferring Employee Data after EU-U.S. Privacy Shield Invalidated

Businesses are now prohibited from transferring employee personal data from the European Economic Area (EEA) to the U.S. under the EU-U.S. Privacy Shield program. The Court of Justice of the European Union (CJEU) declared the EU-U.S. Privacy Shield invalid in Data Protection Commissioner v. Facebook Ireland and Schrems (C-311/18) (Schrems II), effective immediately. Businesses that … Continue Reading

EU-U.S. Privacy Shield Program for Transfer of Personal Data to U.S. Found Invalid

On July 16, 2020, the Court of Justice of the European Union (CJEU) published its decision in the matter of Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (“Schrems II”). The matter, arising from the transfer of Schrems’ personal data by Facebook Ireland to Facebook Inc. in the United States, presented questions concerning the … Continue Reading

Supreme Court Will Take on The TCPA Again

Back in October of 2019, the U.S. Supreme Court was petitioned to review a Ninth Circuit ruling regarding the Telephone Consumer Privacy Act (“TCPA”) on the following issues: 1) whether the TCPA’s prohibition on calls made by an automatic telephone dialing system (“ATDS”) is an unconstitutional restriction of speech, and if so whether the proper … Continue Reading
LexBlog