California has enacted SB 947, the No Robo Bosses Act. It adds new Labor Code requirements for employers that use automated decision systems (ADS) to make disciplinary and termination decisions, and it takes effect July 1, 2027. Importantly, the No Robo Bosses Act makes clear that the California Consumer Privacy Act (CCPA) also must
California Limits Private Lawsuits Over Certain Online Tracking Claims
California has enacted Senate Bill (SB) 690, which narrows the circumstances under which private parties may bring lawsuits under the California Invasion of Privacy Act (CIPA), Cal. Penal Code Section 638.51.
The new law takes effect January 1, 2027, and notably includes a two-year look-back period for pending lawsuits commenced before the law
AI On The Loose: What the Latest Cyber Incidents Mean for Your Organization
AI is accelerating cybersecurity threats. Learn how data minimization, incident response, data mapping, and vendor governance can help reduce risk.
Recent reports involving leading artificial intelligence (AI) developers have heightened concern about whether AI agents can operate beyond their intended boundaries and/or be used by cyber criminals to perpetuate attacks that are more difficult to
Cybersecurity Coalition Calls for Collective Action as AI Changes the Threat Landscape
A broad coalition of artificial intelligence developers, cybersecurity companies, financial institutions, technology providers, and other organizations has issued an open letter calling for a coordinated effort to strengthen cyber defenses.
“We have a limited window to strengthen cyber defenses.”
The letter warns that AI-enabled cyberattacks have become more widespread and sophisticated. At the same
Green Mountain State Joins in State Privacy Effective 2028
Vermont has passed Senate Bill 71, a comprehensive privacy law that will regulate how covered entities collect, use, disclose, sell, and protect personal data.
The law is scheduled to take effect on January 1, 2028.
To whom does the law apply?
The law applies to people who conduct business in Vermont or produce
New Louisiana Data Privacy Act Set to Take Effect in 2027
With the Governor of Louisiana’s signature on Senate Bill 386, Louisiana becomes one of the latest states to enact a comprehensive consumer privacy law, joining more than twenty states that have adopted similar frameworks in recent years. Like laws in Texas, Virginia, Colorado, and other states, the Louisiana Data Privacy Act (LDPA) adopts a
Key Vendor Management Lessons Educational Institutions Can Learn from Recent EdTech Vendor Data Breach
Takeaways
Educational Institutions use Software as a Service platforms to facilitate operations, but doing so carries significant risk that needs to be carefully managed. Strong vendor oversight, tight contracts, and incident response planning are critical to protecting personal data down the chain.
Related links
Five Privacy Issues Higher Education Institutions Should Consider Monitoring
Consumer Privacy Protections Come to the Heart of Dixie
The governor of Alabama recently signed House Bill 351, which establishes a consumer data privacy law for the state. The law takes effect May 1, 2027.
To whom does the law apply?
The law applies to controllers that conduct business in Alabama or produce products or services targeted to Alabama residents, if they
The Delve Scandal: Why a SOC 2 Report Can’t Be a “Check-the-Box” Exercise for Vendor Management
A recent Inc. article highlights an unsettling controversy involving Delve, a Y Combinator-backed compliance startup, and allegations that strike at the heart of how organizations rely on SOC (System and Organization Controls) 2 reports which evaluate an organization’s internal controls over security, availability, and privacy.
According to the report, a whistleblower investigation alleges that Delve
Dashcams: There’s More Risk To Manage Than You’d Expect
In recent years, many organizations have installed dashcams in their vehicles to improve safety and compliance, reduce costs, and better understand what’s happening in the field. Dashcams can be extremely useful for these purposes, giving organizations visibility into risky driver behaviors and misuse of company property. They can also lower insurance costs and provide valuable