A recent study surveying small and mid sized businesses (SMBs) found that 67% had experienced a cyber attack in 2018, and yet that same study found that cybersecurity is still “not on the to do list” for SMBs – 60% of the SMBs surveyed responded that they did not have a cybersecurity plan in place, and only 9% ranked cybersecurity as a top business priority. The federal government has taken notice of these concerning statistics.

Early this month, the U.S. House of Representatives passed five bipartisan bills to help small businesses. Among the bills passed, two specifically aim to enhance a small business’s ability to prevent and respond to a cybersecurity incident. First, the SBA Cyber Awareness Act, H.R. 2331, aims to strengthen the Small Business Administration’s handling and reporting of the cyber threats that affect small businesses. The bill requires the SBA to provide an annual report on the status of SBA cybersecurity, and notify Congress of any incident of cyber risk and how the SBA is addressing it. Second, the Small Business Development Center Cyber Training Act of 2019, H.R. 1649, requires the Small Business Administrator to establish or certify an existing cyber counseling certification program to certify employees at small business development centers. It also requires the SBA to reimburse lead small business development centers (SBDCs) for any costs relating to such certifications up to $350,000 in a fiscal year.

The Senate has also introduced legislation to help SMBs better address cyber threats. In late June, Senator Marco Rubio (R-FL) joined by Senator Gary Peters (D-MI) introduced the Small Business Cybersecurity Assistance Act of 2019, S.2034 that aims to better educate small businesses on cybersecurity through counselors and resources offered at SBDCs. The bill incorporates recommendations suggested by DHS and SBA’s Small Business Development Center Cyber Strategy in a report from March of 2019, which described challenges small businesses face with implementing cybersecurity for their business, including the confusing nature of government cyber resources and lack of training.

The cyber threats plaguing SMBs are real, and SMBs need to address the significant risk to their businesses. The cyber insurance industry is increasingly targeting SMBs with robust insurance policies, comparable to offerings for larger companies. While insurance is a helpful component of an overall risk management strategy, it should not be the only component.

In the event of a data breach, the policy might cover costs related to responding to that breach (sending notices, offering credit monitoring, etc.) and business interruption costs, but it might not cover the costs of a federal or state agency inquiry following the reported breach. That is, if, for example, a small health care practice reporting a breach might trigger a compliance review by the federal Office of Civil Rights. In that case, OCR investigators would be looking for information about the breach, but also evidence that a risk assessment was conducted, copies of written policies and procedures covering administrative, physical, and technical safeguards to protect health information, acknowledgments that employees completed HIPAA training, and other information to support compliance. Having these compliance measures in place can substantially limit an SMB’s exposure in these kinds of federal or state agency inquiries, as well as strengthen the SMB’s defensible position should the SMB be sued as a result of a breach.

Co-author: Valerie Jackson

While healthcare organizations are embracing new technologies such as patient portals, a recent report shows that organizations’ cybersecurity measures for these technologies are behind the times. A patient portal is a secure online website that allows patients to access their Electronic Health Record from any device with an Internet connection. Many patient portals also allow patients to request prescription refills, schedule appointments, and securely message providers. With this increased access for patients comes the risk that someone other than the patient will gain unauthorized access to the portal, and to the patient’s electronic protected health information (ePHI).

2019 has seen record numbers of patient records being breached. Halfway through 2019, around 25 million patient records have been breached, eclipsing the number of patient records breached in all of 2018 by over 66%. In this environment where hackers find patient records a valuable commodity on the black market, healthcare organizations are must balance patients’ desire for ease of use with the duty to prevent unauthorized access to patient records. To learn more about how healthcare organizations are meeting this challenge, LexisNexis® Risk Solutions in collaboration with the Information Security Media Group conducted a survey in spring 2019 asking healthcare organizations about their cybersecurity strategies and patient identity management practices. The results of the survey, which included responses from more than 100 healthcare organizations, including hospitals and physician group practices, were recently published in a report, “The State of Patient Identity Management” (the “report”).

The report concluded that healthcare organizations had a high level of confidence in the security of their patient portals, but this confidence may be misplaced based upon the security measures respondents reported they had in place. The vast majority of healthcare organizations reported that they continued to use traditional authentication methods such as username and password (93%), knowledge-based authentication questions and answers (39%), and email verification (38%). Notably, less than two-thirds reported using multifactor authentication. Multifactor authentication verifies a user’s identity in two or more ways, using: something the user knows (passwords, security questions); something the user has (mobile phone, hardware that generates authentication code); and/or something the user does or is (fingerprint, face ID, retina pattern).

While the HIPAA Security Rule does not require multifactor authentication, it does require covered entities and business associates to use security measures that reasonably and appropriately implement the HIPAA Security Rule standards and implementation specifications. Generally, the HIPAA Security Rule requires covered entities and business associates to (1) ensure the confidentiality, integrity, and availability of all ePHI the covered entity or business associate creates, receives, maintains, or transmits, (2) protect against any reasonably anticipated threats or hazards to the security or integrity of such information, and (3) protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required. The Person or Entity Authentication standard of the HIPAA Security Rule requires that covered entities and business associates implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. However, this standard has no implementation specifications. It is also worth mentioning that under the HIPAA Privacy Rule prior to a permissible disclosure, a covered entity must verify the identity of person requesting ePHI and their authority to have access to that ePHI, if either the identity or authority is not known to the covered entity. In addition, the covered entity must obtain “documentation, statements, or representations” from the person requesting the ePHI when such is a condition of the disclosure.

Healthcare organizations are not required to adopt any one cybersecurity framework or authentication method under HIPAA, however increasing cybersecurity and implementing multifactor authentication for access to patient portals certainly helps with compliance under the HIPAA Security Rule. Failure to implement reasonable and appropriate cybersecurity measures could not only lead to a healthcare data breach, but it could also result in a covered entity or business associate being fined by the HHS Office for Civil Rights. To learn more about how the firm can assist healthcare organizations with HIPAA compliance and data security, please contact your Jackson Lewis attorney.

On Thursday, New York Governor Andrew Cuomo signed into law the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), sponsored by Senator Kevin Thomas and Assemblymember Michael DenDekker. The SHIELD Act, which amends the State’s current data breach notification law, imposes more expansive data security and data breach notification requirements on companies, in the hope of  ensuring better protection for New York residents from data breaches of their private information. The SHIELD Act takes effect on March 21, 2020. Governor Cuomo also signed into law the Identity Theft Prevention and Mitigating Services Act that requires credit reporting agencies that face a breach involving Social Security numbers to provide five years of identity theft prevention and mitigation services to affected consumers. It also gives consumers the right to freeze their credit at no cost. This law becomes effective in 60 days.

Below are several FAQs highlighting key features of the SHIELD Act:

What is Private Information under the SHIELD Act?

Unlike other state data breach notification laws, New York’s original data breach notification law included definitions for “personal information” and “private information.” The current definition of “personal information” remains: “any information concerning a natural person which, because of name, number, personal mark, or other identifier, can be used to identify such natural person.” However, the SHIELD Act expands the definition of “private information” which sets forth the data elements that, if breached, could trigger a notification requirement. Under the amended law, “private information” means either:

  • personal information consisting of any information in combination with any one or more of the following data elements, when either the data element or the combination of personal information plus the data element is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired:
    • social security number;
    • driver’s license number or non-driver identification card number;
    • account number, credit or debit card number, in combination with any required security code, access code, password or other information that would permit access to an individual’s financial account; account number, credit or debit card number, if circumstances exist wherein such number could be used to access an individual’s financial account without additional identifying information, security code, access code, or password; or
    • biometric information, meaning data generated by electronic measurements of an individual’s unique physical characteristics, such as a fingerprint, voice print, retina or iris image, or other unique physical representation or digital representation of biometric data which are used to authenticate or ascertain the individual’s identity; OR
  • a user name or e-mail address in combination with a password or security question and answer that would permit access to an online account.

It is worth mentioning that the SHIELD Act’s expansive definition of “private information” is still not as broad as the definition of the analogous term under the laws of other states. For example, California, Illinois, Oregon, and Rhode Island have expanded the applicable definitions in their laws to include not only medical information, but also certain health insurance identifiers.

How has the term “breach of security of the system” changed?

The SHIELD Act alters the definition of “breach of the security of the system” in two significant ways. First, it broadens the circumstances that qualify as a “breach” by including within the definition of that term incidents that involve “access” to private information, regardless of whether they resulted in “acquisition” of that information. Under the old law, access absent acquisition did not qualify as a breach. In connection with this change, the amendments also add several factors for determining whether there has been unauthorized access to private information, including “indications that the information was viewed, communicated with, used, or altered by a person without valid authorization or by an unauthorized person.”

Second, as discussed above, the expansion of the definition of private information effectively expands the situations which could result in a breach of the security of the system.  Notably, the SHIELD Act retains the “good faith employee” exception to the definition of “breach.”

Are there any substantial changes to data breach notification requirements? And who must comply?

Any person or business that owns or licenses computerized data which includes private information of New York residents must comply with breach notification requirements, regardless of whether the person or business conducts business in New York.

That said, there are several circumstances which would exempt a business from the breach notification requirements. For example, notice is not required if “exposure of private information” was an “inadvertent disclosure and the individual or business reasonably determines such exposure will not likely result in misuse of such information, or financial harm to the affected persons or emotional harm in the case of unknown disclosure of online credentials”. Further, businesses that are already regulated by and comply with data breach notice requirements under certain applicable state or federal cybersecurity laws (e.g., HIPAA, NY DFS Reg. 500, Gramm-Leach-Bliley Act) are not required to further notify affected New York residents, however, they are still required to notify the New York State Attorney General, the New York State Department of State Division of Consumer Protection, and the New York State Division of the State Police.

What are the “reasonable” data security requirements? And who must comply with them?

As with the notification requirements, the SHIELD Act requires that any person or business that owns or licenses computerized data which includes private information of a resident of New York must develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information. Again, businesses in compliance with laws like HIPAA and the GLBA are considered in compliance with this section of the law. Small businesses are subject to the reasonable safeguards requirement, however safeguards may be “appropriate for the size and complexity of the small business, the nature and scope of the small business’s activities, and the sensitivity of the personal information the small business collects from or about consumers.” A small business is considered any business with fewer than fifty employees, less than $3 million in gross annual revenue in each of the last 3 years, or less than $5 million in year-end total assets.

The law provides examples of practices that are considered reasonable administrative, technical and physical safeguards. For example, risk assessments, employee training, selecting vendors capable of maintaining appropriate safeguards and implementing contractual obligations for those vendors, and disposal of private information within a reasonable time period, are all practices that qualify as reasonable safeguards under the law.

Are there penalties for failing to comply with the SHIELD Act?

The SHIELD Act does not authorize a private right of action, and in turn class action litigation is not available. Instead, the Attorney General may bring an action to enjoin violations of the law and obtain civil penalties. For data breach notification violations that are not reckless or knowing, the court may award damages for actual costs or losses incurred by a person entitled to notice, including consequential financial losses. For knowing and reckless violations, the court may impose penalties of the greater of $5,000 dollars or up to $20 per instance with a cap of $250,000. For reasonable safeguard requirement violations, the court may impose penalties of not more than $5,000 per violation.

Conclusion

The SHIELD Act has far reaching effects, as any business that holds private information of a New York resident – regardless of whether that organization does business in New York – is required to comply. “The SHIELD Act will put strong safeguards in place to curb data breaches and identity theft,” said Justin Brookman, Director of Privacy and Technology Policy for Consumer Reports. The SHIELD Act signifies how seriously New York, like other states across the nation, is taking privacy and data security matters.  Organizations, regardless of their location, should be assessing and reviewing their data breach prevention and response activities, building robust data protection programs, and investing in written information security programs (WISPs).

Possibly adding to the list of states that have updated their privacy and breach notification laws this year, the Illinois legislature passed Senate Bill 1624 which would update the state’s current breach notification law to require most “data collectors,” which includes entities that, for any purpose, handle, collect, disseminate, or otherwise deal with nonpublic personal information, to notify the State’s Attorney General of certain data breaches. The state’s current statute already requires notification of a data breach to the Attorney Generals’ office, but only in the event of data breach affecting state agencies, and only if those breaches affect more than 250 Illinois residents.

Under the Senate Bill, if a data collector is required to notify more than 500 Illinois residents as a result of a single data breach, that data collector also must notify the Illinois Attorney General’s office. Similar to the requirements in other states requiring Attorney General notification, the law requires certain content be included in the notification:

  •      A description of the nature of the breach of security or unauthorized acquisition or use.
  •      The number of Illinois residents affected by such incident at the time of notification.
  •      Any steps the data collector has taken or plans to take relating to the incident.

In addition, if the date of the breach is unknown at the time the notice is sent to the Attorney General, the data collector must inform the Attorney General of the date of the breach as soon as possible. Note, some states have more extensive content requirements, such as Massachusetts, which requires covered entities that experience a breach to inform the Attorney General (and the Commonwealth’s Office of Consumer Affairs and Business Regulation) about whether the organization maintains a written information security program. The change in Illinois would exclude covered entities or business associates that are subject to the privacy and security regulations under HIPAA, provided they are compliant with those regulations. Of course, covered entities and business associates would still have to notify the federal Office of Civil Rights in the event of a data breach affecting unsecured protected health information.

The change would require the notification to be made in the most expedient time possible and without unreasonable delay, but not later than when the data collector provides notice to individuals affected by the breach. Also joining some other states, such as Massachusetts and New Hampshire, the Senate Bill provides that the Attorney General may publish the name of the data collector that suffered the breach, the types of personal information compromised in the breach, and the date range of the breach.

Should these changes become law, the patchwork of state breach notification laws continues to grow more complex, particularly for organizations that experience multistate data breaches. It is critical, therefore, that organizations are prepared with an incident response plan, one that not only addresses steps to drive systems-related investigations and recovery, but also a timely and compliant communication and notification strategy.

 

 

Employers, you are not out of the CCPA woods yet.

If you have been tracking the proposed amendments to the California Consumer Privacy Act (CCPA), you know that businesses and stakeholders have been clamoring to shape the new sweeping law in a number of ways. We reported earlier this year on some of the potential changes approved by the California Assembly Privacy and Consumer Protection Committee, which moved on for further consideration. Upon arrival at the Senate Judiciary Committee, several of these business-friendly changes met some resistance, including AB 25 which generally would have excluded employee personal information from being covered under the CCPA.

While employers had hoped AB 25 would amend the CCPA to exclude information gathered in the employment context outright, on July 9, 2019, the California Senate Judiciary Committee clarified that will not be the case.

As we previously noted, the Privacy and Consumer Protection Committee in April unanimously approved AB 25 which sought to modify the definition of “consumer” under the CCPA to exclude “a natural person whose personal information has been collected by a business in the course of a person acting as a job applicant to, an employee of, a contractor of, or an agent on behalf of, the business, to the extent the person’s personal information is collected and used solely within the context of the person’s role as a job applicant to, an employee of, a contractor of, or an agent on behalf of, the business.”

A coalition in opposition to AB 25 expressed concerns that the exemptions go too far in eroding the rights of employee consumers, especially in light of current and future workplace monitoring practices. In response to these concerns, the bill’s author, Assemblymember Ed Chau, agreed to amend AB 25 to clarify that while employee data would be excluded from many of the CCPA’s requirements (including permitting consumers to request: the deletion of their personal information; the categories of personal information collected; the sources from which personal information is collected; the purpose for collecting or selling personal information; and the categories of third parties with whom the business shares personal information), employers subject to the CCPA would still be required to inform consumers (including employees) as to the categories of personal information they collect and the purposes for which such personal information shall be used.

Notably, AB 25’s exemption for employee data would not apply to the CCPA’s subdivision which establishes a private right of action, including those brought as a class action, for any consumer whose nonencrypted or nonredacted personal information is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices. This private right of action establishing statutory damages permitting the recovery of damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater.

To afford business and consumer groups time to develop additional legislation to address concerns about employee personal information, Assemblymember Chau further revised AB 25 to specify that the exemption for employee data would only be effective for the 2020 calendar year and would be inoperative on or after January 1, 2021.

As amended, AB 25 unanimously passed through the Senate Judiciary Committee and will now go to the Senate Appropriations Committee, and if passed, to a full Senate for a final vote. AB 25’s amendments highlight the growing recognition of privacy interests in the employment context and the need for businesses to continue to prepare for the CCPA’s effective date.

The California Consumer Privacy Act (CCPA), which goes into effect January 1, 2020, is considered the most robust state privacy law in the United States. The CCPA seems to have spurred a flood of similar legislative proposals on the state level, and started a shift in the consumer privacy law landscape. Many of these proposals end up dying somewhere along the rigorous legislative process, but in the last few weeks both Maine and Nevada signed into law bills that, although much more narrow than the CCPA, certainly bear resemblance.

Maine

Maine Governor Janet Mills recently signed into law the Act to Protect the Privacy of Online Consumer Information, LD 946, which imposes data privacy requirements on Internet service providers (ISPs). This law requires ISPs to obtain customer consent before “using, disclosing, selling or permitting access” to their data with a third party. In addition, an ISP is prohibited from refusing to serve a customer based on their refusal to consent to the data usage terms. Finally, ISPs will also be required to take “reasonable measures” to protect customer personal information from “unauthorized use, disclosure, sale or access”. The law is applicable to all ISPs that service customers physically based and billed for within the State. The Maine law will take effect July 1, 2020.

Nevada

 In late May, Nevada Governor Steve Sisolak signed into law an act relating to Internet privacy, SB 220. Nevada’s new law prohibits an operator of an Internet website or online service which collects “covered information” from consumers from selling that information to a third party without prior consent. “Covered information” is limited to “personally identifiable information” which includes a first and last name, home or other physical address, e-mail address, telephone number, social security number, an identifier that allows a specific person to be contacted either physically or online, and any other information concerning a person collected from the person through the Internet website or online service of the operator and maintained by the operator in combination with an identifier in a form that makes the information personally identifiable. The law takes a limited approach to “sale” which is defined as “the exchange of covered information for monetary consideration by the operator to a person for the person to license or sell the covered information to additional persons”. The law includes several exemptions including financial institutions subject to GLBA, institutions subject to HIPAA, motor vehicle manufacturers and third parties that host or manage Internet websites or online services on behalf of their owners. Notably, the Nevada law will take effect October 1, 2019 (sooner than the CCPA, which becomes effective January 1, 2020).

While both the Maine and Nevada law are much more limited in scope than the CCPA, these types of laws signify how complicated the patchwork of laws will become as more states enact their own privacy laws which are inconsistent and often include mutually exclusive requirements from one another. Other states that are considering or have recently considered consumer privacy legislation include Connecticut, Hawaii, Illinois, Maryland, Massachusetts, New Jersey, New Mexico, North Dakota, Texas and Washington. Needless to say, the compliance challenges for affected organizations will only continue to grow with the passage of each state bill.

 

 

Verizon recently published its 2019 Data Breach Investigations Report. This report is the 12th edition and contains an analysis of 41,686 security incidents with 2,013 confirmed breaches from 73 sources, including public and private entities. Included among its many findings, the report found high-level executives are twelve times more likely to be the target of social incidents, when an information asset is compromised, and nine times more likely to be the target of social breach, a confirm unauthorized disclosure of data, as compared to past years. It explained that senior executives, who typically face a great deal of time pressures and stress, are more likely to unknowingly click on sham emails, which could compromise their data security systems. Moreover, a successful attack on a senior executive can reap large rewards as a senior executive likely has access to critical systems and unchecked approval authority. Indeed, the report notes that financial gain is the primary motivator for all data breaches, representing 71% of breaches. As a close second, espionage accounts for 25% of all breaches.

The report also found an increasing number of cybersecurity attacks on cloud-based environments as many companies and organizations move their data to the cloud. That being said, ransomware attacks continue to be a significant threat, accounting for 24% of all malware incidents.

“Enterprises are increasingly using edge-based applications to deliver credible insights and experience. Supply chain data, video, and other critical – often personal – data will be assembled and analyzed at eye-blink speed, changing how applications utilize secure network capabilities” comments George Fischer, president of Verizon Global Enterprise. “Security must remain front and center when implementing these new applications and architectures.”

In addition to these types of cyberattacks, the report highlights that everyone is susceptible to cybersecurity incidents. In fact, small businesses account for nearly 43% of all cybersecurity victims.

As evidence by the report, the threat of a cybersecurity attack is not going anywhere. Although data security increasingly progresses, bad actors continue to evolve their tactics to obtain unlawfully sensitive data and information, resulting in significant damages to companies and individuals. The FBI found that the median direct loss for a business email compromise is about $8,000 and about $25,000 for a computer data breach.

The ease with which employees acquire, handle and transport massive amounts of sensitive personal information make it critical that businesses ensure their employees, regardless of department or level, have greater awareness of the sensitivity of this information and receive regular training on how to prevent, spot and respond to a cybersecurity attack. This should be a part of any written information security plan.

During a presentation at the Professional Services Council Federal Acquisition Conference on June 13, 2019, a high-ranking Department of Defense (“DoD”) official announced, with dramatic flair, that cybersecurity is an allowable cost:

“I need you all now to get out your pens and you better write this down and tell your teams: Hear it from Katie Arrington [Special Assistant to the Assistant Secretary of Defense for Cyber] . . . security is an allowable cost. Amen, right?”

Channeling Jerry McGuire, Arrington added: “Now what you need to do as industry is help me, help you. I’m not the enemy. I’m literally the one person in government who said, ‘Hi, I’m here to help and I’m legit here to help.’”

Arrington’s June 13 presentation, which was titled “Securing the Supply Chain,” is just the latest indication that the DoD – like other federal and state agencies – is making the cyber hygiene of its contractors a priority. (Some of our previous posts on this topic are available here.)

During a webinar earlier this month, Arrington noted that, “[i]f we were doing all the necessary security controls, we wouldn’t be getting exfiltrated to the level that we are. We need to level set because a good portion of our defense industrial base [(“DIB”)] doesn’t have robust cyber hygiene. Only 1% of DIB companies have implemented all 110 controls from the National Institute of Standards and Technology. We need to get to scale where the vast majority of DIB partners can defend themselves from nation state attacks.”

Arrington, who appears to be actively involved in the DoD’s development of a cybersecurity assessment and certification program, called the Cybersecurity Maturity Model Certification or CMMC, provided additional details about that program during her June 13 presentation.   Specifically, Arrington announced that:

  1. The CMMC will include five levels of certification. The levels will range from “basic” cyber hygiene to “state-of-the-art.”
  2. The CMMC initiative will require DoD contractor information systems to be certified compliant by an outside auditor. Under the new model, third-party cybersecurity certifiers will “conduct audits, collect metrics, and inform risk mitigation for the entire supply chain,” Arrington said. “Every contract that goes out,” she added, “will have a requirement and every vendor on that contract will have to get certified.”
  3. The DoD will hold 12 listening sessions across the country this summer to solicit feedback about the CMMC from industry and other experts.
  4. The DoD aims to complete the CMMC and begin certifying vendors by January 2020; to begin incorporating the CMMC requirements into requests for information by June 2020; and to include the CMMC in solicitations by September 2020.

Driving home her key point that the cybersecurity of its vendors is a major priority for the DoD, Arrington stated that “[c]ost, schedule and performance are only effective in a security environment.” She added that “[w]e cannot look at security and be willing to trade off to get lower cost, better performing product or to get something faster. If we do that, nothing works and it will cost me more in the long run.”

DoD contractors should heed Arrington’s warning that cost, schedule, and performance will not alone suffice to win future DoD contracts. To best position themselves to compete for those contracts, contractors should consider providing feedback to the DoD this summer about the CMMC, and should promptly begin the process of preparing to comply with its mandates.

 

The U.S. Supreme Court issued its long awaited decision in PDR Network LLC v. Carlton, addressing the issue of whether the Hobbs Act requires the district court to accept the 2006 Federal Communication Commission (FCC) Order 2006 (“the Order”), which provides the legal interpretation for the Telephone Consumer Protection Act (TCPA). Unfortunately, the Court did not answer the question presented when it granted certiorari – whether the Hobbs Act required the district court to accept the FCC’s legal interpretation of the TCPA. Instead, the Court held that the extent to which the district court must defer to the FCC depends on two preliminary issues that the Court of Appeals failed to consider: 1) whether the Order is equivalent to a “legislative rule” which has the “force and effect of law” or an “interpretative rule” which does not have the “force and effect of law”, and 2) whether the defendant had the “prior” and “adequate” opportunity to seek judicial review of the Order. As a result, the Fourth Circuit Court of Appeals judgment was reversed, and remanded for the Court to address these issues.

The full length article discussing the Supreme Court’s decision in PDR Network LLC v. Carlton on the Jackson Lewis P.C. website, is available here.

The California Consumer Privacy Act (CCPA), which goes into effect January 1, 2020, is considered the most robust state privacy law in the United States. The CCPA seems to have spurred a flood of similar legislative proposals on the state level, and it was only a matter of time before the Empire State introduced its own version of the law. The New York Privacy Act (NYPA), s5642, introduced last month by New York Senator Kevin Thomas, the Chair of the Consumer Protection Committee, is considered a more expansive version of its California counterpart.

Similar to the CCPA, the NYPA would provide consumers with greater control over their personal data, and impose substantial duties on businesses that control and process data, however the NYPA is distinct from the CCPA in significant ways. Below are several key features of the NYPA:

  • Application: Unlike the CCPA, which only applies to businesses with a threshold of $25 million annual revenue, the NYPA applies to “legal entities that conduct business in New York” or that produce products or services that “intentionally target” New York residents. This means that small-to-medium size businesses, and potentially even not-for-profit organizations will be subject to the law’s privacy and security obligations. Organizations exempted include state and local governments, and personal data that is regulated by HIPAA, HITECH, GLBA and notably, “data sets maintained for employment records purposes”.
  • Consumer Rights: The NYPA provides consumers a broad set of rights over their personal data. Consumer rights include: the right to access, the right to rectification, right to delete, right to stop processing and right to have data portability.   This extends the rights afforded to consumers by the CCPA, as the CCPA does not include a right to rectification.
  • Privacy and Security Obligations: Under the NYPA, covered businesses would be required to “exercise the duty of care, loyalty and confidentiality . . . with respect to securing the personal data of a consumer against a privacy risk; and shall act in the best interests of the consumer, without regard to the interests of the entity, . . . in a manner expected by a reasonable consumer under the circumstances.” In addition businesses are required to “reasonably secure personal data from unauthorized access” and “promptly” notify consumers of a breach. Finally, the law prevents businesses from using personal data in a way that “(i) benefits an online service provider to the detriment of an end user; (ii) would result in reasonably foreseeable physical or financial harm to a consumer; or (iii) would be unexpected and “highly offensive” to a “reasonable consumer.”
  • Enforcement: The New York State Attorney General may bring an action in the name of the state, or on behalf of residents of the state, however a private right of action is also available to any person injured by reason of violation of the law. If passed, this enforcement provision would likely create an influx of litigation. A similar cause of action exists under an Illinois privacy law that you might have heard about, the Illinois Biometric Information Privacy Act or “BIPA.” That provision has resulted in flood of litigation, including putative class actions, seeking to recover statutory damages for plaintiffs who allege their biometric information has been collected and/or disclosed in violation of the statute. This is arguably the most significant difference between the CCPA. Despite several attempts to expand the private right of action, in its current form the CCPA only allows for a private right of action in very limited circumstances, if a nonencrypted or nonredacted personal information is subject to an unauthorized access, exfiltration, theft, or disclosure because the covered business did not meet its duty to implement and maintain reasonable safeguards to protect that information.

The NYPA is still in the very early stages of the legislative process – it has only been reviewed by the Senate’s Consumer Protection Committee, and is still looking for a co-sponsor from the state Assembly. Nonetheless, such an aggressive bill signifies the seriousness in which New York is considering privacy and security matters.  Organizations, regardless of their location, should be assessing and reviewing their data collection activities, building robust data protection programs, and investing in written information security programs (WISPs).