Privacy law is becoming more technically sophisticated. So should you.
Posted in Compliance and risk management, Privacy lawTopic: Compliance and risk management
Subscribe to Compliance and risk management RSS feed Posted in Compliance and risk management, Privacy lawFor whom the bell tolls: FTC, regulators and private parties are coming for online tracking technologies
Posted in Compliance and risk management
Over a year ago the FTC fired the first warning shot – the FTC health breach notification rule would be used as the basis for enforcement actions where sites and apps shared health information without a user’s permission. Following suit, a few months ago, OCR announced guidance of its own that expanded the class of … Continue reading
HHS: Online trackers without prior authorization and BAAs can violate HIPAA
Posted in Compliance and risk management
HHS: Online trackers without prior authorization and BAAs can violate HIPAA By Steve Roosa, Sue Ross, Dan Rosenzweig On the evening of December 1, 2022, the U.S. Department of Health and Human Services (HHS) issued a 12-page Bulletin titled “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (the “Bulletin”). In the … Continue reading
Another Day, another large BIPA Settlement
Posted in BIPA, Compliance and risk management, Privacy law
It appears Snap has become the most recent company to pay a settlement for alleged violations of Illinois Biometric Information Privacy Act (“BIPA”). The law, which gives consumers a private right of action, has become a popular class action and source of significant penalties. Indeed, Snap joins a string of other companies that have already … Continue reading
OSFI’s Technology and Cyber Risk Management Guideline: Part 1
Posted in Compliance and risk management, Cybersecurity
On July 13, 2022, the Office of the Superintendent of Financial Institutions (OSFI) released its final Guideline B-13 (the Guideline), setting out technology and cyber risk management expectations for all federally regulated financial institutions (FRFIs), such as banks, insurance and trust companies. FRFIs will need ensure that they have taken steps to comply with the requirements … Continue reading
Practical steps for businesses to comply with Bill C-27: Part 1
Posted in Compliance and risk management, Privacy law
The House of Commons recently introduced Bill C-27, the successor to Bill C-11, which died on the docket when Parliament was dissolved in the fall of 2021. Bill C-27 introduces three new acts: the Consumer Privacy Protection Act (“CPPA”), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (“AIDA”), which … Continue reading
The aftermath of an incident – business considerations surrounding record-keeping
In our previous publication, we discussed the legal obligations and procedural considerations surrounding maintaining records of privacy incidents. While the specific obligations vary by jurisdiction, maintaining some form of a record that tracks privacy incidents is a statutory obligation for private-sector organizations subject to Quebec, Alberta, or federal laws. Organizations should also be aware of … Continue reading
TSA Transitions To Results-Based Approach in Revised Pipeline Cybersecurity Directive In Response to Industry Feedback
Posted in Compliance and risk management, CybersecurityBill C-26: a first step at reinforcing Canadian cybersecurity
Posted in Compliance and risk management, Cybersecurity
On June 14, the House of Commons introduced Bill C-26: An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts (Bill C-26). This bill is presented in two parts: The first is to amend the Telecommunications Act to promote the security of the Canadian telecommunications system; The second is to enact the Critical Cyber … Continue reading
UK GDPR Reform: government publishes response to consultation – likely to form basis of forthcoming UK Data Reform Bill
The aftermath of an incident – why keeping records of data breaches and privacy incidents matters
As privacy incidents and security breaches involving personal information become increasingly frequent, organizations are more and more aware of the importance of implementing a robust privacy program to mitigate the risks and impacts of such incidents. While this preparation is important, organizations must also consider the aftermath of a privacy incident. In this first blog … Continue reading
Maybe This Time : Federal Government Proposes the American Data Privacy and Protection Act
Posted in CCPA, Compliance and risk management, Privacy lawAnother fine for over-retention of data
Posted in Compliance and risk managementA third regulator has recently entered into a proposed consent that includes a $500,000 fine based in part on a company’s over-retention of personal data for longer than it was needed. The first regulator was the French data protection authority, the CNIL, in 2021, which we wrote about here. The second regulator was the New … Continue reading
CPRA Rulemaking Delayed – California Privacy Protection Agency Meets and Previews CPRA Rulemaking Timeline
Posted in CCPA, Compliance and risk management, Privacy lawOn February 17, 2022 the California Privacy Protection Agency’s Board (“Board”) met to discuss their progress launching the new agency. They also shared their projected timeline for rulemaking. The California Privacy Protection Agency (CPPA) is the new agency charged with enforcing the California Privacy Rights Act (CPRA). The big news is that the Board … Continue reading
Rejecting cookies should be as easy as accepting cookies: new sanctions by the French authority (CNIL)
Posted in Compliance and risk management, EnforcementBelgian DPA fines IAB Europe over its consent framework’s GDPR violations
Posted in Compliance and risk managementOn 2 February 2022, the Belgian Data Protection Authority (the BDPA) fined IAB Europe for various infringements in relation to the IAB Transparency and Consent Framework. This decision could have a huge impact on the majority of players in the online adtech ecosystem who rely on the framework. Background The Interactive Advertising Bureau Europe’s (IAB) … Continue reading
Illinois Supreme Court Rules that Compensation Act is not a bar to BIPA Damages
Illinois’ Biometric Information Privacy Act (“BIPA”) is considered the most comprehensive law governing the processing of biometric data. Passed in 2008, BIPA sets out requirements for private entities, including employers, that collect, use, store, and share biometric information. It’s also one of the most popular class action suits today – hundreds, if not thousands of … Continue reading
Privacy legislation reform: Bill 64 has now been passed
Apple iOS 15’s new privacy features that industries should know
Apple recently released the latest version of its iPhone operating system, iOS 15. While iOS 15 currently has only a 15% adoption rate, the new operating system brings a slew of new features that are privacy-specific and can impact businesses. Read more on the NT Analyzer blog.… Continue reading
UK Government sets out proposals to shake up UK data protection laws
Posted in Compliance and risk management, General
On 10 September 2021, the UK Government published its consultation paper on proposals to reform the UK’s data protection regime. The deadline for responding to the consultation is 19 November 2021. In August, the Government announced that it intended to “seize the opportunity” afforded by the UK’s exit from the European Union to makes some … Continue reading
Over-retention of personal data
Posted in Compliance and risk management
The declining cost of electronic data storage may have caused some company executives to conclude that retaining personal data forever is “cheap.” Perhaps the CNIL’s €1.75 million (USD $2,051,930) penalty for over-retention will lead to a different view. The matter involved one of France’s largest insurers, SGAM AG2R LA MONDIALE, which was subject to an … Continue reading
PIPL: A game changer for companies in China
Posted in Compliance and risk management, Cybersecurity
China passed its Personal Information Protection Law (PIPL) on 20 August 2021. This is China’s first omnibus data protection law, and will take effect from 1 November 2021 allowing companies just over two months to prepare themselves. The PIPL is a game changer for any company with data or business in China. It will add … Continue reading
China passes the Personal Information Protection Law
Posted in Compliance and risk management, Cybersecurity
China passed its Personal Information Protection Law (PIPL) on 20 August 2021. The new law will take effect from 1 November 2021 allowing companies just over 2 months to prepare themselves. The full text has not been made public yet. In addition, China published the Provisions on the Administration of Security of Automobile Data (For … Continue reading
Top practical tips on the preservation, collection and review of mobile data in investigations.
Posted in Compliance and risk managementRemote working has accelerated the merger of work and private data, particularly on mobile phones and instant messaging services such as WhatsApp. While employees are performing their jobs, mobile access may be putting their employers at risk – because work-related communications on unapproved platforms are frequently not preserved in accordance with regulatory requirements (where applicable), … Continue reading
