$8 million penalty to NYDFS – and another case of over-retention

2024 was not a happy new year for Genesis Global Trading, Inc. (“GGT”).  On January 3, 2024, the New York Department of Financial Services announced a consent order with GGT, where GGT agreed to pay NYDFS $8 million and to surrender its BitLicense (for cryptocurrency trading), due to alleged violations of NYDFS’ cybersecurity and its … Continue reading

Thailand – The Regulation with respect to Cross-border Transfer of Personal Data

On 25 December 2023, the Personal Data Protection Committee (PDPC) published two notifications detailing regulations for cross-border transfers of personal data under Sections 28 and 29 (Notifications) of the Personal Data Protection Act B.E. 2562 (2019) (PDPA). These Notifications are the Adequacy Country Notification and the Appropriate Safeguard Notificationrespectively. Key information In summary, the Adequacy … Continue reading

ICYMI –December in privacy and cybersecurity

December tends to be a busy time for everyone, so you may have missed a privacy update or two.  We have set out some updates in the form of questions, with links in the answers where you can find more information.  (For those making this quiz a competitive event, we have included a tie-breaker/bonus question.)  … Continue reading

FCC adopts updated data breach notification rules to protect consumers

On December 13, 2023, the Federal Communications Commission (FCC) voted to update a 16-year-old privacy rule expanding breach notification requirements for telecommunications, interconnected Voice over Internet Protocol (VoIP), and telecommunications relay services (TRS). Under the new rule, these companies are now required to adequately safeguard sensitive customer information in an attempt to hold phone companies … Continue reading

How to Effectively Draft Data Processing Agreements to Protect Information Shared with Service Providers – Part 2

PadlockIn our previous post, we discussed specific considerations for common boilerplate provisions in data processing agreements (DPAs). Due to the sensitivity of data transfers and privacy laws, DPAs require careful drafting to ensure the data processor complies with appropriate privacy obligations and is responsible for any non-compliance. This post takes a closer look at DPA-specific … Continue reading

The EU’s AI Act: the position is agreed

In the early hours of the morning of Saturday 9 December 2023, the European Parliament (the Parliament) and the Council of the EU (the Council) reached an agreement on the outstanding points on the EU’s Regulation on artificial intelligence (AI Act).  Talks had previously stalled over how to regulate AI trained on large amounts of … Continue reading

How to Effectively Draft Data Processing Agreements to Protect Information Shared with Service Providers – Part 1

PadlockModern businesses collect and process personal information about their customers and employees for the benefit of their business – these benefits include identifying opportunities to enhance their products or services, streamlining operations, reducing costs or maximizing profits. Processing such data is often outsourced to a third-party data processing service provider. For example, third parties may … Continue reading

California proposes rules for automated decision-making

On November 27, 2023, the California Privacy Protection Agency (“CPPA”) released a first draft of rules for automated decision-making technologies under California’s privacy law. The proposed rules revolve around providing notice of the technology’s use, opting out, and consumer access to business information. In general, the proposed rules would require businesses using automated decision-making technology … Continue reading

Managing AI risks and legal implications, effective cybersecurity, ensuring privacy and the integrity of organizational records

Coloured lightsIn a world where generative AI is driving innovation and technology is outpacing legislation, there’s a lot for companies to consider to maintain operational effectiveness and minimize risk. To help provide some guidance, Norton Rose Fulbright Canada hosted its 2023 technology, privacy and cybersecurity virtual summit. Our leading lawyers were joined by prominent industry leaders … Continue reading

Artificial Intelligence (Regulation) Bill: UK Private Members’ Bill underscores wide-spread regulatory concerns

A Private Members’ Bill, the Artificial Intelligence (Regulation) Bill (the Bill), has been introduced into House of Lords (the UK’s upper House of the UK Parliament) and is currently at the second Parliamentary stage. The King’s Speech, which set out the agenda for the current Parliamentary session, did not contain any proposals from the Government for legislation on AI, … Continue reading
LexBlog