Tag archives: cybersecurity

White House Issues Cybersecurity Order

By on Posted in General, Regulatory response
Data Protection Report - Norton Rose FulbrightOn May 11th, 2017, the White House released an executive order on strengthening the cybersecurity of federal networks and critical infrastructure (the “Order”).  The Order marks the administration’s first successful effort to address cybersecurity, after an earlier draft executive order on cybersecurity was postponed in January. The Order is divided into three substantive sections covering … Continue reading

IAPP San Francisco KnowledgeNet Event – Privacy Developments in Asia

By on Posted in General
Data Protection Report - Norton Rose FulbrightPlease join us for a panel discussion as we host the upcoming IAPP San Francisco Bay Area KnowledgeNet Chapter meeting on April 27, 2017. This presentation will focus on the new China Cybersecurity Law, the latest developments with Asia-Pacific Economic Cooperation (APEC) Cross Border Privacy Rules (CBPR), and privacy laws in Asia. Panelists: Anna Gamvros, … Continue reading

Event: Cybersecurity Updates in the Financial Services Sector – April 6, 2017

By on Posted in General
Data Protection Report - Norton Rose FulbrightPlease join us for a 40-minute briefing on the latest developments in cybersecurity and what the financial services sector needs to know in order to comply. There are new regulatory initiatives at the international, US national and US state levels. With the consistent threat of security breach, financial institutions need to be aware of the latest developments … Continue reading

IAPP Web Conference – The New Chinese Cybersecurity Law

By on Posted in General
Barbara Li, a partner in Norton Rose Fulbright’s Beijing office, recently spoke on an International Association of Privacy Professionals (IAPP) Recorded Web Conference discussing legal updates surrounding the cybersecurity law passed in November 2016 that imposes new cybersecurity data governance requirements on companies doing business in and with China. The law encompasses both “network operators,” defined essentially as … Continue reading

FDA issues final guidance on postmarket medical device cybersecurity

Anna Rudawski (US)By Anna Rudawski (US) on Posted in Compliance and risk management, Regulatory response
Data Protection Report - Norton Rose FulbrightOn December 28, 2016, the U.S. Food and Drug Administration (FDA) released final guidance on the management of cybersecurity vulnerabilities for marketed and distributed medical devices.  The guidance establishes a risk-based approach for the reporting of medical device cybersecurity vulnerabilities to the FDA.… Continue reading

US Commission on Enhancing National Cybersecurity: Action Plan for the President-Elect

Anna Rudawski (US)By Anna Rudawski (US) on Posted in Compliance and risk management, Regulatory response
Data Protection Report - Norton Rose FulbrightThe US Commission on Enhancing National Cybersecurity, a nonpartisan group established by President Obama in early 2016, released its final report on December 1, 2016. The report provides an in-depth view of cybersecurity challenges facing the digital economy, and provides a roadmap for addressing those challenges. For some issues, the Commission recommends that the next … Continue reading

Michigan PSC Orders Staff to Draft Rules for Utility Cybersecurity Reporting

By on Posted in Compliance and risk management, Regulatory response
Data Protection Report - Norton Rose FulbrightThe cybersecurity practices and procedures of public utility companies servicing Michigan residents will soon be subject to examination by the Michigan Public Service Commission (MPSC).  In an Order issued on November 22, 2016, the MPSC directed its staff to develop rules requiring public utility companies to report to the MPSC on the utilities’ cybersecurity practices and … Continue reading

China Cybersecurity: New Law Increases Security Regulation Over Cyberspace

Anna Gamvros (HK)Barbara Li (CN)By Anna Gamvros (HK) and Barbara Li (CN) on Posted in Compliance and risk management, Regulatory response
Data Protection Report - Norton Rose FulbrightOn November 7, 2016, the Standing Committee of China’s National People’s Congress (NPC) voted to pass the Cyber Security Law (unofficial English translation). Its draft has gone through three rounds of readings and it will become effective from June 1, 2017. This legislation provides for the Chinese government’s supervisory jurisdiction over cyberspace, defines security obligations for … Continue reading

Recent Developments from Our Sister Blogs

By on Posted in General
Data protection and privacy issues frequently intersect with other areas of the law. In addition to the Data Protection Report, Norton Rose Fulbright publishes other blogs covering important legal developments across the globe. These blogs sometimes touch on issues that may be of interest to our readers. As a service to our readers, we highlight … Continue reading

Major DDoS Attacks Signal Need for Strengthened Cyber Defenses

Daniel Leslie (CA)By Daniel Leslie (CA) on Posted in Compliance and risk management, Cybercrime
Data Protection Report - Norton Rose FulbrightOn Friday, October 21, a series of Distributed Denial of Service (DDoS) attacks were launched against the servers of Dyn, a major DNS host. DNS hosts operate in a manner akin to a switchboard for the Internet, helping to route domain names (e.g., dataprotectionreport.com) to underlying IP addresses (e.g., 104.28.6.115). By attacking Dyn, hackers were … Continue reading

FTC Enforcement Possible for Failing to Guard Against Ransomware

By on Posted in Compliance and risk management, Cybercrime, Regulatory response
Data Protection Report - Norton Rose FulbrightRecent comments by FTC Chairwoman Edith Ramirez suggest that a company’s failure to take preventative measures to address ransomware could result in an enforcement action by the FTC, even if a company is never actually subject to a ransomware attack. The Chairwoman’s comments reflect a growing concern among US government agencies regarding ransomware and may … Continue reading

NIS Directive Published: EU Member States Have Just Under Two Years to Implement

Lara White (UK)Marcus Evans (UK)By Lara White (UK) and Marcus Evans (UK) on Posted in Regulatory response
Data Protection Report - Norton Rose FulbrightThe Directive on Security of Network and Information Systems (known as the NIS Directive) was published in the Official Journal of the European Union on July 19, 2016. Member States will have until May 9, 2018 to implement this Directive into national laws and a further six months to identify “operators of essential services.” Summary … Continue reading

The Intersection of Trademark Law and Cybersecurity

By on Posted in Cybercrime, General
US Supreme Court expands digital privacy rights in Carpenter v. United StatesEarlier this week, our colleague Sue Ross wrote on the intersection of trademark law and cybersecurity on Norton Rose Fulbright’s Brand Protection Blog. The post explains that by protecting its brand, a company can help to improve cybersecurity. For example, by seeking to recover “squatted” domain names and complaining to social networks about trademark infringement, a company … Continue reading

Final CISA Guidance for Cybersecurity Information Sharing Published

By on Posted in Compliance and risk management, Data breach, Regulatory response
Data Protection Report - Norton Rose FulbrightOn June 15, 2016, the U.S. Department of Homeland Security (“DHS”) and Department of Justice issued Final Procedures Related to the Receipt of Cyber Threat Indicators and Defensive Measures by the Federal Government (“Final Procedures”) that provide information on how DHS will implement the Cybersecurity Information Sharing Act of 2015 (“CISA”). The Final Procedures were … Continue reading

IADC Issues Cybersecurity Guidelines for Drilling Assets

Jeffrey Webb (US)By Jeffrey Webb (US) on Posted in Compliance and risk management
Data Protection Report - Norton Rose FulbrightWith infrastructure cybersecurity becoming a growing concern for businesses globally, it is not surprising that yet another industry association – the International Association of Drilling Contractors (“IADC”) – has issued cybersecurity guidelines for its members.  IADC’s Guidelines for Assessing and Managing Cybersecurity Risks to Drilling Assets address the cyber risks affecting the “digital oilfield” – … Continue reading

Hong Kong Securities and Futures Commission Focuses on Cybersecurity

Anna Gamvros (HK)By Anna Gamvros (HK) on Posted in Compliance and risk management, Regulatory response, Vendor management and transactions
Data Protection Report - Norton Rose FulbrightWith its continued focus on cybersecurity, the Hong Kong Securities and Futures Commission (SFC) recently issued a circular to all its licensed corporations (LCs) identifying key areas of concern and suggesting cybersecurity controls. Hong Kong does not have any overarching cybersecurity legislation, and industry-specific regulatory activity in relation to cybersecurity has been limited to date. … Continue reading

U.S. Government Publishes CISA Guidance for Cybersecurity Information Sharing

By on Posted in Compliance and risk management, Data breach, Regulatory response
Data Protection Report - Norton Rose FulbrightEarlier this month, the U.S. Department of Homeland Security (DHS) and Department of Justice (DOJ) issued joint interim guidance on private entities’ sharing of cyber threat indicators and defensive measures with the government and other private entities. As we have written, Congress required the agencies to develop and publish this guidance through the Cybersecurity Information … Continue reading

Caution ahead – Internet of Things and cyber insurance – A talk with Chris Valasek, the “Jeep Hacker” event

By on Posted in Compliance and risk management
US Supreme Court expands digital privacy rights in Carpenter v. United StatesOn Thursday, January 28, Boris Segalis and David Navetta, who co-chair Norton Rose Fulbright’s Data Protection, Privacy and Cybersecurity practice in the US, invite you to join Chris Valasek, security lead at Uber Advanced Technology Center and recognized “Jeep Hacker,” along with a panel of our cybersecurity professionals, for an intimate discussion on the revolutionary possibilities … Continue reading

Council and European Parliament reach agreement on NIS Directive

Jay Modrall (BE)Marcus Evans (UK)By Jay Modrall (BE) and Marcus Evans (UK) on Posted in Cybercrime, Regulatory response
Data Protection Report - Norton Rose FulbrightOn December 7, 2015, the Council of the European Union (the Council) reached an informal agreement with the European Parliament on a new EU directive on network and information security (NISD). The agreement marks the conclusion of two years of work, since the European Commission (the Commission) and the High Representative of the European Union … Continue reading

Heightened cybersecurity standards: a good bet for U.S. futures market participants

By on Posted in Regulatory response
Data Protection Report - Norton Rose FulbrightMembers of the U.S. futures market will soon be measured against heightened cybersecurity standards geared towards enhancing incident preparation, prevention, and response among industry participants regulated by the National Futures Association (NFA)—a non-profit enforcement entity tasked with overseeing futures trading in collaboration with the Commodity Futures Trading Commission (CFTC).  Earlier this year, the NFA submitted … Continue reading

South Africa’s new Cybercrimes and Cybersecurity Bill

Kerri Gevers (ZA)By Kerri Gevers (ZA) on Posted in Cybercrime, General, Regulatory response
Data Protection Report - Norton Rose FulbrightThe South African Cybercrimes and Cybersecurity Bill expands on the original sections of the Electronic Communications and Transactions Act, 2002 (ECTA) with the creation of 20 new cybercrime offences.  This illustrates the extent to which technology is being used for unlawful purposes and the need to protect yourself in your activities online.  Comments on the Bill … Continue reading

Schrems Counterpoint: ECJ has good reasons to reject Safe Harbor invalidation

Jay Modrall (BE)Marcus Evans (UK)By Jay Modrall (BE) and Marcus Evans (UK) on Posted in Regulatory response
Data Protection Report - Norton Rose FulbrightThe European Court of Justice (ECJ) is expected to rule on Case C-362/14 (the “Schrems” case) on October 6, 2015.  In deciding whether to reject or adopt its Advocate General’s recommendation to invalidate the US-EU Safe Harbor, the ECJ finds itself between the proverbial rock and a hard place. Rejecting the Safe Harbor would lead to uncertainty in the ongoing … Continue reading
LexBlog