On March 8, 2018, the Ninth Circuit issued its highly anticipated decision in In re Zappos.com, Inc., finding that allegations of future risk of identity theft from a data breach are sufficient to confer standing. This decision fuels an ongoing circuit split, pitting the D.C., Sixth, Seventh and now Ninth Circuits against the Second, Fourth, and Eighth Circuits over whether the mere exposure of personal information – without actual identity theft or credit/debit card fraud – establishes Article III standing.
Amended Colorado bill aims to enhance data privacy laws
As Data Protection Report posted on January 29, 2018, lawmakers in Colorado are considering legislation that, if enacted, would significantly strengthen Colorado’s data privacy protections. On Wednesday, February 14, 2018, an amended bill passed unanimously in Colorado’s House Committee on State, Veterans and Military Affairs.
South Dakota and Colorado strengthen data breach protections
Last week, South Dakota moved closer to implementing a data breach notification law, while Colorado legislators introduced a new bill requiring “reasonable security procedures,” imposing data disposal rules and shortening the time frame in which to alert authorities regarding a breach. South Dakota and Colorado are the latest states taking steps in cybersecurity lawmaking in light of Congress’s inaction regarding data breach legislation.
Tennessee and Nebraska Amend Their Data Breach Notification Laws
Two states, Tennessee and Nebraska, have recently enacted changes to their data breach notification laws that will go into effect in July. Here’s what you need to know about each:
Senate passes cybersecurity bill, bringing immunity for sharing cyberthreat data closer to reality
On October 27, 2015, the Cybersecurity Information Sharing Act of 2015 (CISA), passed the Senate, by a 74-21 vote. The bill’s passing by such an overwhelming majority is a crucial step towards the controversial CISA becoming law, with support from some security experts and to the chagrin of other privacy advocates.
Russia signs controversial “right to be forgotten” bill into law
Russian President Vladimir Putin has signed into law the “right to be forgotten” legislation, which allows individuals in Russia to demand removal of a search engine’s links to personal information deemed irrelevant or inadequate. The law will go into effect on January 1, 2016.
Canada amends federal data protection law, PIPEDA
On June 18, 2015, Canada’s Senate and House of Commons passed the Digital Privacy Act to amend the country’s federal Personal Information Protection and Electronic Documents Act (PIPEDA). Many of the amendments are scheduled to come into force on a date to be determined by the government. The revised requirements (highlighted below) will have a significant impact on the treatment of personal information by organizations that are subject to PIPEDA. These are organizations that either are federally regulated and fall under the legislative authority of the Parliament of Canada, or operate within a province that does not have in place data protection legislation that has been determined to be substantially similar to PIPEDA (all Canadian provinces other than Alberta, British Columbia and Quebec).
Three amendments are noteworthy for businesses subject to PIPEDA.
Nevada amends data security law to expand definition of “Personal Information”
On May 13, 2015, Governor Brian Sandoval of Nevada signed Assembly Bill No. 179 (“AB 179”) into law. AB 179 amends Nevada Revised Statutes § 603A.040, which defines “Personal Information” for Nevada’s laws on the security of personal information. This amendment will take effect on July 1, 2015.