A forthcoming Harvard Law Review article reviewed 857 cases that cited Carpenter v. United States, the landmark Supreme Court Fourth Amendment case, from its publication in June 2018 to March 2021. The purpose of this study was to evaluate the landscape of post-Carpenter Fourth Amendment law.

The full text of the article can be found here.

Continue Reading Aftermath of Carpenter: An Empirical Study of Fourth Amendment Law, 2018-2021

During its plenary session on September 27, 2021, the European Data Protection Board (EDPB) announced that it has set up a cookie banner taskforce to handle complaints filed with several European Economic Area supervisory authorities by the entity known as None of Your Business (NOYB). As you may know, on May 31, 2021 NOYB sent written warnings to over 500 companies claiming that their cookie banners did not comply with GDPR. When the companies failed to remediate all violations within 30 days, NOYB filed 422 complaints with 10 supervisory authorities.

Continue Reading EDPB Establishes Cookie Banner Taskforce

On September 21, 2021, the U.S. Senate Subcommittee on Competition Policy, Antitrust, and Consumer Rights held a hearing on Big Data, Big Questions: Implications for Competition and Consumers. This hearing was part of a series of hearings on a bipartisan review of competition issues in America. Senator Klobuchar led the hearing, with Senators Lee, Blumenthal, Hawley, Ossoff, Blackburn, and Cruz contributing questions to the witnesses. The witnesses included representatives from technology companies, an author, and a director of a nonprofit. Continue Reading Takeaways from U.S. Senate Hearing on Big Data, Big Questions: Implications for Competition and Consumers

Guest Author: Jasmine Zhao, a student at Loyola Law School.

On August 20, 2021, the Personal Information Protection Law (PIPL), regarded as China’s GDPR, was signed into law, and will become effective on November 1, 2021. The PIPL supplements China’s Cybersecurity Law and the Data Security Law, expanding China’s legal framework for the protection and regulation of data security and personal information. The PIPL has an extraterritorial scope, imposing broad disclosure, consent, and cross-border transfer obligations on organizations that provide products or services to or analyze activities of people within China.

Continue Reading China’s Stringent Data Law Will Become Effective Soon

Guest Author: Jodi Daniels, Founder and CEO of Red Clover Advisors

Data privacy is one of the most complicated and important issues facing modern businesses. With laws varying from state to state, even country to country, and best practices frequently changing, it may be more efficient for companies to outsource their privacy program to an expert who specializes in consumer data privacy.

Fractional privacy officers (FPOs) provide high-level privacy consulting and strategy on a part-time, contract basis. They deliver invaluable assistance in translating and applying the requirements of new and established data privacy legislation to existing business practices and are fully qualified to develop new processes if needed for compliance.

There are four main areas where an FPO’s privacy prowess can be highly beneficial: Continue Reading Outsource Your Privacy to an Expert

On August 24, 2021, the office of the California Attorney General (AG) Rob Bonta issued a press release notifying the public of healthcare data privacy guidance that AG Bonta sent to stakeholder organizations, including the California Hospital Association, the California Medical Association, and the California Dental Association, that day. According to the press release, the guidance was sent to stakeholders as a bulletin that, in part, reminded the entities of their obligation to notify the California Department of Justice (DOJ) when the health data of more than 500 California residents has been breached.

Continue Reading California AG Issues Press Release Urging “Full Compliance” with State Health Data Privacy Laws

There have been several notable developments this month at the California Attorney General’s office relating to the CCPA. First, California Attorney General (AG) Rob Bonta held a press conference and issued a press release regarding CCPA enforcement in the past year. AG Bonta signaled that under his leadership, as under prior California Attorneys General, such as now Vice President Kamala Harris and United States Department of Health and Human Services Secretary Xavier Becerra, the AG’s office will continue its focus on privacy. AG Bonta emphasized the importance of the CCPA at a time when so much of our lives has moved online due to the COVID-19 pandemic and that “there’s more work to be done.” He reported “great progress” in CCPA enforcement, noting that 75% of businesses that received a notice of violation came into compliance within the CCPA’s 30-day cure period, while the remaining 25% are within the cure period or currently under active investigation. Continue Reading Recent Developments at the California Attorney General’s Office Concerning the CCPA and Enforcement

On June 25, 2021, the U.S. Supreme Court in TransUnion LLC v. Ramirez (No. 20-297, slip op.) clarified that for standing purposes in federal courts, an important difference exists between (i) a plaintiff’s statutory cause of action to sue over a violation of law, and (ii) a plaintiff suffering concrete harm because of the violation of law. The Court stated that “an injury in law is not an injury in fact” and held that only those plaintiffs who suffer a “concrete injury” apart from the violation of law alone have standing to sue. This case involved TransUnion’s alleged inaccurate reporting of class members as potential threats to America’s national security. Only a subset of the class, however, was the subject of these incorrect reports provided to third parties, and the Court acknowledged only these individuals as having standing to sue. Continue Reading Recent Federal Court Decisions Creating Uncertainty Around CCPA Standing

Last week a new privacy law limiting what businesses can do with biometric data (for example, facial recognition information and fingerprints) took effect in New York City. The new ordinance requires commercial establishments that collect biometric information to post notices to customers explaining how their data will be used. The law applies to a wide range of businesses, including stores, restaurants, and theaters. The ordinance defines “biometric identifier information” as any “physiological or biological characteristic that is used by or on behalf of a commercial establishment, singly or in combination, to identify, or assist in identifying, an individual, including, but not limited to: (i) a retina or iris scan, (ii) a fingerprint or voiceprint, (iii) a scan of hand or face geometry, or any other identifying characteristic.” The law does, however, permit the collection, use, and retention of biometric identifying data if a notice to customers in “plain, simple language” is clearly displayed. The NYC Commissioner of Consumer and Worker Protection is expected to issue further guidance detailing the exact requirements that businesses must follow to comply with the law. Continue Reading Biometrics Privacy Law Takes Effect in NYC