Photo of Gabriella Gallego

Associate Gabriella Gallego has experience with data security and privacy litigation matters involving the Electronic Communications Privacy Act, Stored Communications Act and other federal and state statutes.

On February 25, 2022, the Utah Senate unanimously (28-0) passed Senate Bill 227, also known as the Utah Consumer Privacy Act (Privacy Act). The 2022 session adjourned on March 4, and Utah Governor Spencer Cox has 20 days from that date to either sign (or not sign) the bill, after which it becomes law, or veto the bill, in which case it does not become a law unless the legislature overrides the governor’s veto. The Privacy Act would become the fourth comprehensive state consumer privacy law in the United States.
Continue Reading Utah Consumer Privacy Act on the Horizon

During its plenary session on September 27, 2021, the European Data Protection Board (EDPB) announced that it has set up a cookie banner taskforce to handle complaints filed with several European Economic Area supervisory authorities by the entity known as None of Your Business (NOYB). As you may know, on May 31, 2021 NOYB sent written warnings to over 500 companies claiming that their cookie banners did not comply with GDPR. When the companies failed to remediate all violations within 30 days, NOYB filed 422 complaints with 10 supervisory authorities.

Continue Reading EDPB Establishes Cookie Banner Taskforce

On March 15, 2021, the California Attorney General approved additional regulations for the California Consumer Privacy Act (CCPA), which focuses on the right to the right to opt-out of sale, authorized agents, and notices to consumers under 16 years of age.  Specifically, sections 999.306, 999.315, 999.326 and 999.332 were revised and/or added to the CCPA regulations in this final review.  This privacy quick tip highlights the changes that were made.
Continue Reading California Attorney General Approves New Regulations Governing the California Consumer Privacy Act

The Brazilian General Data Protection Law (LGPD) has been effective for almost six months.  Since then, there have been movements to form the National Data Protection Authority responsible for enforcing the law (ANDP), guidance on best practices for data security has been published and private enforcement of the LGPD is underway.  This quick tip will shed some light on how Brazil’s landmark privacy legislation has made way despite the continuing COVID-19 pandemic.
Continue Reading LGPD Updates: Six Months Out

As we approach the California Consumer Privacy Act’s (CCPA) effective date of January 1, 2020, brick-and-mortar businesses that increasingly engage with consumers online will have to begin their compliance efforts. However, two challenges unique to brick-and-mortar businesses might hamper these efforts: (1) providing required disclosures to consumers before or at the point of data collection; and (2) knowing your data in a multi-channel environment.

The CCPA requires businesses to give consumers notice of their rights and/or data collection practices on three separate occasions: (1) in the online privacy policy [section 1798.130(a)(5)]; (2) “at or before the point of collection” [section 1798.100(b)]; and (3) in response to a verifiable consumer request. The later business obligation is straight forward. But providing privacy notices at or before the point of collection might be challenging for brick-and-mortar businesses.

Continue Reading Compliance Challenges for Brick-and-Mortars Under the CCPA

At the core of complying with the CCPA is knowing how to deal with consumer’s requests with respect to any of the eight rights regarding their personal information (PI), which are:

  1. An abbreviated right to disclosure regarding PI collected (§1798.100)
  2. An expanded right to disclosure regarding PI collected (§1798.110(a))
  3. Right to disclosure regarding PI sold or disclosed for a business purpose (§1798.115)
  4. Right to opt-out of sale of PI (§1798.120)
  5. Right to opt-in for sale of minor’s PI (§1798.120(c))
  6. Right to deletion of PI collected (§1798.105)
  7. Right to access PI (§1798.100(d))
  8. Right to not be discriminated against (§1798.125)


Continue Reading CCPA 12-Month Compliance Series Part 5: Responding to Consumer Requests