With the states taking the lead on privacy (see our tip here), the federal government is starting to get in on the action.

Last week, on January 16, 2019, Republican Sen. Marco Rubio introduced the American Data Dissemination (ADD) Act (S. 142). Recognizing the lack of a single comprehensive federal privacy law, the ADD Act seeks to “provide a national consumer data privacy law that protects both consumers and the innovative capabilities of the internet economy.” It instructs the Federal Trade Commission (FTC) to prepare privacy regulations applicable to “covered providers”—i.e., persons who provide a service that uses the internet to collect records containing personally identifiable information—for approval by Congress that are substantially similar to the requirements under the Privacy Act of 1974. Among other things, the FTC would be required to establish criteria for exempting small or newly formed providers, to restrict disclosure of records, and to provide consumers with rights to access and correct their personal data. The ADD Act, if enacted, would preempt the California Consumer Privacy Act (see our CCPA page here) and other state privacy laws, including the recently introduced New York privacy bill, which would establish a privacy bill of rights for New York residents.
Continue Reading Federal Privacy Bills Introduced

The California Office of the Attorney General (OAG or Office) held the first two of its six public forums on January 8, 2019 in San Francisco and on January 14, 2019 in San Diego to solicit public comments and feedback in preparation for its rulemaking efforts under the California Consumer Privacy Act (CCPA). The OAG specifically welcomed comments across seven rulemaking categories that are included in the responsibility of the OAG:

  1. Categories of “personal information”
  2. Definition of “unique identifier”
  3. Exceptions to the CCPA
  4. Submitting and complying with requests
  5. The uniform opt-out logo or button
  6. What notices and information should businesses be required to provide to consumers
  7. Verification of consumers’ requests

In San Francisco, 14 speakers from businesses, nonprofit organizations, trade associations, universities, Perkins Coie and individual consumers sought clarifications to definitions in, and scope of, the statute and provided specific suggestions. In San Diego, a total of five speakers, including representatives from a trade association and a cybersecurity consulting firm, shared their input.
Continue Reading California AG Hosts the First Two Public Forums on California Consumer Privacy Act

Privacy policies are meant for a host of audiences, including consumers, regulators and advocates. One way to make your privacy policy more accessible to consumers is to include a short form privacy notice at the start of a policy. Short form notices deliver essential elements of how information is treated and protected, provide means to access the full policy, and often include essential privacy choices, such as opt-ins or opt-outs.
Continue Reading Should You Provide a Short Form Privacy Notice?

The second annual review of the EU-U.S. Privacy Shield framework is currently underway, with the European Commission planning to release a report detailing its findings regarding the effectiveness of the Privacy Shield by January 1, 2019. The Privacy Shield framework was created to act as a conduit between the respective privacy approaches of the European Union and the United States. In July, the European Parliament warned that it would suspend the EU-U.S. Privacy Shield agreement unless the United States took steps to demonstrate its obligations under the framework. Since then, the United States has been collaborating with the European Union to preserve the international data flows in place under the Privacy Shield, emphasizing its importance for both EU and U.S. consumers and businesses.
Continue Reading Is the Privacy Shield Here to Stay?

Are you collecting, using or disclosing personal information (PI) of Canadian residents in the course of commercial activities? If so, you may be subject to Canada’s Breach of Security Safeguards Regulations(Regulations), under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Under the Regulations, which went into effect on November 1, 2018, organizations that are subject to PIPEDA are required to report security breaches involving PI that “pose a real risk of significant harm,” notify affected individuals of the breach, and maintain records of every breach, reported or not, for at least two years. Businesses that fail to comply with the Regulations may be subject to fines of up to CA$100,000 per offense.
Continue Reading Canada’s New Breach Regulations

You might have heard of data brokers—entities that collect personal information and analyze, append, and repackage it for sale to third parties—from reports such as the FTC’s 2014 study or a 2017 proposed congressional bill that would have imposed breach notification obligations on brokers following the Equifax breach. But you may have never thought that your company’s practices could land you in this category.

Beginning on January 1, 2019, Vermont will be the first state in the nation to regulate data brokers that process personal information regarding its residents. This new law incorporates a very broad definition of “data broker” and requires businesses defined as such to register annually and report on security breaches to the Secretary of State. 
Continue Reading Vermont Data Broker Law – Could You Be a Data Broker?

Does your company use mobile apps, Internet of Things, AI, health tech or other technologies to develop consumer profiles, create products or deliver targeted advertising? If so, you should be aware that the technologies used to perform these tasks are highly regulated and the subject of multiple privacy and data security laws. Specifically, it is worth asking your digital marketing department whether it is using persistent unique identifiers (or IDs) to track users. Persistent IDs are the tools that marketers use behind the scenes to connect consumers with their devices. The information gathered is used for marketing, product development and analytics.
Continue Reading Persistent Identifiers Used in Digital Marketing Are Personal Information and Governed by Multiple Privacy Laws

Privacy and data security are front page news. Companies know they need a privacy compliance strategy but are often daunted by the prospect of how and where to begin. There is a plethora of global and U.S. laws, e.g., the GDPR50 different state standards for data breach notification, sector-specific laws, and the first state attempt to put comprehensive privacy protections in place for its residents.
Continue Reading Best Practices for Creating a Comprehensive Privacy Program