The Big Apple now demands big commitments from financial institutions regarding cybersecurity practices. Yesterday, the New York State Department of Financial Services (“NYDFS”) adopted its second set of amendments to its 2015 “Cybersecurity Requirements For Financial Services Companies” (“Amended Cybersecurity Regulation”), with some amendments immediately going into effect. The law requires “covered entities,” including but limited to financial institutions or insurance providers authorized to conduct business in New York, to implement and maintain a cybersecurity program, to report cybersecurity events, and to annually certify their compliance with the law. The Amended Cybersecurity Regulation now requires:Continue Reading Security State of Mind: Amendments to NYDFS’s Cybersecurity Regulation Go Live
The Patchwork Continues… Montana, Tennessee, and Indiana Pass Comprehensive Data Privacy Laws
Continuing the state-by-state legislative trend, three more state legislatures; Indiana, Montana, and Tennessee (via their respective “Acts”); have passed comprehensive data privacy laws. Even while a federal comprehensive data privacy law remains elusive, these laws join the patchwork of data privacy laws in California, Colorado, Connecticut, Iowa, Utah, and Virginia. Below are some highlights from these Acts:Continue Reading The Patchwork Continues… Montana, Tennessee, and Indiana Pass Comprehensive Data Privacy Laws
An “Apple A Day” Does Not Keep Washington Regulators and Consumers Away: Washington Passes My Health My Data Act
On April 18, 2023, the Washington legislature passed the My Health My Data Act (the “Health Act”), a broad-sweeping data privacy and protection law governing individual personal health data. Although this bill is pending Governor Jay Inslee’s signature, the privacy community expects signature this year and braces itself for this novel law.Continue Reading An “Apple A Day” Does Not Keep Washington Regulators and Consumers Away: Washington Passes My Health My Data Act
If You Pass It, They Will Comply (Someday): Iowa Becomes Latest State to Pass Comprehensive Data Privacy Law
Iowa became the sixth state to pass a comprehensive data privacy law, joining California, Colorado, Connecticut, Utah, and Virginia. Instead of standing out from the crowd, the Iowa legislature passed a law that imposes attenuated obligations stated in those other states’ laws . Below are some highlights from the Act relating to consumer data protection (the “Iowa Act”):Continue Reading If You Pass It, They Will Comply (Someday): Iowa Becomes Latest State to Pass Comprehensive Data Privacy Law
BetterHelp… Themselves: FTC Fines Company for Improper Deceptive Advertising Practices
The Federal Trade Commission (“FTC”) recently issued a proposed order requiring BetterHelp, an online counseling service, to pay $7.8 million over misrepresentations to consumers and improper disclosures of consumers’ health information to advertisers, such as Facebook, Snapchat, Criteo, and Pinterest.[1] This order and consent agreement comes a month after the FTC entered a settlement with GoodRx for similar privacy violations, which we examined in the following article here.Continue Reading BetterHelp… Themselves: FTC Fines Company for Improper Deceptive Advertising Practices
From Your “Clicks” To Targeted Ads: FTC Fines Company for Its “Deceptive” Use of Pixels
How does Facebook know you want sugar-free snacks? These personal ads may have targeted you based on your online searches or a refill of your diabetes medicine collected by the digital health company GoodRx. GoodRx has been sending this personal health information such as prescription information to ad platforms like Facebook and Google to use and monetize your data.
But the Federal Trade Commission did not approve of GoodRx’s actions and, last Wednesday, fined the digital health company for its “deceptive practices” in the disclosure of personal and health information to third-party advertising companies and platforms like Meta and Google for advertisement purposes.[1] At the core of the complaint, the FTC cited the inconsistencies between the statements made in GoodRx’s privacy policy and its actual business practices, specifically, the company’s use of online tracking tools such as web beacons and software development kits (generally referred to as pixels) for targeted and personalized ads.Continue Reading From Your “Clicks” To Targeted Ads: FTC Fines Company for Its “Deceptive” Use of Pixels
Are BIPA Claims a Runaway Train? Defendant Hit With $228 Million Federal Jury Verdict in Rogers v. BNSF Railway
On Wednesday, a federal jury broke new ground for lawsuits alleging violations of the Illinois Biometric Information Privacy Act (BIPA). Rogers v. BNSF Railway Co. is the first BIPA class action to go to trial in Illinois, and after only five days of trial and a mere hour of deliberation, the jury returned a verdict in favor of the plaintiff resulting in a whopping $228 million damage award to the class.
Continue Reading Are BIPA Claims a Runaway Train? Defendant Hit With $228 Million Federal Jury Verdict in Rogers v. BNSF Railway
Another Brick in the Wall: California’s Age-appropriate Design Code Act
School is in session and companies are preparing for the slew of new data privacy laws taking effect through 2023 into 2024 but California piled on more homework for those companies handling data of minors. On September 15, 2022, California Governor Gavin Newsom signed into law the California Age-Appropriate Design Code Act (the “Act”).[1] Modeled from UK’s Age-Appropriate Design Code, the Act imposes novel legal obligations on entities that provide “an online service, product, or feature likely to be accessed by children.” The obligations stem from the common belief that “children are particularly vulnerable from negotiating perspective with respect to their privacy rights.” [2]
Continue Reading Another Brick in the Wall: California’s Age-appropriate Design Code Act
Cyberattack Reporting Requirements Included in Spending Deal
Note: This story featuring commentary from Dykema’s Cinthia Granados Motley was originally published by Bloomberg Gov.
- Critical infrastructure industries would have to report hacks
- Spending deal heading for House vote later on Wednesday
By Maria Curi | March 9, 2022, 5:31AM ET
Cybersecurity legislation that would impose new hack and ransomware reporting requirements on businesses was included in a spending bill lawmakers unveiled early Wednesday.
The Senate passed the cyber reporting requirements on March 1 under a bill (S. 3600) from Sen. Gary Peters (D-Mich). Peters previewed their inclusion in the spending bill Tuesday.
Continue Reading Cyberattack Reporting Requirements Included in Spending Deal
FTC Launches Investigation Into Facebook, Twitter, and Other Social Media Sites
The Federal Trade Commission’s increased activity in the data security arena continues, as the FTC has ordered nine social media and video streaming companies—including Facebook, Twitter, TikTok, and Reddit—to provide data on their data privacy practices. The orders seek to discover on (i) how these companies collect, use and present personal information, (ii) their advertising, (iii) their user engagement practices, and (iv) how their practices affect children and teenagers.
In issuing the orders, the FTC focused on social media’s monetization of users’ activities and “the industry’s increasing intrusion into our private lives.” In a joint statement, the FTC wrote:
Continue Reading FTC Launches Investigation Into Facebook, Twitter, and Other Social Media Sites