In May, we told you about proposed revisions to the Illinois Biometric Information Privacy Act (“BIPA”) that should provide some welcome relief for defendants. Governor J.B. Pritzker has now signed that reform legislation into law.Continue Reading BIPA Bellwether: Governor signs BIPA reform bill
In a welcome change for defendants, a recent amendment to the Biometric Information Privacy Act (“BIPA”) is expected to significantly curtail potential damages under the statute. SB 2979, which passed the General Assembly on May 16, 2024, clarifies that damages are per individual, rather than per violation, for violations of the collection provision under Section 15(b) and the disclosure provision under Section 15(d). Continue Reading BIPA Bellwether: General Assembly provides relief from “per scan” damages
Last week, the U.S. Securities and Exchange Commission (“SEC”) became the latest federal regulator to implement a data breach notification law. The commissioners unanimously voted to approve amendments to Regulation S-P (the “Final Rule”)—the regulation governing the use of consumers’ personal information and records—to require certain financial institutions to adopt and maintain data incident response procedures and to require notification to consumers of the potential compromise of their data within 30 days of discovery.Continue Reading SEC Joins Chorus of Regulators Requiring Data Breach Notifications
For years, we were able to tell most clients experiencing a potential data security incident that they likely had at least 30 days to notify any third parties about the incident – if they concluded it was a breach. There were, of course, exceptions in certain regulated industries, but most companies fell within the scope of the general state data breach notification statutes, none of which required a response sooner than 30 days. And for many years, we didn’t have to worry about more urgent deadlines created by federal authorities. Continue Reading Breach Response: Is 72 hours the new 30 days?
Back in July, we shared some good news out of California when a state court judge ruled that the newest regulations under the California Consumer Privacy Act (“CCPA”) could not be enforced until March 2024. But last week, the agency charged with enforcing the CCPA – the California Privacy Protection Agency (with the confusingly similar abbreviation of the “CPPA”) – won reversal of that opinion on appeal. The ruling now gives the CPPA the authority to begin enforcing immediately the regulations that it enacted in March 2023.Continue Reading Delay Lifted in CCPA Regulations Enforcement
Just over halfway through 2023, nationwide TCPA jurisprudence is focused on further delineating the scope of the TCPA. As the dust settles from earlier battles over defining ATDS requirements, the cases from this year are largely aimed at establishing who can bring a claim under the TCPA and what conduct the statute covers. We summarize here developments since our last update, listed in alphabetical order by topic area.Continue Reading TCPA Turnstile: Scoping out the TCPA – 2023 Midyear Update (TCPA Case Update Vol. 18)
Companies that have been wrestling with exactly how to comply with the latest regulations under the California Consumer Privacy Act (“CCPA”) can breathe a sigh of relief after a California state court judge ruled last week that the newest regulations cannot be enforced until March 2024. If you’re familiar with the changes to the CCPA, you know that regulators were supposed to have the accompanying regulations in place by July 2022, but failed to do so – in fact, the regulations were not final until March 29, 2023, nearly three months after the statutory effective date of January 1, 2023. The California Privacy Protection Agency (“CPPA”) voluntarily extended the enforcement deadline to July 1, 2023, but even then, many companies were left scrambling until last Friday, when Judge James Arguelles of the Superior Court of California in Sacramento County entered an injunction barring enforcement of the regulations until March 2024.Continue Reading A Welcome Delay in CCPA Regulations Enforcement
As 2022 comes to a close, we wanted to look back at the most significant Telephone Consumer Protection Act, 47 U.S.C. § 227 (“TCPA”) decisions of the year. While we didn’t see the types of landscape-altering decisions that we saw in 2021, there’s still plenty to take note of. We summarize here the biggest developments since our last update, listed by issue category in alphabetical order.
Continue Reading TCPA Turnstile: 2022 Year in Review (TCPA Case Update Vol. 17)
Much ink has been spilled over the Executive Order Enhancing Safeguards for United States Signals Intelligence Activities (the “Executive Order”) signed by President Biden in early October. The Executive Order is supposed to establish the United States’ commitments reflected in the March 25, 2022 joint EU-U.S. announcement of the Trans-Atlantic Data Privacy Framework (the “Framework”). While the Framework is described as an “agreement in principle” to facilitate cross-border transfer of personal data, the Executive Order is supposed to go further, toward actually implementing the promised protective measures. But does it?
Continue Reading Does the Latest Move in Trans-Atlantic Privacy Really Change the Game?
One of the best ways for companies facing media and privacy risk to protect themselves from expensive class action litigation is by including an arbitration provision in the applicable terms and conditions. While it’s not always clear at the outset of litigation whether the plaintiff agreed to the terms, companies often have to invoke arbitration quickly out of fear that they will be found to have waived arbitration. But in its coming term, the U.S. Supreme Court is now poised to address the critical point of whether prejudice to the plaintiff is a necessary element for a finding of waiver.
Continue Reading Supreme Court to address role of “prejudice” in evaluating waiver of arbitrability