U.S. Securities and Exchange Commission Issues Risk Alert Regarding Safeguarding Customer Records and Information Stored on Cloud-Based Platforms

Share

On May 23, 2019, the United States Securities and Exchange Commission (“SEC”)’s Office of Compliance Inspections and Examinations (“OCIE”) issued a Risk Alert entitled “Safeguarding Customer Records and Information in Network Storage – Use of Third Party Security Features” (the “Risk Alert”). The Risk Alert highlights the risks associated with the storage of customer records and information by broker-dealers and investment advisors on cloud-based storage platforms.

Continue reading “U.S. Securities and Exchange Commission Issues Risk Alert Regarding Safeguarding Customer Records and Information Stored on Cloud-Based Platforms”

As Cyberattacks Rise, U.S. Business Readiness Falls

Share

Two recent reports reflect that cyberattacks and resulting data breaches continue to threaten U.S. companies and public entities. The Hiscox Cyber Readiness Report (April 23, 2019), compiled from a survey of more than 1,000 U.S. cybersecurity professionals at private companies and public-sector entities with 50 to 1,000+ employees, found that 53% of firms reported at least one cyberattack – up from 38% in 2018. Interestingly, only 11% of U.S. firms qualified as experts based on their cybersecurity preparedness and responses – down from 26% in last year’s survey; 16% of firms ranked as intermediate, and the remaining 73% ranked as novice. These statistics reflect a continuing need for public- and private-sector emphasis on cybersecurity preparedness and incident response.

Continue reading “As Cyberattacks Rise, U.S. Business Readiness Falls”

Supreme Court Gives Companies Another Tool To Fend Off Data Breach Class Actions

Share

In the wake of data breaches, companies may find themselves targets of class actions by customers or employees whose personal information was compromised in the breach. The exposure is considerable, with an estimated 765 million people impacted by data breaches between April and June of 2018. As we previously reported, some courts have allowed consumer and employee data breach cases to proceed despite threshold challenges – leading to multi-million-dollar settlements. And in Dittman, Pennsylvania’s Supreme Court recently held that an employer owed an affirmative duty to exercise reasonable care to protect employees’ personal nonpublic data from data breaches.

Continue reading “Supreme Court Gives Companies Another Tool To Fend Off Data Breach Class Actions”

California Attorney General’s Office Gathers Public Opinions Regarding the Implementation of the California Consumer Privacy Act

Share

The California Department of Justice has opened up public forums this month as part of the Attorney General’s rulemaking process to promulgate regulations under the California Consumer Privacy Act of 2018 (CCPA). We previously discussed the Attorney General’s Office’s public statement regarding the CCPA here.

As required by the CCPA, the Attorney General must adopt certain regulations on or before July 1, 2020. In holding these public forums, the Attorney General’s Office hopes to provide an initial opportunity for the public to participate in establishing procedures to facilitate consumers’ rights under the CCPA and to provide guidance for business compliance. Specifically, the following aspects are of high priority: businesses’ obligation to disclose data collection and sharing practices to consumers; consumer rights to request deletion of data; consumer rights to opt out of having their personal information sold to third parties; and restrictions on the sale of personal information of consumers under the age of 16 without explicit consent. The Attorney General’s Office scheduled six public forums across different counties in California and invites in-person attendance or written submissions of public comments through February 2019.

Continue reading “California Attorney General’s Office Gathers Public Opinions Regarding the Implementation of the California Consumer Privacy Act”

The Devil is in the Definitions for Federal Consumer Data Privacy Safeguards

Share

The Senate Commerce Committee held a hearing “Examining Safeguards for Consumer Data Privacy” on September 26, which included testimony from tech industry executives.

Senator John Thune’s opening statement noted that with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) have put the issue of consumer data privacy squarely on the Congress’s doorstep. “The question is no longer whether we need a federal law to protect consumers’ privacy,” he said. “The question is what shape that law should take.”

Continue reading “The Devil is in the Definitions for Federal Consumer Data Privacy Safeguards”

Attorney General’s Cyber-Digital Task Force Assesses Cyber Threats and Response Efforts in New Report

Share

The Attorney General’s Cyber-Digital Task Force has released its first report, which provides a detailed assessment of the cyber threats facing the United States and discusses the ways the Department of Justice (DOJ) is combatting and preparing to combat those threats.

Continue reading “Attorney General’s Cyber-Digital Task Force Assesses Cyber Threats and Response Efforts in New Report”