Privacy Law Blog

Financial Industry Groups Criticize New York Department of Financial Services Cybersecurity Proposal; New Draft to be Released on December 28, 2016

As we previously reported, in September 2016 the New York Department of Financial Services (the “DFS”) proposed a regulation that would require banks, insurance companies and other financial services institutions regulated by the DFS to adopt broad cybersecurity protections (the “Proposal”). The comment period for the Proposal closed in mid-November.

In late December, a DFS spokesman said that a revised Proposal will be filed with the state register on December 28, 2016 (followed by a new thirty-day comment period) and that the revised Proposal will come into effect on March 1, 2017 (two months later than the Proposal’s previous effective date of January 1, 2017).

Continue Reading

European DPAs Issue First GDPR Guidance

On Friday, the Article 29 Working Party issued official guidance relating to the General Data Protection Regulation, or GDPR (which we’ve covered in previous posts here and here). The Article 29 Working Party is comprised of representatives of the various EU Member States’ data protection authorities (DPAs), so this marks the first time that the DPAs have revealed their thoughts on how they plan to interpret and enforce specific GDPR provisions.  This is welcome news for companies that, until this point, have been left to figure out compliance strategies without any indication as to how some of the newer concepts the GDPR introduces will operate in practice when the Regulation begins to apply in 2018.

Continue Reading

Shareholders Denied Suit Against Home Depot Over Data Breach

Judge Thomas W. Thrash Jr. of the U.S. District Court of Georgia permanently shelved a derivative suit brought by shareholders of Home Depot.

Home Depot is a multinational home improvement retailer. In September, 2014, Home Depot suffered a data breach that resulted in $192 million in net losses. This breach followed the widely publicized data breaches at several other major retailers and department stores.

Shareholder plaintiffs argued that defendants should have installed basic network security infrastructure to prevent the breach. Specifically, plaintiffs asserted that Home Depot failed to have a firewall, a properly maintained malware and antivirus software, and a policy to regularly test the network and delete cardholder data. This failure was allegedly a breach of Home Depot’s duties of care and loyalty, a waste of corporate assets, and a violation of the Securities Exchange Act, according to plaintiffs.

Read the full post on Minding Your Business blog.

 

New Privacy Developments in France

DataGuidance spoke with Cécile Martin, Special International Counsel at Proskauer Rose LLP, at the International Association of Privacy Professionals’ Conference in Brussels in November 2016. Cécile discussed the passing of the Digital Republic Bill and its implications for organizations, as well as the latest developments regarding employee monitoring in France and the upcoming changes with the GDPR. Continue Reading

The Clock Has Started: What ISPs Need to Do and When to Comply with the FCC’s Broadband Privacy Rules

On December 2, 2016, the Federal Communications Commission (“FCC”) published its Report and Order entitled “Protecting the Privacy of Customers of Broadband and Other Telecommunications Services” (the “Order”) as a final rule in the Federal Register, adopting rules applicable to Internet service providers (“ISPs”) intended to protect the privacy of broadband consumers. Despite the publication of the rules in the Federal Register, uncertainty remains regarding when ISPs must be in compliance with some of these newly established privacy obligations. Although the rules are effective January 3, 2017, the FCC has made exceptions to the January 3, 2017 effective date for provisions which have not yet been approved by the Office of Management and Budget (“OMB”).[1] This includes many of the operative provisions of the new rules regarding ISPs’ data collection and use. Once such provisions are approved by the OMB, notice will be published in the Federal Register announcing their approval and corresponding effective dates.

Despite the uncertainty regarding the effective dates of many sections, the publication of the Order puts ISPs on notice of the new rules, and ISPs should begin revising their practices so that they are able to meet the earliest possible effective dates. Here is what ISPs need to know regarding compliance with the new rules:

Continue Reading

Privacy Law in Saudi Arabia: A Primer for Businesses

Proskauer litigation associate Courtney Bowman and Jonathan Reardon, head of the Al Khobar, Saudi Arabia office of the Middle East-based firm Al Tamini & Co., recently co-authored an article published by Corporate Counsel about privacy laws in Saudi Arabia.  The article provides valuable insight into the Kingdom’s privacy regime and focuses specifically on the central role Sharia plays in Saudi jurisprudence, including in the privacy realm. It also provides an overview of those laws that touch specifically on privacy matters, making it a must-read for those companies that are already present in that country or thinking about entering the market.  Click here to read the full article.

EU Court Rules that Dynamic IP Addresses are Personal Data…Sometimes

On October 19, the Court of Justice of the European Union (CJEU) ruled that dynamic IP addresses may qualify as “personal data” under EU privacy law. As we covered here on the blog a few months ago, this decision is significant because it clarifies that companies that collect, store, process, and/or transfer dynamic IP addresses belonging to EU users may have to treat them in accordance with the stringent restrictions that EU law imposes on the handling of personal data. As a refresher, an IP (short for “Internet protocol”) address is a series of numbers allocated to a specific device that identifies a device and allows it to access an electronic communications network, such as the Internet.  IP addresses can be either “dynamic” or “static”; dynamic IP addresses, which are more common, change every time the device connects to the Internet, while static IP addresses remain constant and do not change every time the device re-connects.

Continue Reading

LexBlog