California marked the end of the 2019 legislative session this past Friday, September 13, by passing five out of six pending bills to amend the California Consumer Privacy Act of 2018 (“CCPA”). The bills – AB-25, AB-874, AB-1146, AB-1355 and AB-1564 – now head to California Governor Newsom’s desk for signature, which must occur by October 13 for the bills to be signed into law. The only pending bill not to pass was AB-846, which would have addressed the law’s application to customer loyalty programs; it was ordered to the inactive file at the request of Senator Jackson.

Continue Reading Majority of CCPA Amendment Bills Passed by California Legislature

There are six bills pending before the California legislature that would amend the California Consumer Privacy Act of 2018 (“CCPA”). These bills could significantly alter the law’s application and associated compliance obligations, including with respect to HR data, B2B customer data, loyalty programs and the definition of “personal information.” As of September 12, three bills have passed out of the California Senate and are pending before the Assembly for a concurring vote: AB 874, AB 1146 and AB 1564. The California legislature must vote on all pending CCPA amendment bills no later than this Friday, September 13, after which California Governor Newsom will have until October 13 to sign the bills into law.

Please access our CCPA Amendment Bill Tracker for the most recent updates on each of the pending amendment bills.

On September 6, 2019, the National Institute of Standards and Technology (“NIST”) released a preliminary draft of its Privacy Framework: A Tool for Improving Privacy Through Enterprise Risk Management (“Privacy Framework”).

Continue Reading NIST Releases Draft Privacy Framework

The Cayman Islands Data Protection Law, 2017 (“DPL”), which was published in June 2017, will go into force on September 30, 2019. The DPL includes requirements for the protection of personal data and is centered upon eight data protection principles. According to the newly minted Cayman Islands data protection authority, the DPL aligns the Cayman Islands with other major jurisdictions around the world. It includes many concepts that exist in other comprehensive data protection laws, such as the EU General Data Protection Regulation. For example, the DPL includes personal data processing limitations, individual data subject rights, data breach notification obligations and cross-border transfer restrictions.

Continue Reading Cayman Islands Data Protection Law Goes into Force This Month

On September 4, 2019, the High Court of England and Wales dismissed a challenge to South Wales Police’s use of Automated Facial Recognition technology (“AFR”). The Court determined that the police’s use of AFR had been necessary and proportionate to achieve their statutory obligations.

Continue Reading High Court Dismisses Challenge to Police Use of Facial Recognition Technology

The Centre for Information Policy Leadership (“CIPL”) at Hunton Andrews Kurth LLP is pleased to announce Matthew Starr and Giovanna Carloni have joined CIPL, adding to its expertise in global privacy and data protection policy.

Continue Reading CIPL Welcomes New Privacy Managers Matthew Starr and Giovanna Carloni

As an update to our previous blog posts, the FTC announced that it and the New York Attorney General reached a $170 million agreement with Google to resolve allegations that the company violated COPPA through its YouTube platform. Under the agreement, Google will pay $136 million to the FTC and $34 million to New York. The FTC voted 3-2 to authorize the action.

Continue Reading FTC and Google Reach $170 Million Settlement Over Children’s Privacy on YouTube

On August 29, 2019, the Maryland Insurance Administration issued new breach notification requirements for entities that provide health insurance or related services. The new requirements will apply to insurers, non-profit health plans, HMOs, third-party administrators, and certain other managed care entities. The new rules will take effect on October 1, 2019.

Continue Reading Maryland Insurance Administration Announces New Breach Notification Requirements

As an update to our previous blog post, according to media reports, Google has reached a settlement with the FTC in the range of $150 to $200 million over the agency’s investigation into the company’s alleged violations of COPPA through its YouTube platform. The settlement has not been announced by the FTC or Google, and the details of the settlement have not been made publicly available. These reports follow Google’s announcement earlier this week that it has created a separate YouTube Kids site, which will include different content for different age groups. This news also follows recent media reports that YouTube will end the serving of targeted ads on videos that children are likely to watch. It is not clear if YouTube’s changes are a result of the FTC settlement.

On August 21, 2019, the Swedish Data Protection Authority (the “Swedish DPA”) imposed its first fine since the EU General Data Protection Regulation (“GDPR”) came into effect in May, 2018. The Swedish DPA fined a school 200,000 Swedish Kroner for creating a facial recognition program in violation of the GDPR.

Continue Reading Swedish Data Protection Authority Issues First Fine Under GDPR