On November 15, 2022, the Federal Trade Commission announced a six-month extension for companies to comply with certain updated requirements of the Gramm-Leach-Bliley Act’s Safeguards Rule, a set of data security provisions covered financial institutions must implement to protect their customers’ personal information. The new deadline is June 9, 2023.
Continue Reading FTC Announces Six-Month Extension for Compliance with Some Changes to Gramm-Leach-Bliley Safeguards RuleUK ICO Publishes New Guidance and a Tool for Transfer Risk Assessments
Posted on
On November 17, 2022, the UK data protection regulator, the Information Commissioner’s Office (“ICO”), published updated guidance on international transfers that includes a new section on transfer risk assessments (“TRAs”) and a TRA tool.
In its statement regarding the updated guidance, the ICO describes the TRA guidance as “an alternative approach to the one put forward by the European Data Protection Board” and says its aim is “to find an alternative, achievable approach delivering the right protection for the people the data is about, whilst ensuring that the assessment is reasonable and proportionate.”
Continue Reading UK ICO Publishes New Guidance and a Tool for Transfer Risk AssessmentsFacebook’s $90M Privacy Deal Gets Final Nod Over Objections
Posted on
Posted in Information Security, Online Privacy
On November 14, 2022, Judge Edward J. Davila of the Northern District of California approved a $90 million privacy settlement against Meta Platforms, Inc. (formerly Facebook, Inc.) for unlawfully tracking user information when users were logged out of the site. Under the order granting plaintiffs’ motion for final approval of the class action settlement and attorney fees, Facebook must pay $90 million dollars in settlements, of which $26.1 million will be for attorney fees, and delete certain “wrongfully collected” data. Despite numerous objections that the settlement amount was inadequate, the judge found the final settlement to be “fair, reasonable and adequate.” This settlement brings an end to litigation going back to 2011.
Google Agrees to $391.5 Million Settlement with 40 States over Misleading Location Tracking Practices
Posted on
Posted in Information Security, U.S. State Law
On November 14, 2022, Google LLC (“Google”) agreed to a $391.5 million settlement with the attorneys general of 40 U.S. states over the company’s location tracking controls available in its user account settings.
The investigation by the state attorneys general found that, between 2014 and 2020, Google misled users by failing to disclose that toggling the “Location History” setting to off did not disable all tracking activities. The settlement noted that Google retained the ability to track users’ location via the “Web & App Activity” setting, and used the information for targeted advertising purposes.
Continue Reading Google Agrees to $391.5 Million Settlement with 40 States over Misleading Location Tracking PracticesHouse Energy and Commerce Leaders Demand Information from Various Toy Manufacturers
Posted on
On October 26, 2022, House Energy and Commerce Committee and Consumer Protection and Commerce Subcommittee leaders (“Committee Leaders”) sent letters to several toy manufacturers, including Bandai Namco, Hasbro, Mattel, MGA Entertainment, LEGO Group and the Toy Association, asking how they plan to protect children and their information from BigTech companies like TikTok and YouTube. Given the shift of marketing efforts from traditional television outlets to social media platforms, Committee Leaders are concerned about failure to protect children’s privacy, security and mental health on social media platforms.
Continue Reading House Energy and Commerce Leaders Demand Information from Various Toy ManufacturersFTC PrivacyCon 2022 Highlights
Posted on
Posted in Children’s Privacy
On November 1, 2022, the Federal Trade Commission hosted their annual PrivacyCon 2022, which was available to the public via webcast. The FTC held seven different panels highlighting the latest research and trends in consumer privacy and data security.
Continue Reading FTC PrivacyCon 2022 HighlightsPennsylvania Amends Breach Notification Law
Posted on
On November 3, 2022, Pennsylvania Governor Tom Wolf signed Senate Bill 696 into law (the “Act”), amending Pennsylvania’s breach notification law.
Continue Reading Pennsylvania Amends Breach Notification LawEU Digital Markets Act Enters into Force
Posted on
On November 1, 2022, the Digital Markets Act (the “DMA”) entered into force. The DMA introduces new rules for certain core platforms services acting as “gatekeepers” in the digital sector (including search engines, social networks, online advertising services, cloud computing, video-sharing services, messaging services, operating systems and online intermediation services). The DMA also aims to prevent such platforms from imposing unfair conditions on businesses and consumers, and to ensure the openness of important digital services.
Continue Reading EU Digital Markets Act Enters into ForceCFPB Re-Opens Public Comment on Prior Orders Seeking Information on Big Tech Payment Platforms
Posted on
Posted in Financial Privacy, Information Security
On October 31, 2022, the Consumer Financial Protection Bureau (“CFPB”) announced that it will re-open the public comment period on their October 2021 Orders for six large technology companies operating payments platforms to provide information about their business practices. The October 2021 Orders requested that Amazon, Apple, Facebook, Google, PayPal and Square provide information about their data collection and use, their policies for removing individuals and businesses from their platforms, and their policies and practices for providing consumer protections such as addressing disputes and errors.
Continue Reading CFPB Re-Opens Public Comment on Prior Orders Seeking Information on Big Tech Payment PlatformsGoogle Enters into Agreement with DOJ over 2016 Search Warrant Data Loss
Posted on
Posted in Enforcement, U.S. Federal Law
On October 25, 2022, the U.S. Department of Justice (“DOJ” or the “Department”) announced that Google had entered into an agreement to resolve a dispute over the loss of data responsive to a search warrant issued in 2016.
Continue Reading Google Enters into Agreement with DOJ over 2016 Search Warrant Data Loss