On March 31, 2021, the Dutch Data Protection Authority, announced a fine of 475,000 Euros for Dutch headquartered online travel agency Booking.com for failure to report a data breach within 72 hours of becoming aware of the incident in 2019.
Continue Reading Dutch Regulator Fines Booking.com 475,000 Euros for Late Breach Reporting
Penalty
OCR Continues to Settle HIPAA Right of Access Initiative Cases
Posted on
The U.S. Department of Health and Human Services’ Office for Civil Rights recently announced more settlements associated with its HIPAA Right of Access Initiative.…
Continue Reading OCR Continues to Settle HIPAA Right of Access Initiative Cases
NYDFS Settles with Mortgage Company for Data Breach
Posted on
The New York Department of Financial Services recently announced it had entered into a settlement with Residential Mortgage Services, Inc. related to allegations that the company violated the NYDFS Cybersecurity Regulation in connection with a 2019 data breach. …
Continue Reading NYDFS Settles with Mortgage Company for Data Breach
CNIL Fines a Data Controller and Its Processor 225,000 Euros for Security Violation in Connection with Credential Stuffing
Posted on
On January 27, 2021, the French Data Protection Authority announced that it imposed a fine of 150,000 Euros on a data controller, and a fine of 75,000 Euros on its data processor, for failure to implement adequate security measures to protect customers’ personal data against credential stuffing attacks on the website of the data controller. The CNIL decided not to make its decisions public, thereby not disclosing the name of the companies sanctioned.…
Continue Reading CNIL Fines a Data Controller and Its Processor 225,000 Euros for Security Violation in Connection with Credential Stuffing
FTC Settles with Fertility-Tracking App Developer Regarding Health Data Disclosures
Posted on
On January 13, 2021, the FTC announced that fertility-app developer Flo Health, Inc. (“Flo”) agreed to a settlement over allegations that the company shared app users’ health information with third-party data analytics providers despite representations that Flo would keep such information private.…
Continue Reading FTC Settles with Fertility-Tracking App Developer Regarding Health Data Disclosures
Irish DPA Issues Fine of 450,000 Euros Against Twitter for Data Breach Following EDPB Decision under the GDPR Consistency Mechanism
Posted on
On December 15, 2020, the Irish Data Protection Commission announced its fine of 450,000 Euros against Twitter International Company, following its investigation into a breach resulting from a bug in Twitter’s design. The fine is the largest issued by the Irish DPC under the GDPR to date and is also its first against a U.S.-based organization. …
Continue Reading Irish DPA Issues Fine of 450,000 Euros Against Twitter for Data Breach Following EDPB Decision under the GDPR Consistency Mechanism
CNIL Fines Google and Amazon 135 Million Euros for Alleged Cookie Violations
Posted on
On December 10, 2020, the French Data Protection Authority announced that it has levied fines on Google LLC, Google Ireland Limited and Amazon Europe Core for alleged violations of the French cookie rules. This post examines the French cookie rules, CNIL’s territorial jurisdiction, the investigations and the sanctions levied against each company.…
Continue Reading CNIL Fines Google and Amazon 135 Million Euros for Alleged Cookie Violations
CNIL Fines Two Companies of the Carrefour Group 3.05 Million Euros for GDPR and Cookie Violations
Posted on
On November 26, 2020, the French Data Protection Authority announced that it imposed a fine of €2.25 million on Carrefour France and a fine of €800,000 on Carrefour Banque for various violations of the EU General Data Protection Regulation and Article 82 of the French Data Protection Act governing the use of cookies. …
Continue Reading CNIL Fines Two Companies of the Carrefour Group 3.05 Million Euros for GDPR and Cookie Violations
Dutch Court Overturns DPA Fine on Legitimate Interest Legal Basis
Posted on
On November 23, 2020, the Dutch District Court of Midden-Nederland determined that the concept of a legitimate interest for processing is broader than simply being an interest derived from law, overturning a fine by the Dutch data protection authority.…
Continue Reading Dutch Court Overturns DPA Fine on Legitimate Interest Legal Basis
Home Depot Agrees to Pay $17.5 Million in Multistate Settlement Following 2014 Data Breach
Posted on
On November 24, 2020, a multistate coalition of Attorneys General announced that The Home Depot, Inc. agreed to pay $17.5 million and implement a series of data security practices in response to a data breach the company experienced in 2014.…
Continue Reading Home Depot Agrees to Pay $17.5 Million in Multistate Settlement Following 2014 Data Breach