Hunton Andrews Kurth LLP, in coordination with the U.S. Chamber of Commerce, recently issued a report setting forth best practices for an effective data breach notification framework. This blog entry provides a link to download the report.
Continue Reading
Personal Information
Supreme Court of Pennsylvania Ruling on Common Law Duty to Protect Electronic Employee Data
Posted on
Posted in Cybersecurity, Security Breach
On November 21, 2018, the Supreme Court of Pennsylvania found that a putative class action against UPMC by current and former employees should not have been dismissed. Employers have common law duty to use reasonable care to safeguard its employees’ sensitive personal information that it stores on Internet-accessible computer systems, and Pennsylvania’s economic loss doctrine did not bar the plaintiffs’ negligence claim.…
Continue Reading
Medical Transcription Vendor Agrees to $200,000 Settlement with New Jersey Attorney General
Posted on
Posted in Enforcement, Health Privacy
On October 30, 2018, ATA Consulting LLC agreed to a $200,000 settlement with the New Jersey Attorney General resulting from a server misconfiguration that allowed private medical records to be posted publicly online.…
Continue Reading
Canadian Regulator Issues Final Guidance on New Data Breach Reporting Requirements
Posted on
Posted in Information Security, International
On October 29, 2018, the Office of the Privacy Commissioner of Canada released final guidance regarding how businesses may satisfy the reporting and record-keeping obligations under Canada’s new data breach reporting law. …
Continue Reading
FTC Releases Staff Perspective on Informational Injuries
Posted on
Posted in Cybersecurity
On October 19, 2018, the FTC announced that it released the Staff Perspective on the Informational Injury Workshop, which summarized the outcomes of a workshop it hosted on December 12, 2017 to discuss and better understand “informational injuries.” …
Continue Reading
SEC Fines Broker-Dealer $1 Million in First Enforcement Action Under Identity Theft Rule
Posted on
Posted in Enforcement, Identity Theft
On September 26, 2018, the SEC announced a settlement with Voya Financial Advisers, Inc., a registered investment advisor and broker-dealer, for violating Regulation S-ID, as well as Regulation S-P. Together, Regulations S-ID and S-P are designed to require covered entities to help protect customers from the risk of identity theft and to safeguard confidential customer information. The settlement represents the first SEC enforcement action brought under Regulation S-ID.…
Continue Reading
Chipotle Consumer Plaintiffs’ Putative Class Case Survives in Part
Posted on
Posted in Cybersecurity, Security Breach
On September 26, 2018, the U.S. District Court for the District of Colorado refused to dismiss all putative class claims against Chipotle Mexican Grill, Inc. This litigation arose from a 2017 data breach in which hackers stole customers’ payment card and other personal information by using malicious software to access the point-of-sale systems at Chipotle’s locations. …
Continue Reading
Uber Settles with 50 State Attorneys General for $148 Million In Connection with 2016 Data Breach
Posted on
On September 26, 2018, Uber Technologies Inc. agreed to a settlement with all 50 U.S. state attorneys general in connection with a 2016 data breach affecting the personal information (including driver’s license numbers) of approximately 607,000 Uber drivers nationwide, as well as approximately 57 million consumers’ email addresses and phone numbers.…
Continue Reading
New Federal Credit Freeze Law Eliminates Fees, Provides for Year-Long Fraud Alerts
Posted on
Posted in Financial Privacy, U.S. Federal Law
Effective September 21, 2018, Section 301 of the Economic Growth, Regulatory Relief, and Consumer Protection Act requires consumer reporting agencies to provide free credit freezes and year-long fraud alerts to consumers throughout the country. …
Continue Reading
Apple to Require Privacy Policies for All New Apps and App Updates
Posted on
Posted in Online Privacy
On August 30, 2018, Apple announced a June update to its App Store Review Guidelines that will require each developer to provide its privacy policy as part of the app review process and include in such policy specific content requirements. Effective October 3, 2018, all new apps and app updates must include a link to the developer’s privacy policy before they can be submitted for distribution to users through the App Store or through TestFlight external testing. …
Continue Reading