RSS FEEDSRecent Posts
- Requirements for Businesses under Virginia’s New Consumer Data Protection Act
- Putting M.D. Anderson in Context: Unpacking the 5th Circuit Dismissal of HIPAA Penalties
- Eleventh Circuit Joins Courts That Have Declined to Find Standing Based on Alleged Substantial Risk of Identity Theft Resulting From a Data Breach
- U.S. Department of Commerce Proposed Restrictions to Secure the IT Supply Chain
- Ransomware On the Rise: Unwary Victims May Pay Twice
- Federal U.S. Autonomous Vehicle Bill Would Update Safety Standards and Require Detailed Privacy and Cybersecurity Plans
- Transactional Components of Telehealth Contracts
- In the Wake of Schrems II: US Government’s White Paper Aims to Assist Confused Companies, Push Back on “Wild West” Privacy Characterization
- Latest Draft of Washington Privacy Act Addresses Pandemic Contact Tracing
- Considerations When Receiving a Civil Investigative Demand
Steven M. Wernikoff
Co-Leader, Data, Privacy, and Cybersecurity Group
Co-Leader, Autonomous Vehicles Group
Showing 9 posts by Steven M. Wernikoff.
Requirements for Businesses under Virginia’s New Consumer Data Protection Act
With Governor Ralph Northam’s signature yesterday, the Consumer Data Protection Act (“CDPA”) became law, making Virginia the second state after California to enact a comprehensive privacy law (with apologies to Nevada, which also has passed more modest privacy legislation). Although similar in many respects to the California Consumer Privacy Act (“CCPA”), which was recently updated by the Consumer Privacy Rights Act (“CPRA”), the law contains terminology more consistent with the European Union’s General Data Protection Regulation (“GDPR”). More
Eleventh Circuit Joins Courts That Have Declined to Find Standing Based on Alleged Substantial Risk of Identity Theft Resulting From a Data Breach
In Tsao v. Captiva MVP Restaurant Partners, LLC, the Eleventh Circuit joined the federal appellate courts holding that a consumer’s exposure to a substantial risk of future identity theft, and efforts to mitigate the risk of future identity theft, are not sufficient to confer Article III standing. The decision highlights federal court’s struggle with the standing requirements in a data breach case, and possibly raises the likelihood that the U.S. Supreme Court will address the issue. More
Ransomware On the Rise: Unwary Victims May Pay Twice
Given the speculation and concern over ransomware attacks impacting the 2020 U.S. election, the recent spate of private companies falling victim to such attacks, and the October 1, 2020 advisory issued by the Department of Treasury (“Advisory”), it is no surprise that ransomware is trending in cybersecurity. More
Federal U.S. Autonomous Vehicle Bill Would Update Safety Standards and Require Detailed Privacy and Cybersecurity Plans
On September 23, 2020, Representatives Bob Latta (R-Ohio) and Greg Walden (R-Ore.) re-introduced the “Safely Ensuring Lives Future Deployment and Research In Vehicle Evolution Act’’ or the ‘‘SELF DRIVE Act” to create a federal framework for autonomous vehicles (“AVs”). The measure lacks bipartisan support and is not expected to reach the floor of the House of Representatives during this session. But the continued effort demonstrates the importance that many lawmakers put on promoting a U.S.-led effort in the development of self-driving vehicles. The matter likely will be among the key transportation themes before the next session of Congress, which convenes in January. On the Senate side, policymakers have not advanced autonomous vehicle bills. In the previous congressional session, an autonomous vehicle policy measure advanced in the House but came up short in the Senate. More
Considerations When Receiving a Civil Investigative Demand
A number of U.S. federal agencies have authority to issue a type of administrative subpoena called a Civil Investigative Demand (“CID”) to obtain relevant information as part of an investigation. For example, both the Federal Trade Commission (“FTC”) and the Consumer Financial Protection Bureau (“CFPB”) have authority to issue CIDs to obtain documents and testimony in investigations related to privacy, data security, deceptive marketing, and financial fraud. This article identifies some items to consider when receiving a CIDs based on my experience issuing and reviewing hundreds of CIDs as an enforcement attorney in the Chicago office of the FTC. More
Privacy Tips for Ed Tech Companies and Schools Conducting Remote Learning
As schools increasingly are adjusting to remote learning and utilizing education technology (“ed tech”) services, both schools and their ed tech service providers need to consider the appropriate collection and usage of student personal information. Here are some tips for protecting students’ privacy and safeguarding personal data: More
New York’s Newly-Enacted SHIELD Act May Prove To Be Sword To Unprepared Businesses
New York’s Stop Hacks and Improve Electronic Data Security Act (the “SHIELD Act”) took effect on March 21, 2020. The Act expands existing state breach notification requirements and imposes specific data security protections for covered businesses that own or license the private information of New York residents, regardless of whether those businesses are based in New York. The Act also broadens the definition of “private information” to include new types and combinations of data. More
Washington’s New State Facial Recognition Law May Signal a New Norm for Technology Providers
On March 31, 2020, Washington Senate Bill No. 6280 (the “Act”) became law, codifying one of the most detailed facial recognition regulations in the country. The Act regulates state and local government agencies in Washington using or intending to develop, procure, or use a facial recognition service but also includes important considerations for companies designing this technology. More
Practices to Stay Cybersafe While Remote Working
Under extraordinary circumstances, businesses are quickly adapting to remote work on a large scale. In doing so, companies should promote best practices to protect sensitive data. Below are some techniques that your company can employ to help ensure that sensitive personal or company information stays safe: More