In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.

Singapore Looks to Tighten Corporate Disclosures of Directors’ Personal Data | Privacy World

Employers and Insurance Companies Continue To Be Targeted with Deluge of Claims Under the Illinois Genetic Information Privacy Act | Privacy World

FCC Fines National Mobile Providers for Sharing Customer Location Information: What Are the Lessons and What to Expect in this New Era of FCC Mobile Data Privacy Oversight | Privacy World

Congress Could Disrupt Prevailing State Law Approach to Online Ads | Privacy World

Squire Patton Boggs Lawyers to Present on Several Upcoming Webinars and Events | Privacy World

California Privacy Regulator Holds Townhall Sessions On Draft Rules | Privacy World

When the EDPB is Weaponized, It Is Our Privacy That Is at Risk | Privacy World

Relying on CAFA’s Discretionary “Home-State” Exception, Federal Court Punts Data Breach Class Action Back to State Court | Privacy World

Singapore Progresses Towards Amended Cybersecurity Law | Privacy World

Heavyweight Fight, Did the US or EU KO the AI Treaty? | Privacy World

Are you Ready for Washington and Nevada’s Consumer Health Data Laws? | Privacy World

In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.

Congress Could Disrupt Prevailing State Law Approach to Online Ads | Privacy World

Squire Patton Boggs Lawyers to Present on Several Upcoming Webinars and Events | Privacy World

California Privacy Regulator Holds Townhall Sessions On Draft Rules | Privacy World

When the EDPB is Weaponized, It Is Our Privacy That Is at Risk | Privacy World

Relying on CAFA’s Discretionary “Home-State” Exception, Federal Court Punts Data Breach Class Action Back to State Court | Privacy World

Singapore Progresses Towards Amended Cybersecurity Law | Privacy World

Heavyweight Fight, Did the US or EU KO the AI Treaty? | Privacy World

Are you Ready for Washington and Nevada’s Consumer Health Data Laws? | Privacy World

April’s APRA: Could Draft Privacy Legislation Blossom into Law in 2024? | Privacy World

The Italian DPA Has Its Eyes on Biometric IDs – Another Fight on Tech or a Win for Privacy? | Privacy World

In case you missed it, below are recent posts from Privacy World covering the latest developments on data privacy, security and innovation. Please reach out to the authors if you are interested in additional information.

California Privacy Regulator Holds Townhall Sessions On Draft Rules | Privacy World

When the EDPB is Weaponized, It Is Our Privacy That Is at Risk | Privacy World

Relying on CAFA’s Discretionary “Home-State” Exception, Federal Court Punts Data Breach Class Action Back to State Court | Privacy World

Singapore Progresses Towards Amended Cybersecurity Law | Privacy World

Heavyweight Fight, Did the US or EU KO the AI Treaty? | Privacy World

Are you Ready for Washington and Nevada’s Consumer Health Data Laws? | Privacy World

April’s APRA: Could Draft Privacy Legislation Blossom into Law in 2024? | Privacy World

The Italian DPA Has Its Eyes on Biometric IDs – Another Fight on Tech or a Win for Privacy? | Privacy World

Washington’s My Health My Data Act (“MHMDA”) and Nevada’s SB 370 (“NV CHD Law”) (collectively, “CHD Laws”) went into effect at the end of last month, on March 31, 2024 (as many know, MHMDA’s geofencing prohibition went into effect last summer). Unlike the Health Insurance Portability and Accountability Act (“HIPAA”), a federal law which governs privacy and security in traditional healthcare settings, CHD Laws regulate “consumer health data” or “CHD”– a very broadly defined term as we discuss below and in a prior post – collected by companies in a broad swath of health and non-health related industries alike. Even ancillary purposes like providing accessibility accommodations and defending personal injury claims are enough to trigger the laws. CHD Laws impose restrictions and obligations on regulated entities far more burdensome than state consumer privacy laws, many of which already regulate some of the same health data, and unlike those general consumer privacy laws are not proposed to be preempted by the potential federal America Privacy Rights Act.

As such, compliance programs that businesses may have developed to comply with state consumer privacy laws, such as the California Privacy Protection Act (“CCPA”), will not be sufficient to address the requirements of the CHD Laws, though they can be leveraged such as for consumer rights request and processor management. There are some material differences beyond the scope of the data regulated. For example, businesses must add another website footer link (and potentially elsewhere, such as in mobile apps) and post a separate privacy policy applicable to the processing of CHD. The facilitation of consumer rights must be CHD-specific, for example providing the right to delete just CHD, rather than all personal information. Moreover, businesses that have CHD use cases not within narrow exceptions (e.g., as necessary to provide a requested product or service), which differ somewhat as between the two laws, will have to grapple with the foreboding consent and authorization requirements which, in some cases, could result in subjecting visitors or customers to a litany of notices and pop-ups in an environment already plagued by what some dub as “consent fatigue.”

Continue Reading Are you Ready for Washington and Nevada’s Consumer Health Data Laws?

This week, House Committee on Energy and Commerce Chair Cathy McMorris Rodgers (R-WA) and Senate Committee on Commerce, Science and Transportation Chair Maria Cantwell (D-WA) unveiled their bipartisan, bicameral discussion draft of the American Privacy Rights Act (APRA draft).[1] Chair Rodgers’ and Chair Cantwell’s announcement of the APRA draft surprised many congressional observers after comprehensive privacy legislation stalled in 2022.

Continue Reading April’s APRA: Could Draft Privacy Legislation Blossom into Law in 2024?

Following the lead of Europe, four US states currently require businesses to conduct and document assessments to evaluate and mitigate risks in connection with new and ongoing personal data processing activities, and at least eight additional states will do so between now and the end of 2025. California, which applies its requirements beyond traditional consumers to human resources and business-to-business contexts, requires regulatory filings of assessments (which may end up being in abridged form). On March 8, draft California assessment regulations were moved forward toward preparation for public comment, as detailed here. All of the states give regulators the ability to inspect assessments, which must be retained for that purpose. These new obligations will raise the curtain on companies’ info governance practices for regulators, and thereby necessitate robust data protection programs that are more than “window dressing.” Regulators have been clear about their plans to move to more aggressive enforcement of new state privacy laws, as discussed here and here, and assessments will give them a roadmap to do so.

Continue Reading US Regulators Lift the Curtain on Data Practices With Assessment, Reporting and Audit Requirements

The staff and board of the California Privacy Protection Agency (“CPPA”) have been working for nearly two years on a new set of proposed rulemaking under the California Consumer Privacy Act, as amended by the California Privacy Rights Act  (“CCPA”).  A year ago the current CCPA regulations were finalized, but several complex issues where reserved for further consideration and some proposals were pulled back to ease initial implementation.  Their enforcement was initially enjoined and delayed by a trial court, but a California appeals court reversed that order, including any delay on the effectiveness of future regulations.  New draft regulations were proposed by the CPPA staff and considered but not approved by the CPPA board in Q4 of 2023.  In February 2024 further revised draft regulations were released and considered on March 8 by the CCPA board, which voted 5 to 0 to move forward amendments to the existing regulations and, after a spirited debate, 3 (Urban, Le and Worthe for) to 2 (de la Torre and Mactaggert against) to also move forward with new draft regulations on data risk assessments and data driven technologies, with a direction to staff to add to the requirements for filing abridged assessments with the CPPA a discussion on what safeguards were employed to mitigate risks (with an exception for when disclosure would be a security risk).  In each case the staff was authorized to prepare the materials necessary under administrative procedures laws and regulations to publish a notice of prepared rulemaking, the publication which will be subject to a further Board vote after reviewing the rule making package.  The staff was also authorized to make further edits to the draft regulations to clarify text or conform with law.  Although the motions did not set a firm date for staff to complete that work, the discussions contemplate that it would be done by the July 2024 Board meeting at the latest.  That could result in effective regulations in Q3, though given the complexity and lack of Board consensus year-end is optimistic.

Continue Reading In Narrow Vote California Moves Next Generation Privacy Regs Forward

On March 8, 2024, the California Privacy Protection Agency (“CPPA” or “Agency”) Board (“Board”) will consider draft regulations that set forth how automated decisionmaking technology (“ADMT”) and profiling will be regulated under the California Consumer Privacy Act (“CCPA”).  The proposal includes the regulation of a new concept of “behavioral advertising” that is deemed “extensive profiling” and thus a form of “automated decisionmaking” that has a significant impact on consumers, justifying both a complex, advanced notice and ability for consumers to opt-out.  These would overlap with similar notice and opt-out requirements already in place for “sharing” of personal information for “cross-context behavioral advertising”, which involves use of personal information from more than one party (e.g., cross-site/app/service browsing information, or combinations of first- and third-party data).  The proposal would make cross-context behavioral advertising a subset of the newly defined behavioral advertising, and bring within the scope of these proposed regulations any practice that involves the use of personal information, even exclusively first-party data, for advertising or marketing communications (with limited exceptions, such as where the communication is based solely on a current interaction).  So, presenting a contextual ad or other content about cigars when a site user is reading an article about cigars would seemingly not be behavioral advertising, but remembering that the user is interested in cigars, to later recommend cigar-related products (think e-commerce site recommendations), would be. 

In an op ed article published by Law360, we break down how this diverges from the approach of 12 newer state privacy laws, conflicts with current CCPA provisions (e.g., the current exception from “share” restrictions when the data is made available pursuant to a consumer’s direction) and creates CA-specific burdens for businesses that do not create offsetting benefits for California consumers that would justify the approach.

We will keep you informed on the Agency’s and the Board’s ongoing consideration of this issue and their other CCPA rulemaking activities.  For more information, contact the authors.


Disclaimer: While every effort has been made to ensure that the information contained in this article is accurate, neither its authors nor Squire Patton Boggs accepts responsibility for any errors or omissions. The content of this article is for general information only and is not intended to constitute or be relied upon as legal advice.

Protection for minors online continues to top the list of U.S. regulatory and legislative priorities in 2024. So far in 2024, legislators in California introduced several bills focused on minors; Congress held hearings and advanced federal legislation protecting minors online; and constitutional challenges to 2023 state laws focused on minors’ social networking accounts advanced in the Courts. Congress and the Federal Trade Commission (FTC) are looking to update the Children’s Online Privacy Protection Act and corresponding Rule, as detailed in another post. However, the proposals explained in this post extend far beyond online privacy concerns, and we believe more focus on minors’ online safety is on the way.

Continue Reading Protecting Kids Online: Changes in California, Connecticut and Congress – Part I

Online privacy and safety of children and teens are hot legislative topics this year. In a companion post we provide an update of federal and state legislative efforts to fundamentally change how online content and advertising are delivered to children and teens. We have previously discussed legislation in California and Connecticut to require assessments of online privacy impacts on minors. In this post we focus on proposed regulatory and legislative changes to the 1998 Children’s Online Privacy Protection Act (COPPA) (effective in 2000) and its corresponding regulations (COPPA Rule), which were last updated in 2013.

Continue Reading Federal Children’s Privacy Requirements to Be Updated and Expanded