Search results for: COVID

Welcome to the 2022 Q2 edition of the SPB Artificial Intelligence & Biometric Privacy Quarterly Review Newsletter, your go-to source for keeping you in the know on all recent major artificial intelligence (“AI”) and biometric privacy developments that have taken place over the course of the last three months. We invite you to share this resource with your colleagues and visit Squire Patton Boggs’ Data Privacy, Cybersecurity & Digital Assets and Privacy & Data Breach Litigation homepages for more information about our capabilities and team. 

Q2 did not disappoint in the AI and biometric privacy space, with a number of noteworthy litigation, legislative, and regulatory developments having taken place in these two rapidly developing areas of law. Read on to see what has transpired over the last quarter and what you should keep your eyes on as we head into the second half of 2022.

Continue Reading SPB 2022 Q2 Artificial Intelligence & Biometric Privacy Quarterly Review Newsletter

The Federal Trade Commission (“FTC”) announced its next open meeting will focus on issues related to children’s privacy and those pertaining to the use of endorsements and testimonials in advertising. Continue Reading FTC to Discuss Children’s Privacy, Endorsement Guides at Next (Virtual) Open Commission Meeting: May 19, 2022, 1PM ET

The French data protection authority, the CNIL, has published its annual report for 2021 (in French)  which contains some useful information and figures notably on complaints, investigations and sanctions as well as standards of references issued by the CNIL in relation to specific processing activities.

  1. Complaints, Investigations and Sanctions

Complaints

In 2021, the CNIL received 14,143 complaints (an increase of 7% compared to 2020 but similar to 2019) out of which:

    • 1,436 relate to access rights (28% of which are employee requests);
    • 1,906 relate to a request to delete names of corporate officers from online directories;
    • 973 relate to commercial, associative and political solicitation, by email (38 %), by SMS (29 %), by mail (20 %) and by phone (13 %); and
    • Several complaints related to CCTV in the work place.

Some complaints have been transferred to another lead authority under the one stop shop and cooperation rules.

The CNIL has also received 5,882 indirect data subject action requests (the indirect action is the only one available for certain data basis such as the one for the police or secret services).

The CNIL reports that many complaints have been made about organizations that are established outside of the EU (UK, Switzerland, United States of America, Canada, Russia, Australia, South Korea and China) mainly in relation to the publication of data on the Internet.

Investigations

It carried out 384 investigations, 31% of which followed from complaints or reports.

The CNIL highlights:

    • Cookie

Cookie compliance has been one of the priority themes set by the CNIL for 2021 and the CNIL has launched an unprecedented control campaign.

    • Health data

The CNIL also continued its control activities on the security of health data by investigating 30 medical analysis laboratories, hospitals, service providers and data brokers, notably in relation to COVID-19 pandemic related data. Some of these procedures are still ongoing.

    • Cybersecurity

It controlled 22 organizations, 15 of which are public with respect to the level of internet security. The investigations revealed obsolete cryptographic suites making websites vulnerable to attacks, shortcomings concerning passwords and, more generally, insufficient means with regard to current security issues.

Sanctions

The CNIL issued:

    • 135 formal notices; and
    • 18 sanctions for a record total amount of fines exceeding 214 million euros.

Out of the 18 sanctions,

    • 12 have been made public;
    • 15 consist of fines (5 with injunctions under penalty per day of delay);
    • 2 consist of calls to order with injunctions; and
    • 4 are decisions taken by the CNIL as a lead authority.

The most frequent breaches include:

    • Lack of information and excessive retention;
    • Lack of security; and
    • Cookies: 89 formal notices and 4 sanctions for the most serious cases of noncompliance which concerned actors who did not allow millions of internet users to refuse cookies as simply as to accept them.

The CNIL also issued two public sanctions against the Ministry of the Interior, concerning the illicit use of drones and poor management of the automated fingerprint file (FAED).

Investigation program for 2022

In February, the CNIL published  its priority focuses for investigation in 2022 investigation program, which accounts for around one third of its investigations, on the following three major topics:

    • Marketing activities/commercial solicitation

This follows the numerous complaints received on this topic and the publication in February 2022, a new “commercial management” reference framework, in particular framing the carrying out of commercial prospecting. The CNIL intends to investigate data brokers and other intermediaries.

    • Monitoring tools in the context of telework

The significant shift to teleworking has led to the development of specific tools, including tools allowing employers to ensure closer monitoring of the daily tasks and activities of employees. The CNIL considers it necessary to check the employers’ practices in this field.

    • Cloud

The CNIL intends to explore issues relating to data transfers and the management of contractual relations between data controllers and cloud solution provider subcontractors.

  1. Data breach notifications

The CNIL has received 5,037 data breach notifications (a 79% increase compared to 2020) out of which, 63% were due to an external cause (accident or malicious act). The CNIL considers that this figure is still too low compared to actual data breaches which may have occurred.

  1. Support to public authorities the legislator

The CNIL responded to 22 parliamentary hearings and issued 121 opinions on bills and decrees. 16 of these opinions concerned how data processing was implemented in the context of the fight against the COVID-19 pandemic.

  1. Decisions

The CNIL also handled 576 health authorization applications in 2021 and issued 54 research authorizations on COVID-19.

  1. Soft law and support to businesses

In 2021, the CNIL adopted several standards of reference and sectorial recommendations. These included:

    • Standards of reference relating to care, accommodation, social and medico-social support of disabled elderly persons;
    • Standards of reference relating to the designation of drivers who have committed a traffic violation;
    • Standards of reference relating to rental management;
    • Standards of reference for health data warehouses;
    • Recommendation on the exercise of data subject rights through a representative;
    • Interim recommendations for the quality control of clinical trials during the health crisis;
    • Recommendation on logging measures;
    • Draft standards of reference for the management of pharmacies; and
    • Practical recommendation in the insurance sector completing a 2014 compliance pack.

It has also developed tools to enable the development of virtuous digital innovation, in particular through its “start-up” strategy deployed in 2017. This year, this has resulted in the implementation of a first personal data sandbox for health. As a result, 12 projects have been supported by the CNIL, including 4 in a reinforced way.

  1. New sanction procedure for 2022

As of January 2022, the law has created a simplified sanction procedure that allows, most notably, the CNIL to handle a higher number of complaints. The sanctions that can be issued by the CNIL under this procedure are limited to a call to order, a fine of a maximum amount of €20,000 and an injunction with a penalty capped at €100 per day of delay. These sanctions cannot be made public.

  1. Focus for 2022-2024

The CNIL has identified three areas in which it intends to establish a position and elaborate tools before including them in the investigation program:

    • Augmented cameras and their uses

The accelerated development in the field of so-called “augmented” cameras, often coupled with predictive algorithms, raises the question of the necessary and proportionate nature of these devices and runs the risk of large-scale monitoring of people.

    • Data transfers in cloud computing
    • Collection of data collections by smartphone apps

Faced with the opacity of technologies and the heterogeneity of practices, the objective of the CNIL is to make visible the data flows and strengthen the compliance of mobile apps and their ecosystems, to better protect the privacy of smartphone users.

If you need assistance in France on data protection issues, contact stephanie.faber@squirepb.com

The American Bar Association has published A Practical Guide to Cyber Insurance for Businesses, which is now available here.  As summarized on the ABA’s website:

While there are many books about cybersecurity, data privacy and related issues, there are very few, if any, books about cyber insurance. A Practical Guide to Cyber Insurance for Businesses, fills that void and provides a practical look at cyber insurance for different types of businesses.  This book is divided into two parts. The first eight chapters focus on the development of cyber insurance and various aspects and elements of cyber insurance that affect all industries, including how cyber insurance interacts with other commercial insurance coverage. Chapters nine through twenty-five take a closer look at the cyber risks and cyber insurance coverage needs for specific industries. In this way, the unique characteristics of each industry segment are highlighted and a review of cyber insurance for that industry segment is more focused. While not every possible industry segment is covered, the broadness of the industries covered should provide guidance to any business.

CPW’s Kristin Bryan is the coauthor of one chapter in the book concerning risk management for private and publicly traded companies, with a focus on what the next couple of years may bring in this space.  This includes emerging risks to officers and directors on the cybersecurity front, considerations implicated by COVID, and regulatory developments.

For more on data privacy, security and innovation, stay tuned.  CPW will be there to keep you in the loop.

Registration is open for a series of upcoming not-to-be-missed webinars covering key areas for companies seeking to regulate the global compliance landscape.  Register below for insights from CPW’s Alan Friel, Marisol Mork, and others.

Webinar Series: Advertising, Media and Brands – Global Compliance Challenges

2021 has provided unique challenges for businesses operating across the advertising, media and brands industry. Aside from the impact of the pandemic, we are seeing a changing and challenging landscape due to increasing economic, consumer, regulatory and compliance pressures.

With increased exposure as a result of these pressures, Squire Patton Boggs and BDO will be hosting four webinars to support the advertising, media and brands industry in navigating these challenges:

  • November 11, 2021 – Global Data, Technology and Tax
  • November 30, 2021 – M&A Landscape, Post-COVID-19 Transaction Trends and Tips, and Top Five Due Diligence Risks
  • January 12, 2022 – Global Anti-counterfeiting and Brand Protection Trends, and Top Five AMB Hot Topics
  • February 2, 2022 – The Rise of ESG and Global Workplace Challenges

Hosted by Squire Patton Boggs and BDO

Click here to register.

Conference: ANA/BAA Marketing Law Conference (In-Person and Virtual)

Nov. 15-17, 2021: San Diego

Session: California Privacy: What Direction Next From CCPA and CRPA?

Alan Friel (Squire Patton Boggs) will review California’s privacy laws with representatives from the California Privacy Protection Agency and the OAG.

Session: State and Local Attorney General Enforcement updates by Marisol Mork (Squire Patton Boggs)

Hosted by ANA.

Click here to register.

Recent coverage of data breach and cybersecurity litigation has focused on developments concerning Article III standing and inventive Plaintiff’s counsel seeking to rely on a cyberattack to bring quintessential consumer pricing class actions.  However, there is a new development looming on the horizon that has received little attention so far: the threat posed by so-called “killware” and what it may mean for data privacy and cybersecurity.

Killware is the newest form of cyber threat, as Secretary Alejandro Mayorkas of the U.S. Department of Homeland Security recently advised.  It involves hackers maliciously targeting and exploiting the interconnectedness of critical aspects everyday life (think electronic medical devices, infrastructure, transportation networks and the like) for the express purpose of causing individuals serious physical harm.  It can occur through cybercriminals hijacking, for instance, a car and deliberately forcing a malfunction.

The threat of cyberattacks to patient safety has been of concern to the healthcare community for some time.  At a 2018 CyberMed summit, physicians had mere minutes to respond to a training scenario where a patient’s pacemaker had been hacked to misfire.  Saving the patient required resorting to measures that are rarely used to manage faulty pacemakers in the decades since the devices became widespread.

This year there have already been serious threats to public safety caused by killware-like attacks, although at the time these incidents were overshadowed by other developments.  For instance, this February, hackers attacked a water treatment facility in Florida, attempting to change the chemical composition in the water to levels that would have been deadly had the attack not been stopped in time.  And earlier this year, the Wall Street Journal reported on a cyberattack attack directed at an Alabama hospital that resulted in the death of an infant.  In that report, the Journal indicated that cyberattacks are increasingly focused on hospitals for ransomware attacks, as cybercriminals anticipate that hospital executives would prioritize the lives of patients over any reluctance over providing cybercriminals a cash payout.

While the traffic light hacking sequence in the 2003 movie The Italian Job at the time was entertaining, the scene viewed today in light of killware takes on a sobering new dimension.  To put it simply, if the killware threat materializes, it will be a game changer going forward.  Protecting the public’s health is the utmost priority and preempting killware requires strengthening the public and private sectors’ cyber-defenses, among other measures.  However, a fulsome understanding of potential impact of killware also requires consideration of its legal implications.  Killware has the potential to transform the landscape of data breach and consumer privacy litigation by essentially turning cyberattacks into another form of mass torts.

For instance, the days of courts in cybersecurity litigations engaging in protracted disagreements regarding Article III standing based upon future speculative harm would become altogether irrelevant.  Similarly, defendants’  reliance on the economic loss doctrine to defeat cybersecurity class actions would also be eliminated.  The reason for this is that negligence claims based on physical harm caused by killware attacks would bypass the economic loss doctrine, under which there is no cause of action for allegations of negligence that only result in economic loss, without any physical damage or damage to property.  Similar shifts would also be anticipated in relation to certain arguments regarding causation and damages in cybersecurity litigation, as well as class certification.

As new threats are posed by increasingly sophisticated technology and technical capacities, consumer privacy litigation has continued to evolve.  It remains to be seen whether the killware threat will materialize.  However, killware has already proven to be a tangible threat to public health and infrastructure that could once again reshape entirely this legal landscape.

As covered in greater detail in an article by Bloomberg Law, “New York City’s novel mandate that apps like DoorDash share customer information with restaurants that cook the meals they deliver could help eateries devastated by Covid-19, but has set off alarm bells with privacy advocates.  Data-sharing runs counter to delivery apps’ efforts to protect privacy by limiting how much personal information is provided for fulfilling food orders, like revealing to restaurants only a customer’s first name, last initial, and what they bought.”  CPW’s Kyle Fath was interviewed by Bloomberg on this issue.  He explained that “[o]ne of the law’s “shortfalls” is that it doesn’t spell out security protocols for how to keep customer data safe from a breach or a hack,” and “[i]t’s possible that New York City’s commissioner for Consumer and Worker Protection could issue rules that address implementation issues.”

You can read the full article here.

In case you missed it, below is a summary of recent posts from CPW.  Please feel free to reach out if you are interested in additional information on any of the developments covered.

Cothron v. White Castle: A Closer Look at One of the Most Important Data Privacy Litigations of 2021 | Consumer Privacy World

Motion to Dismiss Filed in COVID Contact Tracing Data Breach Lawsuit | Consumer Privacy World

In Case You Missed It: CPW’s Alan Friel Covers Key Learnings From the California AG’s Examples of CCPA Non-Compliance | Consumer Privacy World

Starting at 10:30 AM EST-CPW’s Kristin Bryan Live Blogs the White Castle Seventh Circuit Appeal | Consumer Privacy World

Earlier this month, CPW’s Kristin Bryan provided her insights to Richard Satran at Thomson Reuters Regulatory Intelligence regarding recent developments concerning the New York financial sector, cybersecurity and data privacy in light of a recent key leadership change with a state regulator.  You can read the full article below, which includes her comments, which was originally published by Thomson Reuters Regulatory Intelligence and is re-published with their authorization.

Whoever takes over as head of the New York Department of Financial Services will need to lead its large staff of professionals in putting behind the impact of a political scandal that felled its leader her role in resigned Governor Andrew Cuomo’s administration. Industry experts say the new leadership will be pressed to show that the agency is above politics and capable of carrying on its role as a leading U.S. financial regulator.

The industry observers said the next head of the agency will have little choice but to stick to the same priorities that gave it a national reputation. These include cutting-edge cybersecurity rules and climate change initiatives.

The agency has jurisdiction over thousands of financial services firms doing business in the state. Its latest superintendent, Linda Lacewell,  announced her resignation at the end of last week. She had a long background as a political operative but little, if any, experience in financial regulation. She resigned under pressure due to her alleged involvement in aggressive efforts to save the political career of her longtime ally Cuomo, who last Tuesday announced he would leave office in 14 days amid accusations of sexual harassment.

Cuomo had taken strong interest in the state financial regulator throughout his administration, and Lacewell was the second NYDFS supervisor to move directly from the position of Cuomo’s chief of staff to NYDFS superintendent. The first and longest-serving NYDFS supervisor Benjamin Lawsky, also held the position, overseeing a large staff of regulatory professionals.

Agency Made its Mark in Cyber Regulation  

Although Cuomo reportedly micro-managed the agency’s activities, it nonetheless emerged as a force in financial regulation and was seen taking a leading role among U.S. state regulators in a number of areas, most notably cybersecurity regulation.

Regardless of who takes control, the next superintendent will not likely change the agency’s course. The new head will be appointed by the new governor, Kathy Hochul, an upstate Democrat who served as Gov. Andrew Cuomo’s hand-picked lieutenant governor, who assumes office on August 24.

While the agency is in transition and perhaps for an extended period, banks, insurers and other financial firms that the NYDFS oversees are unlikely to see it push further into new areas of regulation, according to people who follow the agency.

But observers expect the enforcement staff to stay busy, with a mission that may become even more of a priority under a new superintendent.

Hochul Election Campaign Already Begun

Hochul, who even before assuming office announced plans to run for a four-year term in next year’s gubernatorial election, will likely view the Department of Financial Services, or NYDFS, in the same light as her predecessor. That is, as a state regulator with the clout of a federal agency, since its New York jurisdiction is home to many of the largest banks and insurers. What is more, with an election campaign effectively already underway, Hochul was seen likely to look for a superintendent who can provide the kind of quick political wins that enforcement actions can deliver. Industry experts said it is too early to speculate on who might replace Lacewell and whether it will be a figure from enforcement.  .

The role could be high profile. NYDFS enforcement cases went even beyond the giants of New York. Its largest actions were taken against UK multinational bank Standard Chartered, with whom it settled charges of sanctions violations and AML-control lapses for $463 million, and Deutsche Bank, which paid $150 million for charges related to its role in enabling client Jeffrey Epstein to carry on sexual predation over a period of years.

While such actions can’t be considered part of an expected routine, the agency has already taken aim at potential high-profile COVID-19 related cases that could garner public attention, in areas such as favoritism in servicing relief payments, debt collection abuses, student loan moratorium violations and other pandemic concerns.

While enforcement in the foreseeable future will likely be a mainstay, the agency was not seen taking on groundbreaking regulatory initiatives or departures from past priorities.  A new initiative to target discriminatory lending could drop from its priority list since the agency has little background or suitable resources to take on such long-to-develop and complex cases anytime soon, said industry experts.

No Radical Shift in Focus Expected  

“Whoever they choose to become the new superintendent is not going to radically change the focus,” said former agency staffer Scott Fischer, now of regulatory advisory firm DLA Piper. “On the regulatory side, they will follow what Lacewell did and remain focused on a couple of areas that are incredibly important for the near future.”

Cyber protection and insurance, climate change, and diversity and inclusion are among the areas where the agency has a track record that will continue as the top priorities for anyone taking the helm.

“Rather than being a sea change, I see the shift in leadership as being an unsurprising development in light of other issues that have been covered by the media in recent weeks concerning the current governor’s upcoming departure from office.” Kristin Bryan, a senior Squire Patton Boggs LLP senior litigator in cyber law.

The agency was created in 2011 by combining the state banking and insurance regulators. The revamp was aimed at modernizing the agency and combining expertise and resources, especially in sharing the large amount of data generated by the regulated industries. the NYDFS has been strongly focused on data use and fintech since its founding.

“NYDFS is anticipated to continue to play a pivotal role on the data privacy and cybersecurity front going forward,” Ms. Bryan said. The agency has too much invested in cyber regulation to “let it go by the wayside.”

The agency hit its stride most visibly not only in its landmark  cyber protection regulation but also in its pace-setting digital currency regulation. Financial technology is certain to remain a top priority. In one major initiative, the agency has under review a proposal for the first major update to its 2018 cyber regulations to respond to a wave of ransomware attacks. The agency, as regulator of both top insurers and leading financial firms, could play a key role in setting rules. Ms. Bryan noted that the “Cyber Insurance Risk Framework” announced earlier this year was the first guidance by a U.S. regulator on cybersecurity insurance.

Next Up: Ransomware 

Ms. Bryan said the NYDFS has similarly taken a lead in “new guidance on preventing ransomware attacks with a focus on cybersecurity controls that significantly reduce the risk of a ransomware attack.” The agency has undertaken an initiative to extend its ground-breaking cyber regulations to specifically address ransomware comes amid calls from some lawmakers to make ransom payments illegal. The agency in its recent guidance told firms it was opposed to the payment of ransom but has not made it a rule.

Cyber security professionals have objected strongly to rules that would “criminalize the victims,” when breached firms would pay ransom to avoid a shutdown of their systems. Sources near the agency say, however, that some form of sanction might be applied in cases where ransom is paid by firms that lacked proper controls in place.

The agency also will likely push ahead, as it did in Lacewell’s tenure, with innovative approaches in creating a legal process for firms to become involved in digital assets.  The agency has long been issuing “bitlicenses” for virtual currency services, sometimes drawing criticism from U.S. bank regulators who preferred to take the lead. Hochul could take a more collaborative approach than the famously confrontational Cuomo, and the agency already has begun to work more closely with the federal Consumer Financial Protection Bureau.

More broadly, developments brought about by COVID and remote work, which are likely to persist in the near future in light of COVID-19 Delta variant’s surge in the United States, have highlighted the importance of this area across industries. Both the Biden administration and state regulators are paying close attention.

The agency also has been leading in the financial regulatory implications of climate change. It launched an initiative nearly five years ago, taking on an issue that only recently has been put on the agenda of U,S, financial agencies.

Despite expectations for continuity, the Hochul administration could still take actions to distance its NYDFS policy from Cuomo. The choice Hochul makes to take over the agency will be closely watched to see whether the large and complicated regulator decides to find a supervisor with deep financial agency experience, as opposed to a political lieutenant.  Whatever the choice, one thing will change. It will be the first supervisor not appointed by Cuomo or who had previously worked for him directly on his staff.

Just a couple weeks ago, we reported on another case from the Eastern District that dismissed a FDCPA case for lack of standing post-TransUnion LLC v. Ramirez, 141 S. Ct. 2190 (2021). Another recent decision from the same court (different judge) shows, yet again, that Ramirez has teeth.  In Grauman, No. 20-cv-3152 (ENV) (AKT), 2021 U.S. Dist. LEXIS 142845 (E.D.N.Y. July 16, 2021), the court dismissed  a FCRA case for lack of standing, finding that a lowered credit score, by itself, isn’t a concrete harm under Article III.

The plaintiff in this case (Grauman) was a customer at Wells Fargo, which deferred Grauman’s loan payments for a few months in 2020 as a form of relief from the COVID-19 pandemic. Despite the suspension of payments, plaintiff alleges that he made his mortgage payments in a timely manner, and that Wells Fargo had promised it would not report missed payments to the credit bureaus during this time anyway. The gravamen of Grauman’s grievance, though, was that his mortgage suspension was erroneously reported to the credit bureaus, and that his credit score dropped 16 points and didn’t bounce back even when the suspension notation had been removed from his account.  He brought a class action against a credit reporting agency and its vendor, claiming that their reporting of the mortgage loan suspension and the resulting credit score drop constituted a negligent and willful violation of FCRA’s requirement that credit reporting agencies employ reasonable procedures to ensure the accuracy of consumer reports.

The court granted the defendants’ motion to dismiss, finding that the plaintiff’s lowered credit score wasn’t a concrete harm, and the plaintiff thus lacked standing to bring a FCRA claim. In dismissing the case, the court recognized that pre-Ramirez, “many courts had held that a drop in a plaintiff’s credit score was a sufficiently concrete injury in fact under Spokeo, capable of causing real-world harms such as the denial of credit.” But following Ramirez, the court noted, “that holding is no longer tenable.” Unless a plaintiff alleges some “other injury resembling a historically recognized harm,” a reduced credit score isn’t enough to get you into federal court.   This makes sense—Ramirez explicitly held that in cases seeking damages, “the mere risk of future harm, standing alone, cannot qualify as a concrete harm.” And isn’t that quintessentially what a lowered credit score is—just a risk of a future harm?

For more on this, stay tuned.  CPW will continue to keep you in the loop on developments in this area and for other data privacy litigations and trends.