On Monday, July 19, 2021 the Office of the California State Attorney General (OAG) issued a press release to summarize its first year of CCPA enforcement. In this press release, OAG urged consumers to take advantage of their CCPA rights, such as the right to know, delete, opt-out of the sale, right to non-discrimination, and rights for minors. In addition, consumers are encouraged to use OAG’s new Consumer Privacy Interactive Tool. It assists consumers with drafting notices of noncompliance that can be sent to a business the consumer believes failed to post a “Do Not Sell My Personal Informati ..read more

Major United States Municipalities are lining up to limit the ability of the private sector to use technologies to collect biometric identifiers and information. While Portland, Oregon, was perhaps the most dramatic, banning the use of face recognition technologies earlier this year, New York City will see a significant change on this front later this week. Effective this Friday, July 9, 2021, any commercial establishment in New York City that collects, retains, converts, stores or shares biometric identifier information of customers must disclose such activity using clear and conspicuous sign ..read more

            On June 4, 2021, the European Commission adopted modernized standard contractual clauses (“SCCs”) for use in international data transfers (collectively the “Clauses”). These updated Clauses reflect new requirements under the EU’s General Data Protection Regulation (GDPR) and take into account the EU Court of Justice’s Schrems II decision, which invalidated the U.S.-E.U. Privacy Shield program in July 2020. The Clauses also address known short-comings with the old SCCs. The GPDR restricts transfers outside of the EU unless an ex ..read more

Apple is days away from releasing the public version of iOS14.5, which will bring a seismic shift in the way the operating system functions with respect to privacy. In particular, the operating system introduces two major changes. The first change is a requirement that all apps must include a privacy nutrition label within the App Store that helps users better understand the app developer’s privacy practices prior to download (this feature is actually already live). The second change is a requirement that all apps that use information for tracking purposes must obtain opt-in consent from the ..read more

Today, Virginia Governor Ralph Northam signed the Consumer Data Protection Act (SB 1392) into law, making Virginia the second state after California to enact major privacy legislation.  Like the recently approved California Privacy Rights Act (“CPRA”), which amends the California Consumer Privacy Act, the Virginia Consumer Data Protection Act (“CDPA”) also becomes effective January 1, 2023.  But the similarities to California law don’t end there.  There is considerable overlap between the CDPA and the CCPA and CPRA, on the one hand, and between the CDPA and the European General ..read more

On January 14, 2021, the European Data Protection Board (“EDPB”) adopted Guidelines 01/2021 on Examples Regarding Data Breach Notification (“Guidelines”).  The Guidelines complement prior guidelines issued by the Article 29 Working Party in October 2017; namely, the Guidelines on Personal Data Breach Notification under Regulation 2016/679, (“GDPR”), WP 250.  The Guidelines are not yet final, pending a public comment period that concludes on March 7, 2021. While the final version of these Guidelines informed by public comments may vary slightly, they are not likely to change drastical ..read more

January 28 is data privacy day, and I thought it an appropriate time to take a step back.  One of my greatest regrets as a practitioner is that we are always under so much crisis pressure – deadlines, both real and imagined – to get to an answer or to a piece of advice or to a deal closing, that we fail to think big. I am jealous of my peers in academia who get to read, write, and think for extended periods of time. For myself, the pandemic has afforded me a little more ability to luxuriate in big thoughts (even losing that LA freeway commute time helps). So, this post is not about the CC ..read more

As anticipated, on September 29, 2020, Governor Newsom signed into law Assembly Bill 1281 incorporating an extension of time for the sunset of the employee and business to business exemptions of the California Consumer Privacy Act of 2018 (“CCPA”) to January 1, 2022. Both the B2B exemption and the employee exemption exclude certain categories of what would otherwise be personal information from falling within the scope of the CCPA. Under the employee data carve-out, information processed about a natural person in their capacity as a job applicant, employee, owner, director, officer, medical st ..read more

Last week, the LA City Attorney announced that it has agreed to settle its lawsuit against The Weather Channel over alleged improper location data practices. The settlement serves as reminder about the increasing scrutiny over location data, and the need to revisit policies and practices in preparation for the launch of iOS 14. As a quick recap of events, in January 2019 the LA City Attorney brought a lawsuit against TWC Product and Technology LLC (the operator of The Weather Channel app) and its parent company IBM for allegedly violating California’s unfair competition law. The lawsuit allege ..read more

The Office of Administrative Law’s (OAL) approval of the California Attorney General’s proposed regulations to the CCPA on August 14, 2020 was just the news we needed in 2020. Even better, because the OAL graciously approved the finalized regulations on a Friday afternoon, the weekend was spent thinking about best legal practices moving forward. One thing for sure, the finalized regulations are effective immediately. In case you forgot how we got here, let’s rewind and tell the story of how the finalized regulations came to be. A long time ago, back in October of 2019, the AG published the pro ..read more