Alston & Bird Privacy, Cyber & Data Strategy Blog

California Privacy Protection Agency Releases Draft Regulations on Risk Assessments

By and

On August 28, 2023, the California Privacy Protection Agency (the “Agency”) released two sets of draft regulations under the California Consumer Privacy Act (the “CCPA”), one for risk assessments and another for cybersecurity audits, as part of the Agency’s informal rulemaking process. We discuss the draft cybersecurity audits in California Proposes Annual Audits to Assess Sufficiency and Compliance of Company Cybersecurity. This post discusses the draft risk assessment regulations (the “Draft … [Read more] about California Privacy Protection Agency Releases Draft Regulations on Risk Assessments

Penn State University Hit With False Claims Act Suit for Alleged Cyber Security Deficiencies

By and

On September 1, 2023, the U.S. District Court for the Eastern District of Pennsylvania unsealed a qui tam False Claims Act (“FCA”) lawsuit (originally filed on October 5, 2022) alleging Penn State University failed to provide “adequate security” for … [Read more] about Penn State University Hit With False Claims Act Suit for Alleged Cyber Security Deficiencies

UK Government Makes a Bridge to The EU-U.S. Data Privacy Framework

By and

On 21 September 2023, the UK Government adopted the Data Protection (Adequacy) Regulations 2023, also referred to as the “UK-U.S. Data Bridge”. The UK-U.S. Data Bridge will allow companies to legitimately transfer personal data from the UK to the … [Read more] about UK Government Makes a Bridge to The EU-U.S. Data Privacy Framework

California Proposes Annual Audits to Assess Sufficiency and Compliance of Company Cybersecurity

By , and

In late August 2023, the California Privacy Protection Agency (“CPPA” or “Agency”) released a discussion draft of proposed regulations under California’s data privacy law, the California Consumer Privacy Act (“CCPA”). Importantly, the proposed … [Read more] about California Proposes Annual Audits to Assess Sufficiency and Compliance of Company Cybersecurity