On July 18, 2024, a federal jury in Delaware found that an online travel booking company violated the Computer Fraud and Abuse Act (CFAA) by accessing portions of a European airline’s website without permission and “with intent to defraud” the airline. In particular, the jury unanimously found that the online travel company violated the CFAA […]
Pennsylvania Amends Data Breach Notification Law
Pennsylvania’s Governor recently approved amendments to the Commonwealth’s data breach notification law, which represent a significant overhaul to the law. As detailed below, the amended law makes a number of material changes, including adding a regulator notification requirement, lowering the threshold of impacted Pennsylvania residents triggering a notification requirement to the consumer reporting agencies, slightly […]
SEC Corporation Finance Provides Additional Guidance on the Disclosure of Material Cybersecurity Incidents in Form 8-K
On June 24, 2024, the Division of Corporation Finance (“Corp Fin”) of the Securities and Exchange Commission (“SEC”) issued five new Compliance and Disclosure Interpretations (“C&DIs”) related to the disclosure of “material” cybersecurity incidents in Item 1.05 of Form 8-Ks. The C&DIs present hypothetical fact patterns related to ransomware attacks and insurance reimbursement for damages […]
SEC Settlement Suggests the Agency’s Attempt to Regulate Cybersecurity Controls
On June 18, 2024, the SEC announced a $2.125 million settlement with R.R. Donnelley & Sons Co. (“RRD”) related to the company’s 2021 ransomware attack (the “Incident”). The settlement, and the SEC’s accompanying cease-and-desist order (the “Order”), portend the agency’s continued and increasing oversight over registrants’ cybersecurity policies and practices. Background RRD is a global […]
Tennessee Law Designed to Combat Deepfakes Set to Take Effect in July
On July 1, 2024, the Tennessee Ensuring Likeness, Voice, and Image Security Act of 2024 (“ELVIS Act” or “the Act”) will go into effect, bolstering the limitations on the unauthorized commercial use of an individual’s voice. The Act, which amends the Tennessee Personal Rights Protection Act of 1984, was enacted in response to the growing […]