Massachusetts Amends Data Breach Notification Law
Posted on: 19 Jan 2019
Massachusetts Governor Charlie Baker has signed legislation amending the state’s data breach notification law, and the amendments will take effect on April 11, 2019. The new requirements relate to the timing and content of individual and regulator notifications, as well as credit monitoring services offered to affected residents. The key amendments include the following provisions. No Fees for Security Freezes: The amended law does not allow consumer reporting agencies to charge fees for consumers who elect to place, lift, or remove a security freeze from their consumer report. Individual […] Read more
DOJ Announces Indictment of Chinese Hackers
Posted on: 02 Jan 2019
On December 20, 2018, the Department of Justice and the FBI announced the indictment of two Chinese hackers, Zhu Hua and Zhang Shilong, who have been charged in a years-long global hacking campaign that resulted in the theft of sensitive information from companies and government agencies around the world. The two hackers, members of the hacking group known as Advanced Persistent Threat 10 (APT10) (also known as MenuPass Group or Stone Panda), which is associated with the Chinese Ministry of State Security, were charged with conspiracy to commit computer intrusions, conspiracy to commit wire […] Read more
Rich Willis and Laura K. Song share insights on the challenges data localization poses for the payments industry via Bloomberg BNA
Posted on: 21 Dec 2018
Rich Willis, partner in the Financial Services & Products Group, and Laura K. Song, associate in the Privacy & Data Security Team, co-authored the Bloomberg BNA article “Data Localization Poses Challenges for Payments Industry and Innovation.” In the article, Willis and Song discuss the different jurisdictional approaches to data localization and the impacts faced by those in the payments industry. With the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act of 2018 (CCPA), data privacy has been the focus of recent attention but the article addresses why […] Read more
Alston & Bird Hosts John Frank of Microsoft to Kick Off IAPP Europe Data Protection Congress 2018
Posted on: 18 Dec 2018
Alston & Bird’s annual event to kick off the IAPP Europe Data Protection Congress 2018 featured a fireside chat with John Frank, Vice-President, EU Government Affairs at Microsoft. Moderated by Peter Swire, Senior Counsel at Alston & Bird, the discussion provided practical insights into areas that are expected to shape privacy and data protection around the world. Mr. Frank also discussed Microsoft’s approach to global compliance amidst a wide array of privacy and data protection laws and regulations. John Frank John Frank leads Microsoft’s government affairs teams in Brussels […] Read more
Alston & Bird Hosts Webinar on Binding Corporate Rules – The Benefits Go Far Beyond Data Transfers
Posted on: 19 Oct 2018
Binding corporate rules (BCRs) are a legally recognized mechanism that facilitate intra-group transfers of personal data from the European Economic Area (EEA) to the rest of the world. Adopting BCRs not only allows for the free flow of information across an organization but also builds a strong digital culture which is crucial in this data intensive world. On Nov. 7th at 1-2 pm ET, join partners Jan Dhont and Jim Harvey, and senior counsel Peter Swire in an engaging discussion on the evolution of BCRs, the path to BCRs (including the application process), and the realities of embedding the elements […] Read more
Alston & Bird Issues Advisory on Applying GDPR Experience to CCPA Implementation
Posted on: 03 Oct 2018
Alston & Bird recently issued an advisory entitled, “Applying GDPR Process Lessons to the CCPA,” authored by Jim Harvey and Karen Sanzaro. The recently and hastily adopted California Consumer Privacy Act of 2018 (CCPA) has already been compared to the General Data Protection Act (GDPR), though the two greatly differ in scope and content. However, there are valuable insights to glean from the GDPR adoption process that can give companies a heads start on implementing the CCPA. The advisory examines these five lessons from which companies can learn: Leadership and multidisciplinary […] Read more
DOJ Releases “Best Practices for Victim Response and Reporting of Cyber Incidents,” Version 2.0
Posted on: 02 Oct 2018
On September 27, 2018, the Department of Justice Computer Crime and Intellectual Property (CCIPS) Cybersecurity Unit released Version 2.0 of its “Best Practices for Victim Response and Reporting of Cyber Incidents.” Originally issued in 2015, the updated guidance seeks to help organizations better equip themselves to be able to respond effectively and lawfully to cyber incidents. The updated version distills insights from private and public sector experts, incorporating new incident response considerations in light of technical and legal developments in the past three years. While the guidance […] Read more
Ohio Enacts Cybersecurity Safe Harbor Law
Posted on: 20 Sep 2018
Ohio recently enacted the Ohio Data Protection Act (2018 SB 220), a law that offers a breach litigation safe harbor to businesses meeting specific cybersecurity standards. While the law does not prevent a plaintiff from filing a lawsuit following a data breach, it does provide an affirmative defense to companies defending themselves against such claims. If an entity’s data security policies conform to one of several listed cybersecurity frameworks, the entity can invoke the safe harbor as a defense, and possibly defeat a tort claim alleging that the company’s failure to comply with reasonable […] Read more
India’s Draft Data Protection Bill: Another GDPR Around The Corner?
Posted on: 19 Sep 2018
India recently introduced the Personal Data Protection Bill 2018 (“Bill”). The transfer of personal data in India is currently governed by the SPD Rules (Sensitive Personal Data and Information, 2011), which is however considered outdated and not fully protective of personal data. The Bill comes as a result of the country’s Supreme Court recent judgment that declared privacy a fundamental right of an individual. The Srikrishma Committee (“Committee”) was responsible for drafting the Bill and coined a legal framework that is aimed to shape the country’s digital agenda. The Committee […] Read more
GDPR Fragmentation May Appear More Significant than Intended
Posted on: 26 Jun 2018
With the entry into application of the GDPR on May 25, 2018, the EU Member States were expected to have adopted national legislation implementing the regulation. To date, however, only 30% of Member States have effectively passed legislation, which still leaves the legal landscape to be precarious. The GDPR allows for deviations and specifications in several areas, for instance to introduce specific conditions or limitations for the processing of biometric, genetic, or health data; to create specific protection regimes for employee data; or to restrict the rights the GDPR grants to individuals. […] Read more