As highlighted by this blog on Friday, the European Commission has published long-awaited Standard Contractual Clauses (SCCs). These represent the first updates to the SCCs in over a decade, with the last updates having been made in 2010. Alston & Bird partner Wim Nauwelaerts has now published an advisory titled “10 Key Takeaways from the […]
Data Protection
European Commission Publishes Long-Awaited New Standard Contractual Clauses
Today, the European Commission published finalized versions of new Standard Contractual Clauses (SCCs). The Commission has published two sets of clauses: A set of SCCs to be used in controller-to-processor situations in conjunction with Art. 28 GDPR “data processor” terms applicable to such situations. A more general set of modular SCCs that can be used […]
New York and Illinois Regulators Recommend Third Party Cybersecurity Review For Specific Vulnerabilities
This month, the Illinois Department of Insurance issued guidance to insurers recommending assessments in response to a Microsoft Exchange vulnerability, detailed in the guidance. In the Bulletin dated May 5, the Department encourages regulated entities to “assess the risk to their systems and consumers and take steps necessary to address vulnerabilities and customer impact.” The […]
2021 Developments in State Cybersecurity Safe Harbor Laws
Only four months in and 2021 has already been a big year for state cybersecurity safe harbor legislation. Two states, Utah and Connecticut, have recently enacted or introduced a breach litigation safe harbor to incentivize businesses to protect personal information by adopting industry-recognized cybersecurity frameworks such as the National Institute of Standards and Technology’s (NIST) […]
NYDFS Announces Cybersecurity Settlement, Addresses Multi-Factor Authentication Rules
On April 14, 2021, the New York Department of Financial Services (“NYDFS”) announced a settlement with National Securities Corporation (“National Securities”), a licensed insurer, in connection with claims under the NYDFS Cybersecurity Regulation (23 NYCRR Part 500). The consent order requires payment of a $3M penalty and mandatory remediation in response to alleged failures to […]