Rachel Marmor of Davis Wright Tremaine writes: Washington, D.C. amended its data breach notification law (D.C. Act 23-268) on March 26, 2020, expanding the definition of personal information covered by the law and requiring businesses collecting data from D.C. residents to implement “reasonable security safeguards.” Because D.C. law already provides a private right of action…
Category: Legislation
FTC May Change Obscure Data Breach Rule In Telehealth Era
Ben Kochman reports: The Federal Trade Commission said Friday that it is considering changing a decade-old, little-used rule that requires certain companies handling health information to publicly report data breaches — and which could gain new relevance as consumers increasingly turn to telehealth. The consumer protection agency says it is soliciting comments on whether it should make…
Supreme Court to Consider Whether Improper Data Access Violates Computer Crime Law
From EPIC.org: The Supreme Court will decide whether a person who is authorized to access data for some purposes violates the Computer Fraud and Abuse Act if they access the information for other purposes. The case, Van Buren v. United States, concerns a police officer who accessed a law enforcement database to sell the information to…
Another Court Significantly Limits the Scope of Criminal CFAA–Sandvig v. Barr
Eric Goldman writes: The plaintiffs want to create fake job profiles to research algorithmic discrimination. Fearing that their research activities would expose them to criminal CFAA prosecution, they challenged the CFAA as violating their First Amendment rights. Venkat blogged a preliminary ruling in the case 2 years ago. Now, the court dismisses the researchers’ suit as moot…
NY SHIELD Act Data Security Requirements Effective This Month
Julia K. Kadish of Sheppard Mullin writes: Businesses collecting personal information from New York residents will soon be expected to apply enhanced data security requirements. The New York SHIELD Act, signed into law in July 2019, expanded breach notice requirements in October 2019. Now, On March 21, 2020, the remaining provisions related to data security will…
India’s Data Protection Bill Threatens Global Cybersecurity
Lukasz Olejnik, an independent cybersecurity and privacy researcher, writes that some provisions in the Indian Data Protection Act of 2019, “like having to store sensitive data in systems that are located within the subcontinent, may put constraints on certain business practices and are considered more controversial by some.” One feature of the bill that’s received less…