Rick Borden

Join Lowenstein partners Amy Mushahwar and Mary Hildebrand, CIPP/US/E for an ACC New York City - Association of Corporate Counsel webinar on June 18 during which they will address cutting-edge topics including the latest in US, EU, UK, and global data privacy/cyber laws, trends in data breaches and ransomware, updates to SEC notices and regulations, and the complexities of AI in cybersecurity. For more information and to register, please visit: https://bit.ly/4bzqlO9 #techlaw #dataprotection #lawyers #cybersecurity #privacylaw

20

Stephen Breidenbach, Co-Chair of the firm’s Cybersecurity, Privacy and Technology Practice Group, will be a panelist on artificial intelligence and the law for the New York State Bar Association Commercial & Federal Litigation Section's Annual Meeting on May 18 in Saratoga Springs.  The expert panel will provide an update on the generative AI-based tools designed for litigation and an analysis of the risks and rewards of using them. View here for complete details and registration: https://lnkd.in/e2GCi4uT #artificialintelligence #ai #litigation #continuinglegaleducation

20

This is a good summary of what the Chevron Deference means. If you are a cybersecurity person, or your company is subject to DoD regulations regarding cybersecurity, this matters to you. Could Brian Levine and Robert Metzger (and anyone else with good thoughts on it, Vincent Scott?) chime in on this #CMMC related question? Q: In early 2024, the DoD CIO released a memo about "FedRAMP equivalency" which altered the general understanding of which cloud solution providers were acceptable for the DoD's supply chain. Is this an example of an agency releasing guidance which alters the implementation of a federal regulation (DFARS 252.204-7012)? The implications of this memo are worth a lot (migrating to a different cloud vendor starts at thousands of dollars and goes up to millions of dollars of cost, per company). Does Chevron make this memo vulnerable to lawsuit? If this sort of thing is not what Chevron is about, can you provide a CMMC or DoD cybersecurity example of what might be challenged in the near future? Kieri Solutions - Authorized C3PAO

24

4 Comments

Maryland recently became the fifth state in 2024—and the 17th U.S. state overall—to pass a comprehensive data privacy law. In this alert, Phil Yannella, Sharon Klein, Timothy Dickens, and Jason Hirsch review the law, explaining the unique provisions that increase operational and legal risk for U.S. businesses and institutions. #dataprivacylaw #dataprivacy #Maryland

2

New Ruling on Punitive Damages and Attorney Fees in California Invasion of Privacy Act (CIPA) Case As Thompson Hine has previously reported, the recent surge of privacy claims under the California Invasion of Privacy Act (CIPA) related to using website cookies, pixels, and web beacons continues to impact a several sectors. It has been especially harmful to small businesses. On July 15, Judge Rolf Treu ruled on a preliminary motion in a CIPA lawsuit and concluded that the plaintiff could potentially recover punitive damages and attorney fees. Although this case does not address the merits of whether website tracking technologies are considered pen registers or trap and trace devices under CIPA, plaintiffs may rely on it to demand larger awards and settlements in their CIPA actions. Businesses that deploy these types of online tracking technologies should immediately reassess the legal terms governing the use of their websites and whether they contain favorable dispute resolution provisions, such as remedies available for claims arising from a consumer’s use of the website. View full update here ➡ https://bit.ly/3WjOO3x Steven Stransky I Jennifer Adler #DataPrivacy #PrivacyLaw #ThompsonHine #California

1

VT comprehensive privacy bill down for the count? Hear more from Kyle G. Kessler (she/her), Christine Xiao and William Carter #privacylaw

8

Maryland recently became the fifth state in 2024—and the 17th U.S. state overall—to pass a comprehensive data privacy law. In this alert, Phil Yannella, Sharon Klein, Timothy Dickens, and Jason Hirsch review the law, explaining the unique provisions that increase operational and legal risk for U.S. businesses and institutions. #dataprivacylaw #dataprivacy #Maryland

7

Rhode Island's new #privacy law has some quirks that set it apart from the other 19 state laws. We break down what other state laws it follows and where it diverges. There is also a chart of the effective dates of all 20.

14

Our latest blog post examines a new Illinois federal court ruling on the scope of biometric information protections in the context of a privacy class action https://lnkd.in/e6EXyFPr

3

#Cyber attorney Myriah Jaworski Esq., CIPP/E, CIPP/US is quoted in SecureWorld's Chevron Doctrine Reversal: What's It Mean for Cybersecurity Regulation? "The Supreme Court's Loper decision, jettisoning Chevron and upending the longstanding core of administrative law, has major implications for cyber and privacy regulations that are promulgated and enforced by federal agencies, such as CISA, the FTC, and SEC," said Myriah Jaworski, Member, Clark Hill Law. "Courts are no longer required to defer to these agencies' interpretation of their own rules, and may instead substitute their own judgement in an area that is particularly vulnerable to challenge under Loper—where old laws are leveraged to address new security and privacy risks." https://lnkd.in/gt5J4uP7 #cybersecurity #chevrondoctrine #chevron #CISA #FTC #SEC

51

4 Comments

🔦Team Spotlight: Lee Merreot, Esq., CIPP/US, CIPP/E 🔦 In Lee Merreot’s role with The Beckage Firm: Tech, Data Security & Privacy Law Firm, she advises clients on issues surrounding state and global privacy and security compliance, including responding to data subject requests, reporting requirements, and the applicability of various laws to specific organizations. She also drafts and revises many data privacy and security documents including privacy notices and policies, data processing agreements, DPIAs, IT policies, AI policies, and incident response policies. As a Colorado licensed attorney, she has experience with the Colorado Privacy Act and the Colorado Artificial Intelligence Act. Lee previously worked in-house at a marketing firm and dealt with a myriad of privacy and security issues, both in the US and the EU. She led the organization's privacy compliance initiatives, vetted third parties, performed risk assessments, and drafted numerous contracts, including data evaluation agreements, data licensing agreements, master service agreements, nondisclosure agreements, and statements of work. Lee has been an attorney for over 20 years and has earned the following certifications: CIPP/US, CIPP/E, and One Trust Privacy Professional. 💬 “I have a very practical approach to law and genuinely enjoy getting to know, interact with, and assist clients with legal challenges they encounter. I try not to overcomplicate things any more than necessary and instead try to simplify and clarify laws, relationships, and scenarios that can often be quite complex.”💬 🏔𝑷𝒆𝒓𝒔𝒐𝒏𝒂𝒍 𝑵𝒐𝒕𝒆 – “I love: being active and outdoors in beautiful CO, my two daughters, and traveling to new places whenever possible.” – Lee Merreot 🏔 #TheBeckageFirm #CardinalStrong #StaffSpotlight #ColoradoArtificialIntelligenceAct

16

This article summarizes and discusses the USPTO’s April 11, 2024 guidance on the use of AI tools for prosecuting #patent and #trademark applications before the #USPTO. Read more by Crowell's Andrew Spitzer and William Frankel:

4

With all the new proposals coming out of the #SEC, this development may not be on your radar yet. The “American Privacy Rights Act of 2024” (APRA) was recently introduced in Congress and could impose a range of new compliance and operational obligations on financial services companies. As a very general summary, the APRA could impact companies in the following ways:   1️⃣ New Data Protection Regulatory Regime. Place new obligations on covered entities that collect and process data to provide affected consumers with notice of their data practices and with the ability to control (as well as prohibit) how that data is processed and used, depending on the sensitivity and nature of that information. 2️⃣ Data Minimization. Substantially restrict the ability of covered entities to collect, store, and use data – a concept known as “data minimization” – and prohibit the transfer of sensitive data to third parties without prior consumer consent. 3️⃣ Data Algorithm Limitations, including for #AI. Prohibit the use of personal information for artificial intelligence operations, as well as the use of collected data for purposes that discriminate against individuals and/or algorithmically encourage certain online behaviors (a practice known as “dark patterns”.) 4️⃣ Data Brokers. Impose additional obligations on covered entities that collect and process large amounts of data, including entities known as “data brokers”, while exempting small businesses that meet certain metrics established under the bill. 5️⃣ New #FTC Enforcement Authority. Designate the Federal Trade Commission as the primary federal entity with new regulatory and enforcement authority, further deputize state attorneys general to enforce against violations of the law, and provide consumers with a private right of action. 6️⃣ State Preemption, including California.  Preempt state laws that are covered by APRA’s provisions. Many of these changes, particularly the preemption provisions, could impact #brokerdealer and #adviser customer #privacy disclosures, which often incorporate state-specific provisions. In addition to regulatory advice, the Mintz ML Strategies team can provide access to influential policymakers on Capitol Hill and expertise on the draft legislation itself and substantive public policy. Christian Fjeld, ML Strategies, LLC, #ArtificialIntelligence #RegulatoryCompliance #Finance  

12

Join Partners David Sherman, CIPP/US and Nichole Sterling along with Counsel Eric B. Gyasi, CIPP/US July 16 for the fourth installment of the Privacy Strategist webinar series, "Demystifying Cybersecurity Concepts for Privacy Lawyers." This webinar will offer practical and timely insights to help privacy professionals identify and manage data security obligations and cybersecurity threats. #BHEvent #Cybersecurity #Data 

22

It is not clear to me at all that the #Vermont #privacy law will be signed into law, but we took our time to analyze what would immediately become the most onerous consumer privacy law on the books. It's confusing, and has a lot of layers to it. Thanks to Doris Yuen for authoring. https://lnkd.in/gtNFJEGP

4

Debevoise lawyers Avi Gesser, Douglas Zolkind and Sarah Wolf discuss the challenges faced by corporate compliance departments with the rise of AI-enabled corporate crime and the strategies they can implement to mitigate risks in their new article in Law360. Read more below.

32

The dismissal of the vast majority of the SEC's claims against Solarwinds is good news for those that have been in the Commission's crosshairs during the Gensler era. Gibson Dunn's summary is an informative summary of how far reaching the SEC's claims were, hitting an internal accounting controls, disclosure controls and procedures, and fraud claims based on public disclosures. The individual claims against the CISO raise the most concern, however. An important takeaway: "While the decision is an encouraging sign that the SEC’s aggressive attempts to hold CISOs individually liable for company conduct will be evaluated on the factual record and the law, the decision did not dismiss all claims against the CISO (allowing the claims based on allegations of contemporaneous knowledge of falsity of public statements to go forward), and companies and CISOs should remain vigilant in responding to cybersecurity incidents and ensuring the accuracy of all public statements that are made about cybersecurity." #cybersecurity #SEC #disclosurecontrols #individualliability #SECdefense #SawyerLabar

4

Last year saw an increase in lawsuits targeting website Tracking Technologies as a result of a broad interpretation of privacy laws, particularly the California Invasion of Privacy Act (CIPA). NGE Intellectual Property attorneys and Cybersecurity & Data Privacy team members Kate Campbell, Alfred Tam, David A. Wheeler, AIGP, and Josh Hanson highlight how these lawsuits often claim that using tracking tools such as pixel tags and session replay software constitutes unauthorized wiretapping or using a pen register under CIPA. The article also highlights that recent decisions have been inconsistent, with some courts broadening the scope of CIPA while others have pushed back, thus creating uncertainty for companies facing potential claims. Read the full alert here: https://lnkd.in/gAKVdmqE #TrackingTechnologies #CIPA

8