JoAnn Stonier

Big news over the weekend while we were sleeping! Vermont passed its own data privacy law, which is now waiting for signature from Governor Phil Scott. Yes, state privacy laws have a fatigue effect, but this one is a bit more nuanced than those that have come before it: - Private Right of Action: It's limited, but consumers can sue data brokers and companies holding data on 100,000 or more Vermont residents for violating rules surrounding sensitive data. - Sensitive data cannot be sold. - Businesses must have safeguards in place to prohibit digital discrimination - Businesses must abide by substantive limits on the amount of personal data collected and used. The bill is expected to be signed into law, and it will be interesting to see if other states adopt the more nuanced aspects of Vermont's bill; particularly the private right of action. You can read the entire bill here: https://lnkd.in/gupsQGfd

3

State Data Privacy Laws: To date, 17 states have adopted comprehensive data privacy laws – most recently Maryland. And Vermont’s legislature just passed a data privacy law that would become one of the strongest data privacy laws in the country if signed into law by the Vermont Governor. It contains a private right of action for violating an individual’s privacy rights. To date, most states have not adopted a private right of action because of concerns it would open up the floodgates to litigation and bankrupt businesses. This is similar to the Illinois Biometric Information Privacy Act (BIPA) and class actions brought under this statute have exploded over the last several years. In 2023, hundreds of BIPA cases were filed in both federal and state court because of the potential for extremely large class action settlements and verdicts. Indeed, in 2020, Google settled a BIPA case for $650 million and the first BIPA case to go to trial resulted in a jury verdict of $228 million for truck drivers in 2023. That case recently settled for $75 million. New York City has also enacted a biometric law that allows for a private right of action. Even the California Consumer Privacy Act, believed to be the strongest comprehensive data privacy law, only provides a private right of action for data breaches. The United States has taken a patchwork approach to data privacy with the potential of each state creating a different set of rules similar to the 50 different data breach laws that currently exist. This has resulted from the lack of one comprehensive federal law that governs privacy and preempts state law. The costs of America’s patchwork approach of different and sometimes conflicting state privacy laws will only continue to rise. Numerous studies have estimated that the potential financial impact of complying with 50 different state laws could surpass $1 trillion over a decade and small business will likely shoulder a minimum of $200 million. A federal data privacy law such as American Privacy Rights Act would cost significantly less for businesses and bring needed consistency across all states. Additionally, the U.S. Federal Trade Commission is increasingly investigating data privacy practices and imposing civil penalties against organizations for failing to take reasonable steps to protect personal information. Section 5 of the Federal Trade Commission (FTC) Act prohibits unfair or deceptive acts or practices, including unfair practices involving the collection, use, disclosure, processing, and protection of consumers’ personal information. In those cases, the FTC has taken the position that inadequate data security practices may constitute unfair and deceptive practices under the FTC Act. Compliance with privacy and cybersecurity laws and regulations have become a priority for state and federal regulators so organizations should closely follow the developments in these areas.  #data #privacy #cybersecurity

53

1 Comment

This report from the New Jersey Office of the State Comptroller on traffic stop race data should be a red flag for everyone in Pennsylvania and yet another reason why supporting accountability journalism like that of Spotlight PA is so important. Despite robust data collection in NJ (soon to be law in PA) and data transparency (exempted from soon-to-be law in PA), the report finds the New Jersey State Police failed to meaningfully act to correct racial and ethnic disparities. Time and again we see accountability left to those who have everything to lose (see the PA legislature), disempowering those actually being adversely affected, whether they be drivers or taxpayers or ratepayers and so on. This does not work, and change is slow or does not happen at all. Quality journalism disrupts that comfort and demands answers, often moving the needle quicker than any administrative or political process. It’s a vital and one of the most effective forms of relief available to the public in the face of massive power and influence. And if we do not support it, it will go away. We cannot afford a government or a society without that independent check and balance on power. If the court system had for years been a successful commercial enterprise that was then disrupted and failed, would we just throw up our arms and let that branch of our check-and-balance structure disappear? Each pillar of our democracy is both flawed and vitally important. Journalism as the Fourth Estate is no different.

3

The Vermont Data Privacy Act may seem like just a drop in the bucket along with the 17 other states that have passed consumer privacy laws in the last six years. But the VDPA is unique in its stringent data minimization requirements AND the private right of action it gives consumers who believe their rights have been infringed. Here’s my question: with 32 other states considering their own consumer privacy laws, how many will look to Vermont as a model and afford consumers a private right of action? If Vermont replaces Virginia as the consumer privacy model, we could see even MORE scrutiny of corporate privacy practices. Read more in my latest blog available here: https://lnkd.in/gaqaPed4

7

🗣️Let's talk about it - the new DOJ Whistleblower💸Award💰Program, that is. Join us for this roundtable discussion on May 8, 1:00 p.m. ET. ➡️Click https://lnkd.in/gQpwSBcM to register. #SpeakUp #ListenUp #Retaliation #WhistleblowerAwards

14

On April 4, 2024, the Consumer Financial Protection Bureau (CFPB) issued a report titled Banking in Video Games and Virtual Worlds (Report), showing its growing scrutiny of the gaming industry. The Report underscores that the CFPB views the industry’s operations as increasingly bank-like since gaming now facilitates billions in transactions, including the exchange of virtual currencies. In the Report, the CFPB raises concerns about consumer protection, data privacy, and the potential financial risks impacting players, including minors and other vulnerable populations. For further information, read our recent client alert, “Report Highlights the CFPB's Increased Scrutiny of the Gaming Industry and its Financial Transactions,” authored by partner Benjamin Saul and associate Tarrian Ellis.

1

On June 13, the Rhode Island legislature passed the Rhode Island Data Transparency and Privacy Protection Act. Here's what you need to know: 1️⃣ In General. The act is a tale of two themes. One part of the act would expand privacy notice obligations in one significant way (discussed below) but the act lacks a key definition leaving the applicability and scope of that part unclear. The remainder of the act does not include many of the provisions that are commonly found in recent state consumer data privacy laws. 2️⃣ Applicability. With one exception discussed in the next section, the act will apply to entities that process the personal data of 35,000 state residents, which is approximately 3.19% of the state's population. 3️⃣ Information Sharing. The act's information sharing section applies to entities that collect, store and sell personally identifiable information. However, the act does not define personally identifiable information and most of the rest of the act applies to personal data (which is defined). While this could be considered a drafter's error, earlier versions of the act did include a definition of PII that was much narrower and aligned with how data breach notification laws define personal information. 4️⃣ Third Party Sales. If this section of the act does apply, then entities must identify all third parties to whom the controller sells or "may sell" personally identifiable information. Again, PII is not defined. Further, setting that issue aside, as Keir Lamont already has pointed out, there are obviously operational issues with identifying the identity of future third parties to whom PII may be sold. We get into the weeds on this issue in the below-linked article and also tease out another applicability issue with this section of the act. 5️⃣ Omitted Provisions. A comparison of the act to Connecticut's law shows that many provisions were not included. These include provisions on data minimization, secondary use, enhanced children's privacy rights, recognition of UOOMs, and the requirement to have an opt-out link. The act also omits some language in the processor and data protection assessment provisions. We get into specifics in the article. Given that the act leans heavily on the Connecticut law in other places, these omissions would appear to be intentional. 6️⃣ Exemptions. The act includes a double-set of exemptions (e.g., two GLBA entity-level exemptions). We get more into that in the article and why we think it happened. 7️⃣ Enforcement. The act will be enforced by the state Attorney General. There is no private right of action. There also is no right to cure. 8️⃣ Effective Date. January 1, 2026.

73

1 Comment

Governor Moore signed the Maryland Online Data Privacy Act into law today, bringing the number of states with general privacy laws up to 18. (Sadly, Clay Davis wasn’t involved.) MODPA doesn’t follow the California or Washington model but introduces a new (lake trout?) flavor of privacy law. Notable differences: * For all personal data, businesses must limit the collection of personal data to what is “reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer” – not just disclosed in the privacy policy. (Keep an eye on this requirement; it's a biggie.) * Lower applicability thresholds: 35K individuals or 10K individuals plus >20% revenue derived from the sale of data. * No selling data of kids under 18 if you know or “should have known” the kid is under 18. * No geofencing within 1,750 feet of mental or reproductive/sexual health facilities to identify, track, or collect data from consumers or to send notifications to consumers regarding their data.  * Can’t collect or process data for unlawful discrimination, except for self-testing or mitigation. * No private right of action (whew!) * 60-day cure that’s discretionary with the AG Goes into effect on October 1, 2025 #law #privacy

54

6 Comments

Remember that aggressive "game changer" privacy bill that passed the Vermont legislature last month? You know, the one with a private right of action and restrictions for age appropriate design coding? The one that other states may start looking to in an attempt to form more aggressive consumer protection privacy laws? It was VETOED. Last Thursday, Governor Phil Scott vetoed the would-be Vermont Data Privacy Act, citing concerns that it was anti-business (for the private right of action) and could implicate First Amendment concerns (currently being litigated with California's age appropriate coding provisions). Instead, Gov. Scott recommended that Vermont adopt a bill similar to Connecticut's privacy law in an effort to achieve "regional harmony." Check out my latest blog article recapping the veto and how businesses should adjust their privacy practices. https://lnkd.in/gkxwntiK

4

A great review of the latest state privacy law - Minnesota - and the question mark surrounding what could be the 20th state privacy & data protection law.

2

What to expect from the California Privacy Protection Agency meeting today? Some highlights: Objection to preemptive Federal privacy law: The CPPA will discuss its position on this law, which objects to preemption - this is is also in a letter from Executive Director Soltani and a number of State AGs (https://lnkd.in/erQvhJuX) Discuss California Privacy/AI bills including: (https://lnkd.in/eHRpEzHQ) 🔹 Requiring browsers to honor opt out preference signals (OOPS) (AB 3048) 🔹 Removing the M&A carve out and making data sharing during an asset purchase - a potential sale (AB 1824) 🔹 Adding neural data to the definition of sensitive information (similar to Colorado) (SB 1223). 🔹 Prohibiting a developer from using personal information of an under 16 to train AI without authorization (AB 2877) 🔹 Requiring registration of data digesters (aka "providers" under EU AI Act) and giving AI enforcement authority to the CPPA (AB 3204) 🔹 Imposing requirements re: algorithmic discrimination on developers and deployers (AB 2930) 🔹 Requiring consent for selling or sharing of information of under 18s (AB 1949) [Staff recommended that the agency supports this subject to amendment] (https://lnkd.in/ePDm2uma) 🔹 Data Broker registry regulations (https://lnkd.in/eVqenp-J) (recommend to move to formal rulemaking: https://lnkd.in/eR_hzxJS) 🔹 Amendments to existing regs (https://lnkd.in/ejMng6Jn) #dataprivacy #dataprotection #privacyFOMO #AIFOMO

29

The FTC’s amendment to the Safeguards rule is effective. It requires a non-bank financial institution to report a data breach when it discovers that the unencrypted information of more than 500 consumers has been acquired without authorization. This is a good time to review your data breach response plan to make sure that it incorporates this new requirement. I also highly recommend that you table top test your plan to ferret out any kinks or potential problems. And, of course, practice makes perfect … or at least gets your company employees more comfortable with the process if, and when it occurs

4

In a piece for New Jersey Lawyer, Karen Painter Randall, Chair of Connell Foley LLP’s Cybersecurity Data Privacy and Incident Response Group, and associate Joshua Previl explain how government regulators’ new cybersecurity disclosure rules impact M&A acquirers and targets. To read the article, click below. #NJLawyer #Cybersecurity #MergersAcquisitions #SEC #CybersecurityDisclosures

17

This is a good summary of what the Chevron Deference means. If you are a cybersecurity person, or your company is subject to DoD regulations regarding cybersecurity, this matters to you. Could Brian Levine and Robert Metzger (and anyone else with good thoughts on it, Vincent Scott?) chime in on this #CMMC related question? Q: In early 2024, the DoD CIO released a memo about "FedRAMP equivalency" which altered the general understanding of which cloud solution providers were acceptable for the DoD's supply chain. Is this an example of an agency releasing guidance which alters the implementation of a federal regulation (DFARS 252.204-7012)? The implications of this memo are worth a lot (migrating to a different cloud vendor starts at thousands of dollars and goes up to millions of dollars of cost, per company). Does Chevron make this memo vulnerable to lawsuit? If this sort of thing is not what Chevron is about, can you provide a CMMC or DoD cybersecurity example of what might be challenged in the near future? Kieri Solutions - Authorized C3PAO

24

4 Comments

🏛 Vermont just passed a comprehensive privacy law that, in part, draws inspiration from the American Privacy Rights Act/American Data Privacy and Protection Act. This is a complex bill that includes a novel private right of action, substantive data minimization rules, and unique scoping provisions. If enacted, the Vermont Data Privacy Act could be the farthest-reaching comprehensive privacy law to date. Read my analysis here: https://lnkd.in/dHn7GvjK

67

Nancy Libin, John Sevier, and Jevan Hutson review #Minnesota's new #dataprivacy law in NYU Program on Corporate Compliance and Enforcement's blog: https://lnkd.in/e_6Pd_gV #consumerprivacy #privacyrights Jennifer Arlen, Carolyn R Pautz, PhD, Judy Jiang

6