Data Privacy & Security Advisor Archives

Nov 7, 2018

Breaking News: Post-Election IRS Issues Final ACA Rule Regarding Religious Exemptions

The IRS has just released new final regulations regarding religious exemptions and accommodations from the contraceptive coverage mandate of the Affordable Care Act (ACA). The rule, to be officially published on November 15th, currently in unpublished form, is available here. This final rule, released post-midterm elections, will provide a way forward for religious organizations that object to certain contraceptive coverage required under the ACA. More details soon.

Jun 7, 2018

Is Inadequate Data Security an Unfair Trade Practice?

Doctor's Office: Inadequate Data Security?

In LabMD, Inc. v. Federal Trade Commission, Case No. 16-16270 (decided June 6, 2018) the United States Court of Appeals for the Eleventh Circuit addressed the enforcement of an FTC order finding that a business’s allegedly inadequate data security practices were unfair trade practices under Section 5(a) of the Federal Trade Commission Act. LabMD operated a medical laboratory that conducted diagnostic testing for cancer. Contrary to LabMD policy, an employee installed on a company computer a file-sharing application. That application allowed an outside party to download a file that contained the personal information of thousands of customers. The FTC initiated… Read more

Feb 6, 2018

EU-US Privacy Shield: Frequently Asked Questions

What is the EU-U.S. Privacy Shield? The EU-U.S. Privacy Shield (the “Privacy Shield”) is a framework designed by the U.S. Department of Commerce and the European Commission to provide companies in the U.S. and in the EU with a means to comply with data protection laws and regulations when transferring personal data between the U.S. and EU member countries. In July 2016, following an earlier EU Court of Justice decision that struck down the previous EU-U.S. Safe Harbor Framework, the European Commission determined that the Privacy Shield was adequate to permit data transfers to the U.S. under EU law. … Read more

Jan 30, 2018

General Data Protection Regulation (GDPR): Frequently Asked Questions

What is the General Data Protection Regulation? The General Data Protection Regulation (the “GDPR”) (Regulation (EU) 2016/679) is a European Union regulation intended to harmonize data privacy laws across Europe and increase data privacy protections for all European Union citizens. The GDPR was approved by the European Council and Parliament on April 14, 2016, and will come into force beginning on May 25, 2018. The GDPR will replace the Data Protection Directive 95/46/EC (the “Directive”), which required each member state of the European Union to pass national legislation to implement the intended outcome of the Directive. The result was a… Read more

Jan 23, 2018

Cybersecurity in M&A Transactions: Frequently Asked Questions

1. What types of transactions implicate cybersecurity and data privacy concerns? Cybersecurity and data privacy concerns arise in many different types of M&A transactions, but greater focus on potential cybersecurity and data privacy issues should be directed toward transactions involving (a) a target company that operates in certain highly-regulated industries, (b) the acquisition of sensitive information and data, and/or (c) the transfer of sensitive information and data across national borders. Target companies that operate in the financial services and healthcare industries, for example, are subject to the Gramm-Leach-Bliley Act and the Health Insurance Portability and Accountability Act of 1996, respectively…. Read more

Aug 3, 2017

Recent Cyber Insurance Decision Rejects Claim for Computer Fraud

A federal judge in Michigan recently granted summary judgment to Travelers in American Tooling Center, Inc. v. Travelers Casualty and Surety Company of America, Case No. 16-12108, United States District Court, Eastern District of Michigan. That decision interpreted the “computer fraud” provision of Travelers’ insurance policy, finding no coverage for the insured for the losses claimed. The basic facts were that American Tooling asked its vendor in China, YiFeng, for all outstanding invoices by email. American Tooling received a response by email, from an account that looked very much like the YiFeng account, and which directed American Tooling to send… Read more

Jun 20, 2017

A Primer on the EU’s General Data Protection Regulation

Overview Over four years in the making, the General Data Protection Regulation (the “GDPR”) was approved by the European Council and Parliament on April 14, 2016, and will come into force beginning on May 25, 2018. In the wake of ever-increasing cyber security and data privacy threats across the globe, the GDPR is intended to harmonize data privacy laws across Europe and increase data privacy protections for all European Union citizens. The GDPR will replace the Data Protection Directive 95/46/EC (the “Directive”), which required each member state of the European Union to pass national legislation to implement the intended outcome… Read more

Apr 23, 2015

FTC Tracking Company Settlement Highlights Importance of Keeping Privacy Promises

It has long been the Federal Trade Commission’s (FTC) position that if you make a privacy promise to consumers you should expect to be held to that promise. The FTC’s complaint and its proposed settlement, announced on April 23, 2015, with Nomi Technologies, Inc. (Nomi) highlights this. Nomi’s tracking applications allow retailers to capture the unique media access control address (and other information) of mobile devices of persons who enter a retailer’s physical store as well as persons within a certain distance from the stores. Nomi then made this information available to its retailer customers for analytics purposes. Nomi promised that it would… Read more

Apr 16, 2015

2015 Verizon Data Breach Investigations Report Released

Earlier this week, Verizon released its annual Data Breach Investigations Report (DBIR) for 2015. In the DBIR, Verizon, along with about 70 contributing organizations, presents an extensive survey and analysis of patterns and lessons from significant data breaches over the prior year. While the 2015 DBIR offers a broad range of data breach information, among the notable trends observed are the following: 90% of breaches are attributable to miscellaneous errors (29.4%), crimeware (25.1%), insider misuse (20.6%), and lost or stolen devices (15.3%) Among miscellaneous errors, cases of misdelivery and inadvertent posting or publishing of data made up almost half of… Read more