Blogs

Privacy and Security related image, digital thumbprint

Perkins on Privacy

Perkins on Privacy keeps you informed about the latest developments in privacy and data security law. Our insights are provided by Perkins Coie's Privacy & Security practice, recognized by Chambers as a leading firm in the field.

Subscribe

Data

December 3, 2024 National Security Regulatory Enforcement

CISA Security Requirements for Restricted Data Transactions Under New DOJ Rule

CISA has proposed security requirements for certain categories of restricted data transfers. Any U.S. business that transfers its data outside the United States or gives businesses or people outside the United States access to its data should review and work with security and legal professionals to ensure compliance.

World Cybersecurity

November 26, 2024 CCPA Privacy Compliance State Privacy Laws Artificial Intelligence Data Security

Fasten Your Seatbelts: CPPA Proposes Rules on Automated Decision-Making and Cybersecurity Audits and Finalizes Data Broker Regulations

After much anticipation, on November 8, the California Privacy Protection Agency (CPPA) Board voted to advance proposed regulations for insurance, cybersecurity audits, risk assessments, and automated decision-making technology (ADMT) to formal rulemaking.

bell on front desk at hotel

November 7, 2024 Regulatory Enforcement Data Security Data Breach and Incident Response Federal Trade Commission

FTC and State Coalition Settle Data Breach Cases with Marriott

In 2018, Marriott announced a data breach affecting its Starwood reservation system, thought at the time to have affected up to 500 million people worldwide. These settlements arise from that incident, as well as two smaller incidents that also affected Starwood and Marriott. The FTC alleges these incidents exposed payment card information, unencrypted passport numbers, and loyalty account information, along with other information like names, dates of birth, and contact information.

Computer Lock Security

October 28, 2024 Regulatory Enforcement Children’s Privacy

UK Online Safety Act: A Look Ahead

Ofcom, the U.K. Online Safety Act (the Act) regulator, released an updated roadmap on the timing of obligations for covered services on October 17, 2024.

AI finger touch screen

September 30, 2024 Data Breach and Incident Response Data Security

2024 Breach Notification Law Update: Unique New State Obligations and Widespread New Federal Obligations

Amid intense focus on AI and a flurry of consumer privacy law updates, legislative activity has continued to change data breach notification requirements in a variety of ways. Similar to 2023, a handful of changes to generally applicable state breach notification statutes were accompanied by steady sectoral activity at the state level and significant updates at the federal level, including new obligations from both the Federal Trade Commission (FTC) and the U.S. Securities and Exchange Commission (SEC).

Cellphone Privacy Security

September 25, 2024 Data Security

Cybersecurity for Lawyers: The NIST Cybersecurity Framework as a Tool and Reference

In this post in our series on basic cybersecurity concepts for lawyers, we delve into the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0.

Computer server room

August 30, 2024 Data Security

Cybersecurity for Lawyers: Open-Source Software Supply Chain Attacks

In this post in our series on basic cybersecurity concepts for lawyers, we address open-source software (OSS) supply chain risk.

Happy family together at home.

August 14, 2024 Data Security Regulatory Enforcement Children’s Privacy Federal Trade Commission

FTC Order Bans Anonymous Messaging App from Serving Minors

The Federal Trade Commission (FTC) and the Los Angeles County District Attorney announced a complaint and proposed stipulated order concerning the “NGL: ask me anything” anonymous messaging app.

Conference group

July 25, 2024 CCPA Regulatory Enforcement Artificial Intelligence

CPPA Regulatory Delays and Enforcement Updates: Takeaways from July Board Meeting

On July 16, the California Privacy Protection Agency (CPPA) held a public meeting of its Board (the Board).

scales

June 27, 2024 Regulatory Enforcement Children’s Privacy

California Attorney General Announces Children’s Privacy Settlement with Mobile Game

The California Attorney General announced a settlement with Tilting Point Media LLC resolving allegations of unauthorized disclosure of children's personal information.

Computer Lock Security

May 22, 2024 Data Security

Clarifying Guidance on Abundance-of-Caution Disclosures under SEC Cybersecurity Rule

The Director of the U.S. Securities and Exchange Commission (SEC) Division of Corporation Finance issued a statement clarifying public companies' obligations to disclose cybersecurity incidents under Item 1.05 of Form 8-K.

Financial Services & Investments

March 18, 2024 Regulatory Enforcement Federal Trade Commission

FTC Obtains $16.5M from Avast for Sale of Sensitive Data

The FTC's action against Avast reflects its continued focus on the mass collection and sale of sensitive personal data for advertising purposes.

Computer server room

January 26, 2024 Regulatory Enforcement Federal Trade Commission

The FTC Continues its Focus on Location and Sensitive Data

The Federal Trade Commission (FTC) followed its recent spate of enforcement in the location and sensitive data space with the announcement of another enforcement action and proposed settlement with InMarket Media, Inc. (InMarket).

Woman on a laptop

September 19, 2023 Data Security Data Breach and Incident Response

Updating Corporate and Cybersecurity Practices To Satisfy the SEC’s Final Cybersecurity Disclosure Rules: Assessing Materiality of Cybersecurity Incidents

In the wake of the SEC's new rule requiring prompt disclosure of cybersecurity incidents, incident response (IR) teams have asked how they should modify IR plans to promote compliance with the new rule.

Cellphone Privacy Security

September 11, 2023 Data Security Data Breach and Incident Response

A Deep Dive Into the SEC’s Materiality Trigger for Cybersecurity Incident Disclosures

The U.S. Securities and Exchange Commission (SEC) adopted final rules relating to cybersecurity disclosure on July 26, 2023, which will take effect on December 18, 2023.