On February 10, 2021, Phil Yannella, Chair of Ballard’s Privacy & Data Security Group, will join Ankura for a webinar, “2020 Cyber Year in Review”, which will recap cybersecurity events for 2020. Panel members will also offer their predictions for what cybersecurity issues will dominate headlines in 2021. You can register for the event here.
Washington’s Latest Effort at Passing a Comprehensive Privacy Act
On September 9, 2020, Washington Senator Reuven Carlyle, D-Seattle, announced via Twitter that the third version of the draft Washington Privacy Act 2021 (“WPA”) was available for public review and comment. The recently released version of the WPA is the latest attempt by the Washington legislature to pass a comprehensive privacy bill. An earlier 2020
HHS Issues HIPAA Guidance on Contacting Survivors of COVID-19 About Plasma Donation
The Office of Civil Rights of the U.S. Department of Health and Human Services has issued guidance clarifying how HIPAA’s Privacy Rule permits covered entities (in particular, health care providers and health plans) or their business associates to contact former COVID-19 patients about plasma donation to treat or potentially treat patients. The guidance follows the
CPRA Poised to Go On November 2020 Ballot
While businesses are busy finalizing CCPA preparations, a new privacy initiative in California called the California Privacy Rights Act (CPRA) may be headed to the November 2020 ballot.
Continue Reading CPRA Poised to Go On November 2020 Ballot
2019 Year in Review
Happy (belated) New Year! 2020 marks the second anniversary of CyberAdviser. In the word of data privacy and cybersecurity, a great deal has happened over that span of time, including the enactment of the GDPR, BDLC (Brazil’s new privacy law), and the CCPA, the continued expansion of data breach and biometrics litigation, important US federal
Listen to Our Webinar on “The SEC’s Special Report on Business Email Compromises: What It Means and What You Should Do”
On November 13, 2018, Ballard Spahr lawyers presented a webinar on the SEC’s recent “Report of Investigation” into “business email compromises” affecting public companies.
As noted in our prior blog post, the Report was prompted by the SEC’s investigation into whether nine public companies violated U.S. securities laws “by failing to have sufficient accounting controls” to prevent approximately $100 million in losses as a result of business email compromises targeting their personnel. The SEC investigated whether these companies violated Sections 13(b)(2)(B)(i) and (iii) of the Securities and Exchange Act of 1934. Although declining to pursue enforcement actions against the companies, the SEC emphasized its recent cybersecurity guidance, advising public companies that “[c]ybersecurity risk management policies and procedures are key elements of enterprise-wide risk management, including as it relates to compliance with federal securities laws.” (See our prior alert and blog post regarding the Interpretive Guidance).
Continue Reading Listen to Our Webinar on “The SEC’s Special Report on Business Email Compromises: What It Means and What You Should Do”
Pennsylvania Supreme Court: If You Want to Search a Cell Phone, Get a Warrant!
The Pennsylvania Supreme Court recently issued a sweeping ruling “that accessing any information from a cell phone without a warrant” violates the Fourth Amendment to the United States Constitution. In Commonwealth v. Fulton, the Court suppressed the warrantless search of the contents of a ‘flip phone’ and reversed a murder conviction that flowed from the unlawful search. The Supreme Court held that the Superior Court’s decision contravened U.S. Supreme Court precedent in Riley v. California and United States v. Wurie, 134 S. Ct. 2473 (2014), holding that searches of cell phones generally require a warrant.
In June 2010, Philadelphia Police arrested I. Dean Fulton and three others on suspicion of unlawful drug activity and gun possession. They seized Fulton’s “smart phone” from his body at the time of the arrest. They subsequently obtained a search warrant for the vehicle Fulton and the others were in at the time of their arrests. That search turned up a firearm, a holster, three cell phones and other property. The cell phones – which included one ‘flip phone’ later connected to Fulton –were provided to the Homicide Division, which was investigating a recent drug-related murder.
Continue Reading Pennsylvania Supreme Court: If You Want to Search a Cell Phone, Get a Warrant!
Massachusetts Attorney General Launches Online Data Breach Reporting Portal
Massachusetts Attorney General Maura Healey has unveiled a new, “easier and more efficient” way to notify her office of data breaches. The Massachusetts Attorney General’s Office has created an online portal and web form for submitting data breach notifications. An email announcing the changes was transmitted this week to attorneys who have previously filed data breach notices on behalf of clients. The email requested our “assistance in passing the message along,” which we are hereby doing.
Attorney General Healey stated, “This new feature allows businesses to more efficiently report data breaches so we can take action and share information with the public.” The Attorney General Office’s website will soon include a publicly accessible database of data breaches reported to the Office. Other states, including California and Maryland, have similar public databases.
Continue Reading Massachusetts Attorney General Launches Online Data Breach Reporting Portal
Let’s Talk IoT and Mobile Discovery at Legaltech 2018
For those of you heading to Legaltech in New York next week, please join me and a great panel for what promises to be a lively discussion of hot topics in IoT and Mobile Discovery. I’ve been fortunate enough to have been included in Relativity’s session on this topic at a number of conferences, and
Federal Court Allows Credit Union Data Breach Class Action to Proceed Against Eddie Bauer
Consumers are not the only ones suing retailers for payment card data breaches. The U.S. District Court for the Western District of Washington recently denied, in large part, a motion to dismiss a data breach class action brought by Veridian Credit Union, on behalf of itself and other financial institutions, against Eddie Bauer, LLC. The class action relates to a January 2016 payment card data breach that allegedly impacted “every Eddie Bauer store in the United States and Canada.”
The court dismissed Veridian’s negligence per se claim, but allowed Veridian’s negligence and state statutory claims to proceed. The court’s analysis of choice of law and negligence issues is worth a read.
Continue Reading Federal Court Allows Credit Union Data Breach Class Action to Proceed Against Eddie Bauer