Author

Brian Hengesbaugh

Browsing

In advance of its June 8 public board meeting, the California Privacy Protection Agency (“CPPA”) has released draft regulations intended to implement and interpret new requirements under the California Privacy Rights Act (“CPRA”).  In addition to codifying the new obligations under the CPRA (e.g., the right to correct, right to opt out of “sharing”), the Draft Regs include helpful illustrative examples and also provide details regarding certain new obligations, which we’ve summarized below. Key Takeaways…

In this episode, Brian Hengesbaugh, Global Chair of Data Privacy and Security, is joined by Stephen Reynolds, partner in Chicago, as they discuss the Strengthening American Cybersecurity Act, a law recently signed by President Biden, which requires key businesses to report certain ransomware incidents to the Cybersecurity and Infrastructure Security Agency (CISA). Listen in to hear about: An overview of the new law, including key elements such as mandatory reporting requirements, timelines and which “critical…

On April 28, 2022, the Connecticut State House passed Senate Bill (‘SB’) 6 for An Act Concerning Personal Data Privacy and Online Monitoring (‘the Act’), following its earlier passage by Connecticut’s Senate.  If enacted, the Act would take effect on 1 July 2023. Like California, Virginia, and Colorado, the Act would include several consumer rights, including the rights of access, correction, deletion, data portability, and the right to opt-out of targeted advertising, the sale of…

In this episode, Brian Hengesbaugh, Global Chair of Data Privacy and Security, is joined by Cy Vance, Global Chair of Cybersecurity based in New York, as they discuss the current cybersecurity threat landscape from a government, enforcement and litigation perspective. Listen in to hear about: Cy’s background as the former Manhattan District Attorney for 12 years, including his experience focusing on cybersecurity issues and building the District Attorney Office’s capability to address emerging threats to…

After years of legislative debate, Congress passed a new law requiring key businesses to report certain data breaches—or “covered incidents”—to the government. Signed by President Biden on March 15, 2022, the law, part of the Strengthening American Cybersecurity Act, requires companies that operate critical infrastructure—financial institutions, utilities, and other organizations—to share information with the Cybersecurity and Infrastructure Security Agency (CISA) about certain cybersecurity incidents within 72 hours and ransomware payments to cyber criminals within 24…

In this uncertain time, some global companies are announcing that they are “leaving Russia.”  What does it mean to “leave Russia,” and what are the data privacy implications of doing so?  Setting aside the broader business, political, and other legal considerations, the following are some initial thoughts on these challenging and rapidly developing data privacy issues. What does it mean for a global company to “leave Russia”? The specifics of the answer to this question…

The United Kingdom has finalized, and laid before Parliament, its International Data Transfer Agreement (“IDTA”). The new IDTA will come into force on 21 March 2022, together with a supplemental document to the new EU Standard Contractual Clauses (“UK Addendum”) and transitional provisions, to address requirements under the UK GDPR and UK Data Protection Act. Both the IDTA, UK Addendum, and transitional provisions will replace use of the previous EU Standard Contractual Clauses (approved by…

Friday 28 January 2022 is Data Protection Day (or Data Privacy Day outside of Europe), which marks the anniversary of the Council of Europe’s Convention 108. To mark Data Protection Day 2022, our Global Data Privacy and Security Team have provided a roundup of key trends and developments across the globe from a data protection perspective as well as looking ahead to what to expect in 2022. There are new laws and developments to keep…

A flaw in a widely used software threatens system security and makes companies vulnerable to cyber threats. The Apache Software Foundation released an advisory that Apache Log4j versions up to and including 2.14.1 has a defect that may allow threat actors to execute arbitrary code and deploy viruses including ransomware on that IT infrastructure. Entities that directly or indirectly leverage this software should act with haste to mitigate the risk of a data incident. These…