Latest Posts:
Search for:
Author

Justine Phillips

Browsing
In Artificial Intelligence

Setting the Standard: DHS Debuts First-of-its-Kind AI Safety Framework for Critical Infrastructure

by , , and 7 Mins Read

In brief On Thursday, November 14, 2024, the U.S. Department of Homeland Security (“DHS”) announced its groundbreaking “Roles and Responsibilities Framework for Artificial Intelligence in Critical Infrastructure” (“Framework”). The Framework is a guide for deploying AI safely and securely in all sixteen sectors of U.S. critical infrastructure, including communications, critical manufacturing, energy, financial services, healthcare, and information technology. It emphasizes the importance of risk-based mitigations to reduce potential harms to critical infrastructure and highlights the…

In Cybersecurity

Prepping For the Holidays: Companies to Strengthen Cybersecurity Infrastructure in Compliance with Amendments To New York’s Cybersecurity Regulation

by , and 4 Mins Read

In brief Financial institutions, financial services providers and companies otherwise subject to the Banking, Financial Services and Insurance laws of New York State should note that on November 1, 2024, the amendments to the New York Department of Financial Services’ (“NYDFS'”) cybersecurity regulations took effect. “Covered entities” under the amendments still include any licensed financial institution company operating in New York regardless of whether it is already regulated by other government agencies. Additionally, the amendments…

In California Privacy Law

Off to the Races: California Advances CCPA Regulations on Cyber, Risk & AI

by , , , and 4 Mins Read

On Friday, November 8, 2024, the California Privacy Protection Agency board voted 4-1 to commence the formal rulemaking process for the draft regulations on Automated Decisionmaking Technology (ADMT), Risk Assessments, Cybersecurity Audits, and Insurance Companies. The formal rulemaking process will begin with a 45-day public comment period. During this time, CPPA staff will gather and analyze public comments, which will inform potential amendments and revisions to the regulations. The period will likely be extended to…

In Artificial Intelligence

AI Innovation in California Prevails: California Governor Nixes Major AI Legislation

by , , , , , , and 4 Mins Read

On September 29, 2024, California Governor Gavin Newsom vetoed Senate Bill 1047, which would have enacted the Safe and Secure Innovation for Frontier Artificial Intelligence Models Act (the “Act”) to create a comprehensive regulatory framework for the development of artificial intelligence models. The veto embodies the dilemma that has emerged around the regulation of AI applications: how can laws prevent harms in the use and development of AI, while promoting innovation and harnessing the power…

In Artificial Intelligence

Minding Your Data: New Law Expands CCPA’s Sensitive Personal Information to Include Neural Data

by , , , , , , and 3 Mins Read

“Neural data” is the newest addition to the ever expanding California Consumer Privacy Act (CCPA). Signed into law on September 28, 2024, SB 1223 amends the CCPA to add “personal information that reveals neural data” to the categories of personal information that constitute sensitive personal information. It further amends the CCPA to define “neural data” as “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is…

In Cybersecurity

United States: SolarWinds landmark ruling – Amid defense victories, questions remain on individual liability and material misstatements of fact

by , and 11 Mins Read

In brief In a landmark decision on July 18, 2024, Judge Paul Englemayer of the Southern District of New York dismissed most charges in the SEC’s enforcement action against SolarWinds and its CISO, Timothy Brown. The court ruled that cybersecurity controls are not part of a company’s “system of internal accounting controls” under Section 13(b)(2)(B)(iii) of the Exchange Act, dismissing these claims. However, the court upheld charges that SolarWinds and Brown misled investors with public…

In Cybersecurity

Cyber Transparency, Risk & Sanctions: How Cyber Incidents Give Rise to Export Control Issues

by , and 5 Mins Read

At the Update Conference recently hosted by the Bureau of Industry and Security (“BIS”), the Office of Export Enforcement introduced a newly established Cyber Division to manage the increasing number of disclosures it is receiving related to cyber incidents. This announcement signals increased regulatory scrutiny in cyber incidents and underscores the need for companies to update their cyber governance programs and incident response plans to analyze whether impacted data is subject to US export controls…

In Data Privacy

Kentucky is Off to the Races: Bluegrass state is 15th to Pass Comprehensive Privacy Law

by , , , , and 8 Mins Read

On April 4, 2024, the Kentucky Governor Andy Brashear signed HB 15, enacting the Kentucky Consumer Data Protection Act (“KCDPA” or the “Act”), to make Kentucky the 15th US state to adopt a comprehensive privacy law. Kentucky joins New Hampshire and New Jersey in a trifecta of states that have enacted privacy legislation in the opening months of 2024. In the days since the KCDPA’s signing, the consumer privacy stakes have been raised, with the…

In Cybersecurity

Mission Critical: CIRCIA’s Regulations and the Race to Secure Critical Infrastructure

by , and 9 Mins Read

Today, April 4, 2024, Cybersecurity and Infrastructure Security Agency (“CISA”) officially published its long-awaited Notice of Proposed Rulemaking (“Proposed Rule”) for the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”). The Proposed Rule requests written comments from the public no later than June 3, 2024. CISA will then have 18 months to promulgate a final rule which is expected to be finalized and in effect by October 2025. CIRCIA Big Picture CIRCIA is…

In Data Privacy

Living Free from the Sale of Personal Data: New Hampshire is the 14th US State to Pass Comprehensive Privacy Law

by , , , , , and 7 Mins Read

On January 18, 2024, the New Hampshire legislature passed SB255, making the Granite State the 14th US state to pass a consumer privacy law—and the second state to do so in January. Following enrolment—a formality to excise clerical errors—the bill will move to Governor Chris Sununu’s desk for final enactment. If it becomes law, SB255 will go into effect on January 1, 2025, giving businesses less than one year to ensure compliance with the new…

Load More