According to media reports, Russian government hackers have penetrated the systems of thousands of companies across a variety of industries, as well numerous US government agencies. Moreover, what has been publicly reported may be only the tip of the iceberg in terms of both the scope of the attacks’ victims and the attackers’ methodologies. The most recent reporting also suggests that victim companies are not just those that would be of obvious interest to Russian intelligence services. Accordingly, all companies should assess whether they have been affected by this attack, what steps they need to take to remediate those effects, and what legal and contractual obligations they may have to notify government agencies, business partners, customers, and individuals.
Continue Reading The Urgent Need to Assess and Respond to Russian Supply Chain Attacks
Webinar: CCPA Enforcement Is About to Begin: Are You Ready?
On July 1, 2020, the California attorney general is expected to begin enforcing the California Consumer Privacy Act (CCPA), California’s groundbreaking new privacy law which has been in effect since January 1, 2020. In addition, the attorney general is also finalizing regulations that interpret and build upon the CCPA. To minimize the risk of potentially
Data Security Components of New York’s SHIELD Act Take Effect
While most businesses have been preoccupied with navigating the effects of the COVID-19 pandemic, a significant change to businesses’ data security obligations has taken effect in New York. On March 21, 2020, the second part of the Stop Hacks and Improve Electronic Data Security Act (the SHIELD Act) went into effect in New York State.
California Attorney General Releases Third Draft of CCPA Regulations
On March 11, California Attorney General (AG) Xavier Becerra released a third version of draft regulations implementing the California Consumer Privacy Act (CCPA). The third draft contains relatively minor changes from the second draft, which was released in February, suggesting that the AG is close to finalizing the regulations, and that enforcement is likely to begin on schedule on July 1, 2020.
Continue Reading California Attorney General Releases Third Draft of CCPA Regulations
CCPA Makes First Court Appearance
The California Consumer Privacy Act (CCPA) has been in effect only since January 1, but it has already been cited in a lawsuit, apparently for the first time. On February 3, plaintiffs filed a class action complaint in the US District Court for the Northern District of California against retailer Hanna Andersson, LLC and Salesforce.com,
California Attorney General Releases Modified CCPA Regulations
On February 7, 2020, California Attorney General (AG) Xavier Becerra released a second version of draft regulations implementing and interpreting the California Consumer Privacy Act (CCPA). The second iteration of the Attorney General’s draft regulations contain numerous important changes from the initial draft, some of which are summarized in this alert. One of the most
The California Attorney General’s CCPA Regulations: Clarity or More Questions?
Last week, California Attorney General Xavier Becerra released much anticipated regulations implementing and interpreting the California Consumer Privacy Act (CCPA). Given the Attorney General’s responsibility for enforcement and the many open questions surrounding the CCPA, even after another round of amendments were passed last month, businesses have been eagerly waiting for the draft regulations to
The Final Countdown – The EU General Data Protection Regulation
The EU General Data Protection Regulation (GDPR) comes into force on May 25, 2018.
The GDPR makes many important changes to European Union (EU) data protection law, but it is not a complete departure from existing principles. Many of the concepts with which organizations are familiar will continue to apply under the GDPR. Thus, the
OFAC Issues Cyber-Related Sanctions Regulations
On December 31, 2015, the US Treasury Department, Office of Foreign Assets Control (OFAC) issued the Cyber-Related Sanctions Regulations (CRSR), 31 C.F.R. Part 578. The CRSR formally implement the sanctions set forth in Executive Order (EO) 13694 of April 1, 2015, which authorizes sanctions against persons involved in malicious “cyber-enabled” activities, and are effective immediately.
CFTC Adopts Proposed Cybersecurity Regulations
On Wednesday, December 16, 2015, the Commodity Futures Trading Commission (CFTC or Commission) approved for publication two proposed rules to amend existing regulations addressing cybersecurity. The proposed rules would establish testing obligations and safeguards for the automated systems used by designated contract markets (DCMs), swap execution facilities (SEFs), swap data repositories (SDRs) (the Exchange Proposal), and derivatives clearing organizations (DCOs) (the Clearing Proposal and, together, the Proposals).1
The Commission’s Proposals grant regulated entities with significant deference with respect to the development and implementation of policies and procedures reasonably designed to demonstrate compliance with the new cybersecurity provisions. However, these new regulatory burdens will come with significant operational, technology, and other resource burdens, including ongoing testing and engagement with third-party service providers. Furthermore, the scope of the Proposals for testing may extend further than similar cybersecurity standards established by other federal agencies.
The Commission unanimously approved the Proposals. They were published in the Federal Register on December 23, 2015 and are subject to a 60-day public comment period ending on February 22, 2016.
Continue Reading CFTC Adopts Proposed Cybersecurity Regulations