Personally Identifiable Information

New commentary from a respected think tank attempts to provide guidance on cross-border data transfers.  The guidance proposes principles for determining which country’s law to apply to a cross-border transfer.  Although there is no guarantee that the guidance will gain favor with courts or regulators, it is an important indicator
Continue Reading Navigating Cross-Border Data Transfers: Lessons from the Sedona Conference Commentary

As public pressure increases on legislators to better protect the personal information that organizations collect, interest has grown in using a property framework, rather than the current privacy model. On October 1, U.S. presidential candidate Andrew Yang became the latest policymaker to advocate for a data security framework that treats
Continue Reading Should Protection of Personal Data Be Regulated Using A Property Model, Rather Than a Privacy Model? Probably Not.

Appropriate cybersecurity disclosures can reduce risk of class action securities cases following a data breach.  We have written recently on the rise of these class action securities cases, including the Intel case and the Yahoo! $80 million settlement.  We have also been closely watching the Equifax case.  The recently
Continue Reading Data Breach Securities Class Actions—An Update on Equifax and Thoughts on Future Cases

If you haven’t been closely following, you may be of the mistaken view that without evidence of actual harm, consumer plaintiffs in federal cyber breach cases have no standing.  While that may have been roughly correct in 2016, the story in 2018 is more complicated, and getting better for plaintiffs.
Continue Reading Still Standing—The Road for Plaintiffs in Consumer Cyber Breach Class Actions May Be Getting Smoother

Regulators in almost every U.S. state have the authority to enforce cybersecurity compliance under their state’s laws, but until recently, they have rarely exercised this power, leaving enforcement mostly to federal agencies like the FTC.  With the recent Equifax breach, this appears to be changing.

The Massachusetts Attorney General filed
Continue Reading Will Equifax Lead to Increased State-Level Cybersecurity Enforcement?

We have issued a memo on recent proposed cybersecurity regulations by the New York State Department of Financial Services that would be more stringent than existing federal requirements for certain financial entities. The memo highlights similarities and differences between the proposed regulations and federal regulations and guidance.

Read the Full
Continue Reading Davis Polk Memo – New York State Department of Financial Services Proposes New Cybersecurity Regulations