Until recently, biometric privacy was a niche area of the law that had little application to most companies. But with the rapid growth in commercial biometric data collection, including voice samples, fingerprints, retina scans, and facial geometry, as well as some recent developments in the applicable case law, it’s probably
Continue Reading
Privacy
A New Safe-Harbor Approach to Cybersecurity Regulation
By Avi Gesser & Will Schildknecht on
Momentum is building for federal privacy legislation, with several different proposals circulating in Washington. Ohio’s new cybersecurity law offers an interesting approach for incentivizing companies to protect their customers’ personal data.
We have written previously on two competing models for cybersecurity regulation—“standards” versus “rules.” The standards-based approach, historically…
Continue Reading
Federal Privacy Legislation Is Coming. Maybe. Here’s What It Might Include
Momentum is building for federal data privacy legislation, in large part due to the passage of the California Consumer Privacy Act (CCPA) (which goes into effect in 2020) and other states enacting or considering their own consumer privacy laws. These developments have businesses concerned that they will face a patchwork…
Continue Reading
Private Actions Under the GDPR—One More Privacy Concern for U.S. Companies to Worry About?
In the lead-up to the EU’s General Data Protection Regulation (“GDPR”) becoming effective on May 25, little attention was paid in the U.S. to the private right of action that the GDPR creates. But so far, private actors have filed approximately 24 cross-border GDPR complaints with EU regulators.
At least…
Continue Reading
FTC Reaches Proposed Settlement With Mobile Phone Manufacturer BLU, Highlighting the Importance of Effective Oversight of Third-Party Vendor Data Security and Privacy Practices
By Daniel F. Forester & Reagan T. Lynch on
On April 30, 2018, BLU Products, Inc. (“BLU”) reached a settlement with the Federal Trade Commission (“FTC”) over allegations that BLU allowed ADUPS Technology Co. LTD (“ADUPS”) to collect detailed personal information about BLU’s consumers without their knowledge or consent, despite BLU’s assurances that…
Continue Reading
Blockchain for Data Protection: A Double-edged Sword or a Techno-regulatory Oxymoron?
By Avi Gesser, Trevor I. Kiviat, Carolin L. Raspe & Mengyi Xu on
In January 2018, at the Eleventh Annual International Conference on Computers, Privacy and Data Protection (the “Conference”) in Brussels, one panel that made some headlines centered around blockchain technology in the context of data protection. The core inquiry of the panel was two-fold: (1) whether blockchain technology can…
Continue Reading
Cybersecurity and Vulnerability Assessments: Evolving Law on Hacking and Extortion in the Age of Bug Bounties
Companies and law enforcement are increasingly turning to white hat hackers for help. The FBI apparently paid consultants over $1,000,000 to unlock an iPhone used by one of the shooters in the San Bernardino attacks, and companies such as Microsoft, Uber, Facebook, and Google are paying hackers tens of thousands…
Continue Reading
Announcing our Cybersecurity Blog; One Month Until the NYDFS Cybersecurity Rules Take Effect
With about a month to go until the first set of NYDFS’s cybersecurity rules go into effect (on August 28, 2017), we are proud to announce the formal launch of the Davis Polk Cyber Blog. The blog will help you keep pace with industry best practices and be aware…
Continue Reading
The PetyaWrap Attack, Anthem Data Breach Settlement, and NYDFS Cyber Regulations All Highlight that Companies Should Review Their Access Controls
Three recent cybersecurity events highlight the need for companies to review their access controls to limit who has administrator privileges and how long those elevated privileges last.
First, this week, computer malware that has variously been called PetyaWrap, WannaCry2, GoldenEye and NotPetya began spreading in dozens of countries, encrypting computers…
Continue Reading