The Cybersecurity Law Report recently published an article by Davis Polk titled Lessons from Equifax on How to Mitigate Post-Breach Legal Liability.  The article analyzes the July 2019 settlement between Equifax and the Federal Trade Commission, Consumer Financial Protection Bureau, and 50 state and territorial attorneys general and uses
Continue Reading Lessons from Equifax on How to Mitigate Post-Breach Legal Liability, by the Davis Polk Cyber Blog Team, published in The Cybersecurity Law Report

On April 30, 2018, BLU Products, Inc. (“BLU”) reached a settlement with the Federal Trade Commission (“FTC”) over allegations that BLU allowed ADUPS Technology Co. LTD (“ADUPS”) to collect detailed personal information about BLU’s consumers without their knowledge or consent, despite BLU’s assurances that
Continue Reading FTC Reaches Proposed Settlement With Mobile Phone Manufacturer BLU, Highlighting the Importance of Effective Oversight of Third-Party Vendor Data Security and Privacy Practices

Plaintiffs in data breach cases have tried many theories of recovery, including negligence, negligence per se, violations of state data protection statutes, violations of the Fair Credit Reporting Act, breach of fiduciary duty, and violations of the constitutional right to privacy, with mixed results.

Courts have rejected many of these
Continue Reading The Rise of State Consumer Protection Act Cyber Cases

On Halloween, the New York and Vermont attorneys general obtained a $700,000 settlement from Hilton for, among other violations, late breach notification.  Earlier this week, we noted that the Reserve Bank of India (“RBI”) imposed a $1 million USD fine on India’s Yes Bank for violating RBI’s 2 to 6
Continue Reading More Tough Penalties for Late Breach Notification