Photo of Jacqueline Lefebvre

Jacqueline Lefebvre

Subscribe to Jacqueline Lefebvre's Posts
Contact:Read more about Jacqueline Lefebvre

Many online platforms are using verification tools to address the broader concern of trustworthiness and credibility on the Internet. With a general move toward a “verified internet,” these online platforms are looking at new verification measures, including facial recognition and other biometric technology. The online adult video platform Pornhub announced last week that it will be introducing biometric technology to verify users who upload videos. In a statement, Pornhub explained that verification will be done by Yoti, a digital identity verification company, “by providing a current photo and government-approved identification document.”

Yoti advertises that it is a “privacy driven” verification solution. The company is a conduit between consumers and the platform owners, like Pornhub. Essentially, a consumer will provide Yoti with their biometric identifier, such as a video or voice recording, plus their government identification. Yoti will then verify that data for the platform owner, such as Pornhub. Pornhub will not see that information, but will rely on the verification to allow the consumer to access their site.
Continue Reading Use of biometric technology is latest trend toward a verified internet

On January 6th, the first day of the New York legislature’s 2021 session, NY lawmakers proposed Assembly Bill 27 (AB 27), the Biometric Privacy Act.  The legislative purpose of AB 27 is to provide safeguards for consumers regarding their biometric identifiers, such as fingerprints, handprints, retina or iris scans, voiceprints, and other facial and hand recognition.  Effectively, the proposed Act would require private (non-governmental) organizations that possess a biometric identifier or biometric information (i.e., information “based on” a biometric identifier) (collectively “biometric data”) to develop a written retention policy  setting forth the time period for information containing biometric data, as well as guidelines for permanently destroying such biometric data either when: (i) the initial purpose for obtaining such information “has been satisfied,” or (ii) within three years of the individual’s last interaction with the private entity, whichever happens first.

AB 27 would also require organizations to obtain individuals’ express written consent for the collection of their biometric data prior to collecting or otherwise obtaining such data. In addition, the proposed Act would prohibit organizations from selling or otherwise profiting from the biometric data which they possess, and separately mandate organizations to provide technical and organizational safeguards around biometric data that are the same or more protective than the measures it maintains for other confidential and/or sensitive information.
Continue Reading New York proposes a new Biometric Privacy Act

In a continued pursuit for cybersecurity compliance, New York Attorney General (AG) Letitia James has sued Dunkin’ Brands, Inc. (franchisor of Dunkin’ Donuts) over two data breaches in 2015 and 2018, accusing the company of mishandling a series of cyberattacks that together compromised more than 320,000 customer accounts.

In the complaint filed last week, AG James alleges that Dunkin’, by failing to notify consumers of the breaches or to take sufficient steps to investigate and safeguard consumer data, violated not only its internal data security procedures but also New York data breach notification and consumer protection laws.

In 2015, Dunkin’ was the target of a series of brute force attacks, in which automated software was used to gain access to accounts by guessing various combinations of usernames and passwords. The lawsuit alleges that despite being notified of these attacks by one of its mobile app developers, Dunkin’ did not notify its customers – in violation of the New York data breach notification law – nor did it conduct any security protocols to prevent future attacks, such as resetting passwords or freezing accounts.Continue Reading With latest lawsuit, New York attorney general continues to demand cybersecurity compliance

Another potentially groundbreaking California ballot initiative has been announced, just as companies began to digest and incorporate the amendments to the California Consumer Privacy Act (CCPA) into their compliance plans and learned the draft CCPA regulations will be issued by the California Attorney General in October. Last week, the primary advocate for and co-architect of the CCPA announced a new privacy initiative for California’s November 2020 ballot – the California Privacy Rights and Enforcement Act of 2020 (CPREA), which would revise and expand upon the CCPA.

The new law would:

  • Create new rights around the use of sensitive personal information including race, ethnicity, geolocation, health and financial information.
  • Provide enhanced protection for children’s privacy by requiring opt-in consent to collect data from individuals under 16 and tripling CCPA fines on children’s privacy violations.
  • Require transparency around automated decision-making and profiling regarding employment, housing, credit, and politics.
  • Establish a new authority, the California Privacy Protection Agency, to enhance enforcement of the law and provide guidance to consumers.
  • Require corporations to disclose whether and how they use personal information to influence elections.
  • Require that future amendments are limited to furthering the law.

Continue Reading A new California privacy initiative seeks to further bolster individual privacy rights