Tag Archives: cybersecurity

Attorney General Rokita on the possibility of a federal privacy law, Indiana’s breach notification law, and regulating data brokers

By Divonne Smoyer and Roger Gibboni on Posted in Privacy & Data Protection
In the June edition of IAPP’s Privacy Advisor, Divonne Smoyer and Roger Gibboni talk to Indiana State Attorney General Todd Rokita on the possibility of Congress passing a federal privacy law, Indiana’s different approaches to data privacy and protection, and its recent announcement that the state was joining Washington, Texas, and D.C. in an enforcement … Continue Reading

Department for Digital, Culture, Media and Sport launches consultation on app security

By Cynthia O’Donoghue, Yunzhe Zhang and Sarah O'Brien on Posted in Data & Cyber Security, Privacy & Data Protection, Social, Mobile, Analytics & Cloud (SMAC)
On 4 May 2022, the Department for Digital, Culture, Media and Sport (DCMS) launched a consultation (available here) to request views from the tech industry on potential interventions to enhance security and privacy requirements for firms running app stores and developers making apps.… Continue Reading

CafePress FTC settlement signals future approach to enforcement actions

By Nikki Bhargava, Lauren Weaver and Eric Manski on Posted in Data & Cyber Security
On March 15, 2022, the Federal Trade Commission (“FTC”) issued a proposed settlement with online custom merchandise platform CafePress in connection with the company’s alleged: (1) failure to implement reasonable security measures to secure consumers’ Personal Information; and (2) attempt to cover up a significant 2019 data breach. The proposed settlement would require CafePress to … Continue Reading

European Commission adopts two proposals for cybersecurity and information security regulations

By Cynthia O’Donoghue and Sarah O'Brien on Posted in Privacy & Data Protection
On 22 March 2022, the European Commission (“EC”) adopted two new proposals for a Cybersecurity Regulation and an Information Security Regulation (available here and here). These regulations aim to set common priorities and frameworks in order to further strengthen inter-institutional co-operation, minimise risk exposure and further strengthen the EU security culture.… Continue Reading

SEC proposes cybersecurity rules for registered funds and investment advisers

By Gerard Stegmaier, Howard Womersley Smith, Kile Marks and Eric Manski on Posted in Data & Cyber Security, Regulatory
The Securities and Exchange Commission (SEC) is proposing new rules to require registered funds (RFs) and investment advisers (RIAs) to implement comprehensive cybersecurity programs. Under the proposed rules, the SEC seeks to accomplish four main objectives, requiring RFs and RIAs to: Maintain and implement cybersecurity policies and procedures; Adopt new recordkeeping standards; Report significant cybersecurity … Continue Reading

Additional cybersecurity measure proposed for CIP Reliability Standards

By Colette Honorable, Debra Ann Palmer, Bart Huffman, Wendell Bartnick and Christian Blair on Posted in Privacy & Data Protection, Regulatory
In response to recent cybersecurity incidents, the Federal Energy Regulatory Commission (FERC) has announced a Notice of Proposed Rulemaking (NOPR) that would task the North American Electric Reliability Corporation (NERC) to impose additional cybersecurity requirements on high-, medium-, and, potentially, low-impact bulk electric systems in its Critical Infrastructure Protection (CIP) Reliability Standards.… Continue Reading

Cybersecurity 2.0: European Parliament adopts new draft directive

By Cynthia O’Donoghue on Posted in Data & Cyber Security
During the autumn of 2021, the European Parliament adopted a draft cybersecurity directive, the revised ‘Directive on security of network and information systems’ (commonly referred to as ‘NIS2’). When it moved to the Council, additional changes were made; one was to extend the time for Member States to transpose it into national law from 18 … Continue Reading

DOJ’s new Civil Cyber-Fraud Initiative

By Bart Huffman, Leigh T. Hansson, Liza Craig, Joshuah Turner and Jordan Rose on Posted in Privacy & Data Protection
On October 6, 2021, the Department of Justice (DOJ) announced the launch of its new Civil Cyber-Fraud Initiative that emphasizes accountability for conduct that could increase cybersecurity threats to the government. This initiative supports the Biden administration’s goals and efforts to improve U.S. cybersecurity generally. Those who do business with the government or receive federal … Continue Reading

Key rules of PRC’s new Personal Information Protection Law

By Amy Yin and Charmian Aw on Posted in Privacy & Data Protection
During the thirtieth meeting of the Standing Committee of the Thirteenth National People’s Congress of the People’s Republic of China on August 20, 2021, they finally passed the long-awaited Personal Information Protection Law (PIPL), which will come into force on November 1, 2021. Our recent client alert, the first in a series which we will … Continue Reading

Practical tips to safeguard your company information when an employee leaves?

By Charmian Aw and Adrian Aw, Resource Law LLC on Posted in Privacy & Data Protection
Last September the Singapore High Court heard a case relating to Singapore’s Personal Data Protection Act (PDPA). An individual had left his former employer, an investment company, to join a competitor firm. At this new firm, he sent an email to a client of his former employer’s, another individual, whom he had come to know … Continue Reading

Texas legislature updates state data breach notification law to provide for online posting of certain data breaches

By Bart Huffman, Wendell Bartnick and Haylie Treas on Posted in Privacy & Data Protection
On March 31, 2021, the Texas legislature passed House Bill 3746 (HB 3746), an update to the state’s breach notification statute. HB 3746 is expected to be signed into law by the Texas governor and become effective on September 1, 2021. The bill makes two primary changes to Texas’ current breach notification statute. First, the … Continue Reading

Recent report signals NIST may publish IoT cybersecurity standards

By Wendell Bartnick and Hubert Zanczak on Posted in Data & Cyber Security
Although regulators seem to think all too often that cybersecurity is an after-thought for internet-connected device manufacturers, the National Institute of Standards and Technology (NIST) recognizes that as the Internet of Things (IoT) grows, so do cybersecurity risks. In March 2021, NIST published several key takeaways from a recent workshop that provide helpful guidance for … Continue Reading

Proposed rule would impose new notification requirements on banks and their service providers when a cybersecurity incident occurs

By Catherine Castaldo, Trevor Satnick and Christine Gartland on Posted in Privacy & Data Protection, Regulatory
A new proposed federal rule, “Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers,” could impose accelerated notification requirements on banking organizations and their service providers when notification incidents (as defined in the proposed rule) occur. The Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal … Continue Reading

Cybersecurity Maturity Model Certification: New requirements in the near future

By Bart Huffman, Liza Craig, Elizabeth Leavy and Aryeh Younger on Posted in Data & Cyber Security, Regulatory
Beginning in November 2020, the Department of Defense (DoD) has confirmed that new solicitations will include the new Cybersecurity Maturity Model Certification (CMMC). Despite the impact of COVID-19, this confirmation indicates that the DoD is intent upon ensuring the protection of certain critical information and shoring up protection of its critical networks and supply chain. … Continue Reading

Medical Device Coordination Group guidance on cybersecurity for medical devices

By Cynthia O’Donoghue and Katalina Bateman on Posted in Data & Cyber Security
Background In light of the growing concern over cybersecurity and the increasing complexity of medical device supply chains, the Medical Device Coordination Group has released updated guidance on cybersecurity for medical devices (the Guidance). The Guidance is intended to supplement the essential requirements listed in Annex I of the Medical Devices Regulations (Regulations 745/2017 and … Continue Reading

U.S. cybersecurity – points to remember when business is not as usual

By Bart Huffman, Gerard Stegmaier, David Krone and Haylie Treas on Posted in Data & Cyber Security, Privacy & Data Protection
As the U.S. economy and educational system adapt to work and life at home, it is important to remember that cybersecurity (and related privacy) risks remain and are evolving. Remembering to think through measures that are in place to protect personal information, proprietary information, confidential information, and information needed for ongoing operations can help businesses … Continue Reading

ENISA releases report detailing security guidelines for Internet of Things

By Cynthia O’Donoghue and Daniel Millard on Posted in Privacy & Data Protection, Regulatory
On 19 November 2019, the European Union Agency for Network and Information Security (ENISA) released its report ‘Good practices for security of Internet of Things (IoT)’ (Report), providing a comprehensive analysis of security concerns surrounding IoT, secure Software Development Life Cycle (sSDLC) principles, and setting out best practices. Below, we highlight some of the key … Continue Reading

The EBA releases its final ‘Guidelines on ICT and security risk management’ report

By Howard Womersley Smith on Posted in Privacy & Data Protection, Regulatory
Last week (28 November 2019), the European Banking Authority (EBA) released the final version of its report entitled ‘EBA Guidelines on ICT and security risk management’ (the Guidelines) (link here) on the mitigation and management of financial institutions’ (FIs) information and communication technology (ICT) and security risks. We highlight below some of the key takeaways. … Continue Reading

Implications for employers and the biometric landscape under New York’s expanded data security law

By Kimberly Gold, Mark S. Goldstein, Alexandra Manfredi and Jim Barbuto on Posted in Privacy & Data Protection, Regulatory
Over the past several years, legislators from coast to coast have increasingly made data privacy and cybersecurity top priorities. The result has been a spike in the number and stringency of laws that impose proactive and reactive responsibilities – covering, for instance, data security and breach notifications – on companies that collect personal information, whether … Continue Reading

With latest lawsuit, New York attorney general continues to demand cybersecurity compliance

By Kimberly Gold and Jacqueline Lefebvre on Posted in Data & Cyber Security, Privacy & Data Protection
In a continued pursuit for cybersecurity compliance, New York Attorney General (AG) Letitia James has sued Dunkin’ Brands, Inc. (franchisor of Dunkin’ Donuts) over two data breaches in 2015 and 2018, accusing the company of mishandling a series of cyberattacks that together compromised more than 320,000 customer accounts. In the complaint filed last week, AG … Continue Reading

EU Cybersecurity Act gets the green light!

By Cynthia O’Donoghue and Howard Womersley Smith on Posted in Privacy & Data Protection
On 7 June 2019, Regulation (EU) 2019/881 on ENISA (the European Union Agency for Network and Information Security) and on information and communications technology cybersecurity certification, also known as the Cybersecurity Act, was given the final go-ahead and published in the Official Journal of the European Union.  The Cybersecurity Act will come into force on 27 … Continue Reading

FERC requests comments on proposed new CIP Reliability Standard regulating the transmission of data between control centers

By Regina Speed-Bost, Bart Huffman, Colette Honorable, Debra Ann Palmer, Wendell Bartnick, Justin Mirabal and Haylie Treas on Posted in Privacy & Data Protection, Regulatory
On April 18, 2019, the Federal Energy Regulatory Commission (FERC) issued a Notice of Proposed Rulemaking (NOPR) requesting comments on proposed Critical Infrastructure Protection (CIP) Reliability Standard CIP-012-1. As written, CIP-012-1 will require responsible entities to implement controls to protect communication links and data transmissions in an effort to mitigate cybersecurity risks to communications between … Continue Reading

The European Parliament adopts first stance to proposed EU Cybersecurity Act

By Cynthia O’Donoghue and Eleanor Brooks on Posted in Privacy & Data Protection
On 12 March 2019, the European Parliament issued its first position on the text proposed by the European Commission for a Regulation of the European Parliament and of the Council on ENISA (the European Union Agency for Network and Information Security), also known as the EU Cybersecurity Act. Initiatives to build strong EU-wide cybersecurity The … Continue Reading

Draft amendments to China’s personal information standards proposed

By Xiaoyan Zhang, Jim Barbuto, Trevor Satnick, Amy Yin and Catherine Jing on Posted in Privacy & Data Protection
China’s National Information Security Standardization Technical Committee issued draft amendments (Amendments) to the standards that govern the protection of personal information, “Information Security Technology – Personal Information Security Specification” (Standards, effective May 1, 2018) on February 1, 2019. The Standards provide guidance on interpreting China’s Cybersecurity Law (CSL) and set out best practices for the … Continue Reading
LexBlog