California’s late-session privacy and AI agenda is moving quickly. In the past 30 days, Governor Gavin Newsom has signed several technology bills addressing AI accountability, child online safety, and targeted privacy protections, while other significant measures remain on his desk. Because the Legislature adjourned at the end of August, the Governor has until September 30
Regulators
Data Privacy and Cybersecurity Look Ahead: First Half of 2025
By John Pavolotsky & Kenny Gutierrez on
Posted in Cybersecurity, Data Protection, ePrivacy, EU, Laws / Regulations, Privacy, Regulators, Security
Privacy and cybersecurity are incredibly dynamic, and in 2025 we have committed ourselves to a look ahead post every six months, with the next one in July 2025. The new Congress convened on January 3, 2025, and a new administration starts on January 20. Most state legislatures reconvene in early-to-mid January. If you track privacy…
Just Around the Corner: The Utah Consumer Privacy Act (“UCPA”)
By John Pavolotsky & Elena Miller on
2023 has seen a flurry of general state privacy laws, with twelve (12) such laws now on the books. The next one to “go live,” on December 31, 2023, is the Utah Consumer Privacy Act (UCPA). With no general federal privacy law in sight, the state privacy landscape continues to get more crowded and challenging…
A New Consumer Personal Data Protection Law in Oregon
By John Pavolotsky & Stoel Rives Attorney on
Q&A about the new Oregon consumer personal data protection law.
Continue Reading A New Consumer Personal Data Protection Law in Oregon
Digital Transformation – Regulator Issues $80 Million Penalty for Not Doing It Right
By Romaine Marshall, Jon Washburn & Jose Abarca on
Digital transformation refers to the process of leveraging technology, people and processes to innovate or stay competitive. The main driver of this process is often data. For a vivid illustration see Data Never Sleeps, an infographic released by Domo, a leading business analytics company.
While executing digital transformation the right way can lead to…
Anthem Pays OCR $16 Million in Record-Breaking HIPAA Data Breach Settlement
By Sarah Bimber on
The Office of Civil Rights (OCR) announced in a press release this week that Anthem, Inc. (Anthem), one of the nation’s largest health benefit companies, has agreed to pay $16 million and take substantial corrective action to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. This settlement…
France – CNIL
By Amy Carlson on
Posted in EU, Regulators
France’s Commission Nationale de l’Informatique et des Libertés (“CNIL”) provides great tools and resources as well.
- CNIL recently updated its Privacy Impact Assessment (PIA) Guides which include application to connected objects, methodology, template and knowledge bases.
- CNIL also recently updated its PIA software tool in four languages that companies can use for compliance.
- CNIL provides
…
Germany – BfDI
By Amy Carlson on
Posted in EU, Regulators
Germany’s Bundesbeauftragte für den Datenschutz und die Informationsfreiheit published the Federal Data Protection Act to adapt GDPR. Germany provided some extensive guidance on GDPR here. Germany also publishes the standard data protection model, SDPM, in English on its site. Also available from the site are guidance materials about GDPR from the German Data…
UK ICO
By Amy Carlson on
Posted in EU, Regulators
The United Kingdom’s Information Commissioner’s Office (“ICO”) is a great resource for companies looking for clear DPA guidance. The ICO has provided a Guide to the GDPR which is very targeted and comprehensive as well as resources for organizations including several guides. Getting Ready For GDPR Resources is a nice package of information prepared by…
Article 29 Working Party
By Amy Carlson on
Posted in EU, Regulators
The European Commission – Data Protection links to the Article 29 Working Party Guidelines which supplement our understanding of GDPR:
- Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (wp251rev.01)
- Guidelines on Personal data breach notification under Regulation 2016/679 (wp250rev.01)
- Guidelines on the application and setting of administrative fines (wp253). In
…
European Commission – Data Protection
By Amy Carlson on
Posted in EU, Regulators
The European Commission – Data Protection provides links to EC data protection policies, information and services. The Commission provides the official GDPR text in multiple languages, describes the European Data Protection Board and its responsibilities, provides detailed guidance and resources on data transfers outside the EU, and some focused discussion of the changes to…