A New Technology for Web Browser Opt-Outs Could Trigger New Legal Requirements

If your organization has a website directed at California consumers (or US consumers generally), you should start thinking about this soon: A group has developed the technology to honor web browsers’ privacy signals, which could have implications under the California Consumer Privacy Act.

The California Online Privacy Protection Act of 2003 (CalOPPA) was the first broadly-applicable consumer privacy statue in the US. It merely required companies to have website privacy policy statements and to state clearly whether or not they would honor “Do Not Track” signals from a user’s web browser; it did not require companies to honor those signals.

The lawmakers assumed that technology would be created to honor those opt-out signals, and that companies would be pressured by market forces to honor them, but that never really happened.  It has been almost impossible to honor those signals until now, and as a result, almost all US-facing websites have a privacy policy statement that says “we do not recognize browsers’ Do Not Track signals.”

California's Attorney General, which enforces CalOPPA, was not satisfied with industry's failure to develop the technology and honor Do Not Track signals.  When the AG released regulations under the California Consumer Privacy Act, which became enforceable in mid-August, he included a provision that says that companies must honor browsers’ privacy signals as a valid Do Not Sell instruction…even though the technology doesn’t yet exist. The AG explained that the requirement "is forward-looking and intended to encourage innovation and the development of technological solutions to facilitate and govern the submission of requests to opt-out." Section 999.315 of the regulations says "[i]f a business collects personal information from consumers online, the business shall treat user-enabled global privacy controls, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information as a valid request submitted pursuant to Civil Code section 1798.120 for that browser or device, or, if known, for the consumer." [emphasis added]

Now, it appears a group of companies and nonprofits, including the Electronic Frontier Foundation and DuckDuckGo have developed the technology, calling it the Global Privacy Control framework.  THe express intent, according to the creators is "to communicate a Do Not Sell request from a global privacy control, as per CCPA-REGULATIONS §999.315." It is already available in beta in certain browser updates or as add-on browser scripts, and consumers will begin sending those signals all over the Internet.  Companies will  be under tremendous pressure to adopt the technology framework and begin honoring the signals quickly.

 It is not yet perfectly clear if and when the GPC would be treated as a legally binding Do-Not-Sell instruction.  Here's why:

• It is not clear whether the AG had the authority to include this requirement in section 315 of the regulations.  The global privacy control concept is not expressly stated in the CCPA, although the DOJ and Office of Administrative Laws obviously felt the authority was there.  The delegation of authority to the AG in Section 1798.185(a)(7) is broad.
  
• Competing frameworks could develop. It is not clear who will decide whether a framework is "official" or "enforceable."  Perhaps a formal endorsement of the California Attorney General is required.  California's Attorney General has informally endorsed the GPC framework via Twitter.
• Right now the GPC framework is not a finalized standard, according to the website.  It's still being tested.  It is not certain when it would be finalized.
  

Because the CCPA's definition of "sale" is so broad, and could be interpreted to cover technologies that are ubiquitous across the web (such as third-party advertising cookies), the GPC could affect large numbers of website operators.

Key Point: Companies covered by CCPA should begin thinking now about whether and how to implement this new technical framework. 

The Employee Data Dilemma: Should Companies Establish An Employee Privacy Program Now, or Later?

At a time when a global pandemic and economic recession have left many employers in the US cash-strapped, most would probably prefer to defer any investment of time and money in an employee data privacy compliance program.  

Employers with a substantial number of California employees (or contractors) are currently faced with a conundrum: whether to establish an employee data privacy program now, or later.

The California Consumer Privacy Act, as originally written, applied to  personal information about "consumers," but the term "consumer" was so broadly defined that some people speculated that it covered employees and contractors as well as individual customers.  Later in 2019, AB 25 was proposed by Assemblymember Chau to clarify that the intent was not to cover employees, but after objections were raised (and backed by powerful labor unions, I'm told), AB 25 was amended to create a temporary,  partial exclusion from the CCPA until January 1, 2021.  That is the version of AB 25 that passed.  The idea, as I understand it, was that the California legislature would come up with some other way of addressing employee privacy before the end of 2020.  (I wrote about that briefly here.)

We are now halfway through 2020, and the legislature has not yet delivered a solution.  Companies are starting to grow concerned.  Under current law, companies have six months to create an employee data privacy program.  

The California Privacy Rights Act, better known as "CCPA 2.0," is a ballot initiative promoted by the same people behind the CCPA, and it has officially qualified to be on the November ballot in California.  Polling suggests it is highly likely to be approved by voters.  There is one aspect of CPRA that would help companies: It would extend the partial exemption of employee and contractor data for two additional years.

The problem for companies is that we will not know if CPRA has passed until November 3. If it does not pass, it will be too late to do the work required by January 1 (less than two months later). 

Companies must decide whether (a) to take the gamble that CPRA will pass, and defer the work, or (b) to do the work now, even though it likely will not be necessary to comply until January 1, 2023.

(There is a third possibility: Assemblymember Chau has introduced AB 1281, which would push the deadline out by one year to January 1, 2022.  Unfortunately, that bill has not made meaningful progress in the legislature, and currently lingers in committee.  Perhaps, if the CPRA somehow fails, AB 1281 could be enacted rapidly during November or December.)

Based on my informal survey of privacy professionals, it seems many companies are not preparing employee privacy programs, and are simply assuming that CPRA will pass.  (I have not yet seen any actually polling of privacy pros on this question.)  There is certainly a degree of risk in this approach.  Companies with the resources would be best served by preparing now, rather than later.  Companies struggling to survive, however, have a difficult decision to make. 

What Is A "Sale" of Personal Information Under the CCPA? No One Knows (Although the California Department of Justice Says It Is Obvious)

In my opinion, the most vexing unresolved question associated with the California Consumer Privacy Act is what the term "sale" means.  Specifically, what "valuable consideration" renders the sharing of personal information a "sale"?  The consequences for businesses are substantial. 

Comment W280-5 dealt with this specifically and politely: "...it would be useful to have the definitions of ‘sale’ and ‘valuable consideration’ clarified."

The Attorney General's regulations and guidance have repeatedly failed to address or explain this, despite pleading from industry. Instead, the California Department of Justice glibly declined on the basis that the meaning is already clear: "There is no need to clarify the definition of 'sale'....   [T]he terms 'valuable' and 'consideration' are reasonably clear and should be understood by the plain meaning of the words."

It is anything but clear.

Even the CCPA's proponents, Californians for Consumer Privacy, know it is unclear.  They have attempted to add clarity in the CPRA proposal, although even that attempt falls far short. 

As a result, we will likely spend enormous time, energy, and money (including taxpayer dollars) in the coming months and years trying to bring clarity to the question. In the meantime, there will be massive uncertainty in several of the industries that Californians and Americans desperately needs to help revive its economy as the COVID-19 pandemic subsides. 

(R) FreeVectors.net

Are The California Consumer Privacy Act Regulations Delayed?

***Update: The California Attorney General filed the final regulations on July 2nd, late, and requested expedited review so that they could be enforceable within 30 business days (as opposed to October 1 or even the 90 day period provided for by COVID-19 changes to the rules).  After having waited almost two years to finalize rules, and still missing the deadline, the Attorney General now expects companies to be able to react on short notice. ***

It appears the California Consumer Privacy Act regulations will not become effective on July 1st after all.

The latest round of revisions to the regulations, released by the California Department of Justice on March 11, triggered an additional 15 day public comment period, which ended in late March.  Following the comment period, the Department of Justice was required to consider any comments received, and submit the final text to the California Secretary of State so that the California Office of Administrative Law could review them.  (For the handful of legal nerds interested in the minutia, the entire administrative rulemaking process in California is described here.)

Under the ordinary rulemaking process in California, regulations become effective on one of four specific dates, based on when they are filed.  Rules filed between March 1 and May 31 are effective on July 1, but rules filed later (until August 31) are effective on October 1.

It doesn't look like the California Department of Justice met the May 31 deadline, because the CCPA regulations are not showing up on the OAL's list of regulations under review as of today.  It seems possible that the regulations might not be effective until October 1.  It's also possible that the regulations could have been submitted and will still become effective on July 1. The OAL says that there are exceptions to the normal process "if the agency demonstrates good cause for an earlier effective date."

The statute itself required the California DOJ to promulgate rules by July 1 ("On or before July 1, 2020, the Attorney General shall solicit broad public participation and adopt regulations to further the purposes of this title"), which is also the date on which the DOJ must begin enforcing the CCPA. It now appears that the DOJ will begin enforcing the statutory language on July 1 but will not be able to enforce regulations until October.

[If you have any additional insights on this regulatory issue, please share them with me.]

First Take: Summary of Revisions to the CCPA Regulations

On Friday afternoon, and without advanced notice, the California Department of Justice released changes to the California Consumer Privacy Act (CCPA) regulations that will affect how companies all over the world attempt to comply with the CCPA.

Background

Before describing the changes, let's remember how we got here.  The CCPA began as a ballot initiative funded by a wealthy real estate developer.  The ballot measure was so popular that it was certain to pass in the 2018 election, so the California legislature struck a deal with the proponents to make it a statute immediately (which made it easier for the legislature to amend).  It was amended once in 2018 and several times in September 2019.

The law became effective on January 1, 2020. When the CCPA was enacted back in June 2018, it delegated certain rulemaking responsibility to the California Department of Justice, led by the Attorney General.  After fifteen long months--and painfully close to the CCPA's effective date of January 1, 2020 the Attorney General released proposed regulations on October 10, 2019.  Because the Attorney General waited so long to publish regulations, the statute says that the California Department of Justice cannot begin enforcing the law until six months following its effective date--July 1, 2020.  The Attorney General has said, however, that companies are expected to comply on January 1, 2020, and enforcement actions after July 1 might relate to activities taken between January 1, 2020 and July 1, 2020.

The new, standard CCPA opt-out button

When the regulations we first released on October 10, 2020, there was a public comment period, and many interested people, companies, and groups commented on the proposal.  Many pointed out that the regulations created new burdens not found in the statute, failed to clarify many ambiguities in the statute, and introduced new ambiguities.  The Attorney General, however, said in December that there would be no major changes to the regulations, despite the voluminous comments and criticisms. 

In response to the comment letters, and to clarify certain ambiguities in the regulations, the Department of Justice revised the regulations on Friday, February 7, 2020.  Despite the Attorney General's statement, hardly a paragraph of the original regulations is left intact; all 32 pages of the revisions show significant changes.

The Changes

Many of the changes are merely clarifying edits and do not signal substantive policy changes.  While it will take time to digest and understand the effects of the changes, my quick, initial summary of the more salient changes are listed below:

• The disclosure of the categories of sources of personal information will be more specific than the three categories originally described. Several additional examples are provided: advertising networks, internet service providers, data analytics providers, operating systems and platforms, social networks.  Businesses will need to revise their public-facing privacy policy statements and disclosures in response.
• New provisions addressing employee data are included. The term "employment-related information" is added.  Disclosures can be hyperlinked. 
• More specific instructions for handling household requests are included.  Companies will need to revise their procedures to address this. 
• The definition of "personal information" is to be interpreted slightly less broadly than some have thought.  For example, even though the statutory definition includes IP addresses, all IP addresses will not be considered personal information.  A consumer's IP address is only considered personal information if it can be linked to the consumer or household. 
• The WCAG 2.1 (not 2.0!) accessibility standards are incorporated by reference. 
• The "notice at collection" may be oral.
• Non-intuitive collection via a mobile device will require a "just-in-time" notice, such as a pop-up window.
• Businesses may use personal information for additional purposes if they are not "materially different" from the purposes previously disclosed.  This gives businesses a little more flexibility to adjust to new use cases than the previous language.
• It appears that purposes need not be disclosed for each category of personal information, as originally required.  (Many companies may not need to describe purposes in the granular detail found in privacy policy statements published on January 1.)
• Companies that collect consumer personal information only indirectly can avoid the notice of collection if they register as data brokers with the California Attorney General. All of the implications of this change are unclear to me at this point, but this could be very significant.
• Mobile apps can use hyperlinks to privacy policy statements. 
• A description of the process for authorized agents to demonstrate authority is no longer required to be included in the notice of opt-out rights.
• The privacy policy statement URL is no longer required to be included in the notice of opt-out rights. 
• Businesses do not need to commit to never sell personal information in the future in order to avoid opt-out notices, as was perhaps implied by the initial regulatory language.
• A simple opt-out graphic is included for use in lieu of the hyperlink text for the opt-out mechanism.
• Businesses must disclose the value of the consumer's data, explain how the financial incentive is related to the value of the consumer's data, when giving a notice of financial incentive.  Businesses will need to revise these notices to comply with the change.  This likely means loyalty and discount program terms and conditions need to include a dollar value for consumer data.  There are also new examples relating specifically to loyalty programs.
•  Categories of sources of information, purposes for collection, and categories of third parties are no longer required to be disclosed separately for each category of personal information.  (The complex matrices and other highly-granular disclosures that some businesses have already released in response to the proposed regulations now seem unnecessary.  Those companies may want to make more general statements going forward.)
• The requirement to affirmatively state whether data has been sold in the prior 12 months is removed.
• The categories of third parties to whom personal information is sold must be disclosed separately for each category of personal information.  
• Verification processes must be disclosed generally, not specifically, in the notice at collection.
• The right to opt-out disclosure must state whether or not the company sells personal information.
• Online-only, direct-to-consumer businesses can limit consumer requests to email; all others must offer two or more options.  The webform is no longer mandatory if a business has a website. 
• The requirement to accept consumer requests to know and requests to delete via an additional method based on how the business interacts with consumers is now recommended but not mandatory.  
• Confirmation must be sent within 10 business days, not calendar days.
• If a business cannot verify identity within 45 days of receiving a request, the business may deny the request.
• Businesses need not search for personal information if four criteria are met (this will be rare).
• Business may not disclose certain biometric data in response to a request to know.
• A response to a request for categories of personal information must include additional information.
• If identity cannot be verified, a business must ask if the consumer wishes to opt out of the sale of their personal information (for which verification is not required).
• A business does not have to describe how it deleted the consumer's data pursuant to a deletion request, but must state whether or not it has done so.
• The revisions say that a business may tell a consumer that it is retaining a record of a deletion request "to ensure the personal information remains deleted from the business's records."  (While re-introduction of data through automated data syncs and dumps is a legitimate concerns, I worry that such a statement could lead a consumer to think that a business has a duty to avoid collecting the consumer's data in the future, or to periodically purge the data in the future.)
• If prohibited from fulfilling a deletion request by law, the business must now explain the legal conflict. (!)
• Several changes to the constraints placed on service providers are present, including the ability of service providers to use personal information to improve their own services.  (This was important, especially for AI providers.)
• It must be "easy" to opt-out and involve "minimal steps." 
• Additional expectations are set regarding the honoring of browsers' privacy settings and the "opt out" signal.  It is still unclear how this will work in the real world.
• An authorized agent must have written authority that is signed by the consumer, and the business can require the consumer to confirm directly to the business that the authorized agent has permisison to do so.
• Statistical disclosure is due on July 1 of each calendar year, for businesses that meet the threshold requirements for reporting.  (I believe July 1, 2021 will be the first reporting deadline.)
• Household requests require verification of all household members.  (This seems likely to cause most businesses to treat household requests as multiple individual requests, for practical operational purposes.)
• Verification cannot involve a fee payable by the consumer, even if payable to a third party.  Businesses cannot require notarization for verification unless the business pays for the notarization.  (Some businesses will need to revise their verification processes.)
• Requests must be denied unless verified in accordance with the regulations (businesses seem to have no discretion). 
• Authorized agents must use reasonable security procedures and cannot use a consumer's data for additional purposes.
• Businesses must establish a method to verify that a parent acting on behalf of a child under 13 is the parent (or guradian).
• If the value of consumer data cannot be calculated or does not relate to the value of a financial incentive, the financial incentive cannot be forfeited in response to a request to delete (unless the incentive is required by federal law).  The value of consumer data can be calculated based on the value to all individuals, not just the business's consumers.  The "typical consumer" concept is removed.

Again, this is just a quick summary after an initial reading of the revisions.  As I (and others) continue to scrutinize the revisions, better understandings and additional insights are likely to emerge, so please stay tuned.

What's Next?

The revisions to the regulation trigger an additional 15 day public comment period, which ends on February 24.  Following the comment period, the Department of Justice will submit the final text to the California Office of Administrative Law, which has 30 business days to review the regulations before they will go into effect.  In other words, the earliest date that the regulations could become effective is early April.  The latest date I can imagine them becoming effective is July 1, when the Department of Justice begins bringing enforcement actions against companies for violations.

If you would like to read the revised regulations for yourself, you can find them here. The notice is here.

Was 2019 the “Year of Privacy” in the U.S.? (Or Will It Be 2020?)

What a year it has been! As one year closes and another begins, let us take a moment to reflect on the significance of 2019. It may not be an exaggeration to say that 2019 brought some of the most important changes in privacy and data security law that most of us have seen in our professional careers.

Yet, with all the momentum toward heightened consumer data protection, there remain conspicuous absences: Congress again considered, and again failed to deliver, a comprehensive privacy and data security bill. The North Carolina General Assembly declined to meaningfully revise the State’s core privacy and cybersecurity statute (the Identity Theft Protection Act or ITPA); House Bill 904, the most recent incarnation of Representative Jason Saine’s and Attorney General Josh Stein’s bipartisan update to the ITPA, languishes in the General Assembly. The General Assembly did, however, approve some modest updates to the data security laws affecting North Carolina government entities, in HB 217/SL 2019-200, giving the State Chief Information Officer greater oversight of State agencies’ cybersecurity controls.


Other states were more successful in modernizing privacy and data security laws in 2019. Forty-three states (and Puerto Rico) considered more than 300 proposed changes to privacy and cybersecurity laws in 2019, ultimately enacting 31 statutes. Although they cannot all be described in detail in this post, most have at least one of the following aims:

• requiring government agencies or businesses to implement training or specific types of security policies and practices;
• creating task forces or commissions;
• restructuring government for improved security;
• studying the use of blockchain for cybersecurity;
• providing for the security of utilities and critical infrastructure;
• exempting cybersecurity operations information from public records laws;
• addressing the security of connected devices (the Internet of Things);
• regulating cybersecurity within the insurance industry;
• providing funding for improved security measures; and
• cybersecurity threats to elections.1

One state law, of course, stands out from among all others. Throughout 2019, the California Consumer Privacy Act (CCPA) dominated the headlines (as well as the thoughts, dreams and nightmares of privacy and data security lawyers). The CCPA is driving a fundamental shift in the way we think about data protection in the United States, forcing companies to carefully contemplate the personal data they collect, hold, use, and share. Though it lacks the aggressive extraterritorial reach of Europe’s General Data Protection Regulation, the CCPA will apply to many companies throughout the United States and around the world, including many North Carolina-based businesses. Though enacted in 2018, the CCPA was amended, and proposed regulations were released, in late 2019; and with a January 1, 2020 effective date, most practitioners were intensely focused on the CCPA throughout 2019.

Even as 2020 arrives, companies are still wrestling with many patent and latent ambiguities in the CCPA and its proposed regulations. In fact, many have argued that the California Attorney General’s proposed regulations added to the ambiguities rather than reducing them. The regulations are expected to become final very soon, and the Attorney General stated publicly, that the final regs are not expected to differ substantially from the proposed regs—in other words, the final regulations are unlikely to offer new answers.

Because the California Attorney General’s proposed regulations were released so late, and were not made official by the statutory effective date of January 1, the Attorney General is delaying enforcement of the regulations by six months—until July 1. However, his office intends to take action on violations of the statute that occur between January 1 and July 1, and plaintiffs could bring claims under CCPA beginning January 1. Accordingly, most companies would prefer to achieve compliance sooner rather than later. That may be easier said than done. Even companies that have been actively pursuing compliance since 2018 were forced to pivot due to the various amendments passed in September 2019 (and the failure of some amendments to pass) and the new requirements imposed by the proposed regulations released in October 2019, putting them far behind schedule. According to a survey conducted by the International Association of Privacy Professionals in April 2019, one-quarter of companies were targeting compliance by July 1 (the enforcement date), rather than January 1 (the effective date); in a subsequent survey this summer, the number had grown to one-third. My suspicion is that a majority of companies subject to the CCPA are now targeting a July 1 compliance date, in light of the many new and different requirements and uncertainties arising from the amendments and regulations.

As dramatic as 2019 has been for privacy and data security law, 2020 may be even more eventful. We can be fairly certain that plaintiffs will bring actions under CCPA and other laws; the Federal Trade Commission, state Attorneys General, and other domestic authorities will bring enforcement actions; states and municipalities will continue to enact divergent data protection laws, further complicating the domestic legal landscape; and foreign nations will continue to adopt data protection laws, largely drawing upon common principles found in the GDPR and its predecessors. On top of all of this, the creator of the CCPA, Alastair Mactaggart, is already advancing a so-called “CCPA 2.0” to tighten the requirements and strengthen enforcement. It is an exciting (and sometimes frightening) time to be a privacy and data security lawyer. I look forward to navigating these uncharted waters along with you in 2020! 

[This blog post is re-posted from the North Carolina Bar Association.]

 

Proposed Regulations Implementing the California Consumer Privacy Act

California's Attorney General released proposed regulations implementing the California Consumer Privacy Act yesterday (10/10), and at first glance, I'm disappointed.  I'm still digesting them, and will probably post more later, but you can read them for yourself here.  The AG's press release is here.  The AG's "Fact Sheet" is here.

The draft regulations are out for public comment until December 6. Make your voice heard! The Attorney General will consider  comments and may revise the regulations in response. Any revision will trigger an additional 15 day public comment period.  Following the comment period(s), the AG will submit the final text to the Office of Administrative Law, which has 30 business days to review the regulations before they will go into effect.  In other words, the regulations will not be final before the January 1 compliance deadline. 

Although the AG will not begin enforcing the regulations until July 7, 2020, I predict the plaintiffs' bar will be initiating actions soon after January 1. 

Will the "Washington Privacy Act" be the aftershock to the CCPA's seismic shift?

California has been getting most of the attention lately for the California Consumer Privacy Act, but Washington may be following closely behind with its own bold new privacy statute.  Senate Bill 5376 has been approved by the state's Senate and is currently before the House (in the Environment, Energy & Technology Committee as of the date of this post).  The current version can be viewed here. 

"Washingtonians cherish privacy as an element of their individual freedom..." the bill begins (somewhat awkwardly), and takes off from there.  Briefly, here are some highlights:

• Jurisdiction resembles the CCPA. It applies to entities that conduct business in Washington or intentionally target residents if they (a) processes personal data of 100,000 consumers; or(b) derives over fifty percent of gross revenue from the sale of personal data and process personal data of 25,000 consumers.
• The controller/processor paradigm is clearly set out, reflecting the influence of HIPAA and international laws.  Controllers and processors share liability under a "comparative fault" framework.
• Access, correction, and deletion rights are all specifically conferred (not unlike CCPA and GDPR).  These are each subject to "verification" of the request.  
• Consumers have a right to information regarding a controller's sharing of their data (by category) with processors, and processors must cooperate with controllers to fulfill opt-out, correction, and deletion requests from consumers. 
• Consumers are given the specific right to opt out of "targeted advertising" by controllers, and third-party processors must honor the request.
• Consumer requests should be fulfilled within 30 days, but the timeline can be extended by 60 days if necessary. 
• Risk assessments (similar to privacy impact assessments) are mandated for all new processing of personal information or material changes.  This is not limited to processing of sensitive data.  If the risks are substantial, consumer consent is required.  The AG may inspect risk assessments, but otherwise they are confidential.
• There are healthcare carve-outs; it doesn't appear to be intended to overlap with HIPAA.
• The use of facial recognition (a) for decision-making with "significant effects" or (b) by the government is specifically restricted.
• There is no private right of action created by the statute.
• The AG will enforce the statute, but there is a 30 day cure period. 
• An "office of privacy and data protection" is created, and (all of) the civil penalties extracted from violators by the AG will be used to fund it.

The statute would become effective July 1, 2021.  Stay tuned!

The Year In Review: a Privacy and Data Security Law Update

The pace of change in privacy and data security law continues at grow, and even though this is one of the most rapidly-developing areas of law, the law simply cannot keep up with the speed of technology and business. 

Today, I delivered a continuing legal education presentation on behalf of the North Carolina Bar Association summarizing the changes in privacy and data security law over the past year, along with Elizabeth Johnson.

This post contains a brief outline of the items we described, and it might serve as a helpful checklist for those of you who are taking a moment near the end of the year to look back to ensure you have kept up with the many, many developments:

North Carolina Law Update

• NC narrowly avoided the shortest breach reporting timeframe in US 
• Amendment to Revenge Porn statute (Session Law 2017-93) 
• NC DHHS ordered to develop telemedicine policy including data security standards. (Session Law 2017-133) 
• Transfer of data to CIO conditioned on adequate data security protocols. (2018 appropriations bill; Session Law 2017-204) 
• Secretary of Revenue ordered to establish information security program for tax information. (Session Law 2018-5)
• NC Bank Commission records receive enhanced privacy protection. (Session Law 2017-165.) 
• Privacy and data security training mandated for opioid diversion investigators and supervisors. (SL 2018-44.)

Other States’ Data Breach Laws

• Alabama and South Dakota become 49th and 50th states to enact data breach notification statutes in 2018
• Reminder of interplay between state, federal, local, and international data breach laws, as well as private requirements (contracts and PCI rules)

Trends in State Data Breach Law

• Substantial majority of laws amended/enacted in 2018 added reporting deadline
• Slight majority of laws amended/enacted in 2018 added regulator reporting requirement
• Substantial majority of laws amended/enacted in 2018 expanded coverage of personal information

New Breach Notification Timelines

• 30 days: Colorado
• 45 days: Alabama, Arizona, Maryland, Oregon
• 60 days: Delaware, Louisiana, South Dakota,

New Law: Healthcare or Health Insurance Data

• States’ data breach laws that cover healthcare data

New law: Login Credentials

• States that Cover Login Credentials

New law: Biometric Data

• States that Cover Biometric Data
• Specific requirements of Illinois, Texas, Washington: notice, consent, disclosure limitation, retention limitation
• Illinois’ BIPA private right of action (multiple class actions against employers)

Expanding data covered by breach laws

• Arizona (passport number; TIN; private, unique key used to authenticate/sign electronic record)
• Delaware (passport number; TIN)
• Maryland (passport number; TIN)
• Oregon (any data that could be used to access financial account)
• Virginia (for tax preparers, income tax information such as deductions and exceptions)
• Ohio safe harbor for post-breach action
• Colorado data protection requirements and vendor oversight
• New Hampshire constitutional amendment
• Iowa and Nebraska data security laws for EdTech
• Credit freeze changes in Kentucky, Massachusetts, Minnesota, Oregon, Louisiana
• California website privacy class actions proliferating

The California Consumer Privacy Act

• History
• Requirements
• Ambiguities
• Enforcement and Penalties

EU General Data Protection Regulation (GDPR)

• Quick recap of GDPR
• Max penalty is €20mm or 4% of global turnover
• Scope of application
• What have we learned since 25 May 2018?
• Extraterritorial jurisdiction
• Early enforcement
• Contract battles
• Data mapping pains
• Privacy Shield update

HIPAA Update

• No major rule developments
• Steady flow of guidance documents
• Cyber newsletters
• Family access to PHI
• Emergencies and business continuity
• Enforcement continues at steady pace
• Cases, settlements and penalties
• Requests for information
• OCR Priorities

Hot Topics and Miscellaneous Developments

• Trends in breaches/causes/losses: Identity Theft Resources Center, IBM Ponemon Institute reports
• Lessons from the Uber Breach
• FTC Update
• Social Media – third party sharing (Cambridge Analytica), Facebook breach
• Minors
• Internet of Things
• Equifax (one year later)
• New NIST privacy framework
• US v. Microsoft (Stored Communications Act)
• CLOUD Act
• GLBA (Regulation P) amendments from CFPB
• Data broker issues (Vermont)
• Cyberinsurance issues
• International developments:

• China
• Canada, Alberta
• Australia
• New Zealand
• Brazil
• Argentina
• Chile
• India
• Kenya
• Hungary
• Vietnam