Category: Data Privacy

Data Privacy / Emerging Issues

The GDPR Question and Answer Guide

Attorneys in Goldberg Segalla’s Cybersecurity and Data Privacy, Global Insurance Services, and other practice groups have fielded countless questions from clients and colleagues curious (or concerned) about the European Union’s (EU) General Data Protection Regulation (GDPR), the landmark legislation governing data protection and privacy for all individuals within the European Union, as well as the export of all data from the EU and European Economic Area (EEA). Here, we answer the most frequently asked questions pertaining to the GDPR’s who, what, when, where, how, and… Continue Reading
Data Privacy

Fourth Circuit Weighs in on the Evolving Law of Standing in Data Breach Litigation to Hold that Misuse of Stolen Data Confers Standing

While data breach lawyers wait for the U.S. Supreme Court to more clearly define when a hack confers standing on the individual whose personally identifying information (PII) is stolen, the Circuit Courts of Appeals continue to choose sides over a useful standard. On June 12, 2018, the Fourth Circuit weighed in to hold that the individual has standing when the data is actually misused, such as when the hackers open fraudulent credit cards with the stolen PII, and the individual spends time and resources on… Continue Reading
Cyber Attacks / Cybersecurity / Data Privacy

New York Cybersecurity Regulations Extended to Credit Reporting Agencies

This week, Governor Cuomo has directed the Department of Financial Services to issue a final regulation requiring credit reporting agencies to comply with cybersecurity regulations applied to financial service companies, previously adopted in 23 NYCRR 500, et seq. The new regulation, 23 NYCRR 201, et seq., obligates credit agencies reporting on 1,000 or more New York consumers to register annually with the DFS, and, beginning November 1, 2018, to comply the previously adopted standards, including adoption of a cybersecurity program and CISO, and other controls.… Continue Reading
Data Privacy

Supreme Court Recognizes Expectation of Privacy Regarding Cellphone Location Data

On Friday, June 22, 2018, in a 5-4 split, the Supreme Court in Carpenter v. United States, held that the government usually needs a warrant to access an individual’s historical cellphone location data held by third-party carriers. The court rejected the government’s argument that an individual does not have a legitimate expectation of privacy under the Fourth Amendment concerning the location data that third-party carriers collect and keep.  This data, essentially logs of the location of cellphone towers used to route calls to and… Continue Reading
Data Privacy

Newsflash: Internet-Connected Devices Are Not Private

Last week, Amazon confirmed that it’s Alexa-powered Echo device may, in fact, listen in on private conversations, whether or not the device had been intentionally activated by a user. In this “extremely rare occurrence,” a couple’s private conversation was not only recorded, but was sent to a random number in the user’s address book without their permission. Earlier this year, users also reported “unexpected and unwarranted bursts of robotic laughter,” which many found to be extremely “creepy,” and which Amazon characterized as the… Continue Reading
Data Privacy

Data Breach Settlement Highlights Need for Proactive Management of Data Security Threats

Lincare Inc. recently agreed to settle a class action lawsuit for $875,000. The class plaintiffs consisted of employees whose personal information was compromised in 2017. The breach involved a business email compromise scam. The settlement amount is not the only cost to the company and in fact may cost less than implementing remedial measures (credit/identity monitoring) and IT reforms to prevent such an incident from happening in the future. For example, the settlement terms dictate that an additional two years of free credit and identity… Continue Reading
Cyber Breach / Data Privacy

Chili’s Carefully Announces Limited Data Breach

On May 11, 2018, Chili’s Grill & Bar learned that “some of [their] guest’s payment card information was compromised at certain Chili’s restaurants” as the result of a “data incident,” according to a press release on the company’s website. Preliminary investigations suggest malware was used to gather payment card information for purchases between March and April 2018. While such data incidents are increasingly common, Chili’s press release is notable for two reasons. Firstly, The release, presented as a letter to “valued guests,” provided… Continue Reading
Data Privacy / Emerging Issues

Nearly a 50 percent Increase in Gulf Region Cyberattacks

Gulf Business Machines (GBM) reports a significant increase – from 28 percent in 2016 to 41 percent in 2017 — in hacking events among Gulf-based enterprises. Even so, only 31 percent of regional organizations are concerned about the detection and response to these attacks. At the 2018 Gulf Information Security Expo and Conference in Dubai that took place from May 1-3, 2018, GBM issued its Seventh Annual Cybersecurity Study, which surveyed regional organizations regarding security in the business environment. The survey polled over 600 executives… Continue Reading
Data Privacy

Facebook Continues Playing the Globalist Game

Facebook once again recently taught us that it may be easier to avoid a law, than to comply with it. On April 17, 2018, Facebook confirmed that to meet its mission to comply “in spirit” with “the whole” of the European Union’s General Data Protection Regulation (GDPR) , which takes effect on May 25, 2018, Facebook is effectively moving data for approximately 1.5 million users outside the reach of the law.  By offering “new privacy experiences” complete with updated terms of service … Continue Reading
Data Privacy

Facebook Faces a Bombardment of Lawsuits Over Handling of Personal Information

Facebook is facing yet another class action lawsuit in the wake of the well-publicized Cambridge Analytica scandal. The lawsuit, filed in the Northern District of California near the company’s Menlo Park headquarters, follows close on the heels of Facebook’s admission that the personal information of a large number of its users was collected via a personality quiz app named “This is Your Digital Life” and shared with Cambridge Analytica. The app harvested the personal information of not only those who used it, but also millions… Continue Reading