For the second year in a row, Washington State is considering the “Washington Privacy Act,” legislation that would regulate the collection and use of consumer data and have Washington join a chorus of states looking to legislate privacy. The bill (SB 6281) passed the Washington Senate with near-unanimous approval on February 14 and
SCOTUS: Private Entities Operating Forums for Speech Are Not State Actors
Against the background of lawsuits and debate about the role of communications service providers in moderating speech on their platforms, the U.S. Supreme Court has weighed in, affirming that private entities that host forums for speech are not state actors subject to constitutional requirements.
The Decision
In a 5-4 decision by Justice Kavanaugh, the Court held in Manhattan Community Access Corp. v. Halleck, 587 U.S. __ (2019) that a private, nonprofit corporation operating a public-access TV channel is not a state actor subject to the First Amendment. Producers of public access programming had claimed the channel was a state actor that violated their First Amendment rights after it suspended them from its services due to their films’ content. The Court disagreed.
Continue Reading
How California’s New Privacy Law Impacts Brick-and-Mortar Businesses
Businesses that market and sell to consumers are heavily focused on navigating federal and state legal issues related to advertising, privacy, promotions, products liability, government investigations, unfair competition, class actions and general consumer protection. The California Consumer Privacy Act (CCPA) has introduced a series of robust obligations for brick and mortar businesses that collect personal
I Am Robot: California’s New Law Requires Disclosure of Use of Bots
California’s new Autobot Law, Cal. Bus. & Prof. Code § 17940, et seq. (SB 1001), which goes into effect July 1, 2019, may affect businesses that use chatbots to interact with customers online. As the nation’s first autobot regulation, SB 1001 makes it unlawful “to use a bot to communicate or interact with another person
Nevada Expands Online Privacy Law to Grant Consumers Additional Rights While Excluding Certain Institutions From Compliance
Nevada is the latest state to strengthen privacy laws to address the perceived need for more oversight of how companies handle personal data. On May 29, 2019, Nevada’s governor signed into law Senate Bill 220, which amends the state’s online privacy notice statute, Nev. Rev. Stat. Ann. § 603A.300 et. seq. The amendments provide consumers with the right to restrict an entity’s “sale” of covered information while also excluding certain entities from the statute’s application. The amendments become effective October 1, 2019.
Continue Reading
New Consumer Protection Due Diligence That Your Company May Need to Perform
The Ninth Circuit recently held a company vicariously liable for the actions of a downstream vendor of text message and telephone marketing activities. Companies should consider due diligence and vendor oversight protocols as counter-measures to limit the risk of liability for digital advertising and text marketing activities. Read the full article here.
Updates to Massachusetts Data Security Requirements
New changes to the Massachusetts data breach notification statute emphasize timely and public disclosure of data security incidents, including requiring companies to disclose compliance with Massachusetts’ data security law. Among other more technical changes, H. 4806, effective April 11, increases the information that breached companies must provide to Massachusetts state agencies and provides for ways that information will be made public. Under the changes, when a breach is reported to the attorney general and the director of the Office of Consumer Affairs and Business Regulation (OCABR):
- Companies are required to disclose whether or not they have the written information security plan required by MA law;
- The OCABR is required to make consumer notices provided to it public within one day, and update the breach notification report on its website within 10 days; and
- The OCABR is required to inform consumers of their ability to file a public records request to obtain a copy of the notice provided to the AG and OCABR.
Google Defeats Biometric Privacy Lawsuit on Article III Standing Grounds
On December 29, 2018, Google won summary judgment in Rivera v. Google, a privacy class action alleging violations of the Illinois Biometric Information Privacy Act (BIPA). The case involved “face grouping,” a feature that enables Google Photos to automatically sort and group the photographs in a user’s private account based on visual similarities between
What You Need to Know Regarding The New Data Breach Notification Laws
In the first half of 2018, on the heels of the Equifax breach last fall, a number of state legislatures addressed privacy and data security issues, and in particular, data breach notification. Most notably, Alabama and South Dakota passed their first breach notification laws, making it so there now breach notification laws in all 50 states. In addition, Arizona, Louisiana, Colorado and Oregon updated their existing laws.
Both the new laws and the revisions reflect national trends over the last several years to clarify (and shorten) notification periods, broaden the scope of information that prompts notification requirements, and increase engagement with regulators. The changes add complexity, but because they are in line with changes made by other states, they should not require substantial changes to existing procedures for responding to larger incidents.
Continue Reading