InfoTrax Systems, a Utah-based technology company, has agreed to implement a comprehensive data security program to settle Federal Trade Commission allegations that the company failed to put in place reasonable security safeguards, which allowed a hacker to access the personal information of a million consumers.  InfoTrax Systems, L.C., provides back-end operation services to multi-level marketers. This includes such services as compensation, inventory, orders, accounting, training,… More

The Boston Bar Journal has published an article of mine on written information security policies, or WISPs, which are required in certain jurisdictions (such as Massachusetts) and are becoming increasingly important privacy and security tools for companies.  You can read the article here.

The passage of the California Consumer Privacy Act (CCPA) was a seismic event in U.S. data privacy law. CCPA has an expansive, rights-based approach to privacy, with national and international ramifications.

Foley Hoag attorneys Colin Zick, Chris Hart, Yoni Bard and Scott Bloomberg present a second podcast discussing the latest developments with the CCPA. Click here to listen to part one.

October brought three new developments to California’s comprehensive data privacy law, the California Consumer Privacy Act (“CCPA” or “Act”).  First, the state enacted a series of amendments to the CCPA that both clarify ambiguities and create new exceptions.    Second, we learned that the organization whose 2018 ballot initiative pushed California to enact the CCPA is planning to introduce another data privacy ballot initiative in 2020.  Finally, California’s Attorney General published draft regulations for notice and comment.… More

Partner Colin Zick recently spoke at the MaHIMA Dot Wagg Memorial Legislative Seminar on HIPAA updates. Click here to download the slides. Topics included: HIPAA FAQs on right of access, CMS interoperability and the patient access proposed rule, HIPAA enforcement trends, the proposed AKS safe harbors, and more. More

On 26 July 2019, the Greek Supervisory Authority (SA) found Pricewaterhouse Coopers (“PwC”) not compliant with General Data Protection Regulation (GDPR) in relation to the processing of its Greek employees’ personal data. The SA issued a €150,000 fine and an injunction requiring PwC to take measures to comply within three months (which is has apparently done). A summary of the decision in English is available on the Greek SA’s website.… More

As data breaches are seemingly reported on a daily basis, cybersecurity has emerged as a top enforcement priority for federal and state regulators and a key concern for companies of all sizes in a diverse range of industries. For example, compliance with federal cybersecurity regulations is required by nearly every government contract and the New York Division of Financial Services adopted a vast set of regulations that is applicable to all entities operating under NYDFS licensure. In short, ensuring that a company has effective cybersecurity policies and procedures in place is essential to both protecting customer information and avoiding unwanted attention from federal and state regulators.

Foley Hoag presents a webinar offering guidance for in-house counsel, compliance officers and other professionals on the cybersecurity regulatory and enforcement landscape.

Speakers

• Christopher Hart, Counsel, Privacy & Data Security and Litigation Practices
• Michael Licker, Partner, White Collar Crime & Government Investigations and Litigation Practices
• Rachel Hutchinson, Associate, Privacy & Data Security and Litigation Practices

On October 1, 2019, China’s new regulation to protect personal data related to children – called the “Measures on Online Protection of Children’s Personal Data” – went into effect.

As we wrote in June, when a draft of the regulation was released by the Cyberspace Administration of China, the regulation contains elements similar to those found in both the United States’ Children’s Online Privacy Protection Act (“COPPA”) and the European Union’s General Data Protection Regulation (“GDPR”).… More

A recent report from the Mass Digital Health Council includes a cybersecurity toolkit created by MDHC’s Cybersecurity Group of Experts (CGE). The toolkit will enable faster clinical adoption of new digital health products, software and solutions by enhancing access to security needs and requirements and will address:

• Cybersecurity needs for digital health companies
• Medical device and software solutions
• Best practices
• Available state and national resources and tools

This toolkit should enable healthcare organizations to share experiences and guidance with each other,… More

Attorneys Colin Zick and Chris Hart recently led a Q&A discussion for MassTLC members on new trends in data privacy. Click here to download the slides. Topics included: recent GDPR enforcement actions, the California Consumer Privacy Act, recent changes to the Massachusetts data breach statute and more. More