Weaponization of Data Subject Access Requests in the EU

By Yann Padova, Cédric Burton, Laura De Boel and Laura Brodahl on November 28, 2023 Posted in Privacy

Individuals are increasingly making use of their right to access their personal data under applicable privacy laws in the EU.

It can be a challenge for companies to handle such requests, and in particular, if a request concerns a complex data set, there are a high number of requests, or the right is exercised for strategic reasons, such as in HR or legal disputes. The right of access is, however, not absolute, and its restrictions vary across Member States, adding further complexity to the matter. How to handle such requests and apply these restrictions is commonly set out in internal policies and procedures. We set out below the current landscape as well as a recent enforcement trend.

10 Things You Should Know About the EU Artificial Intelligence Act

By Rossana Fol, Karol Piwonski, Roberto Yunquera Sehwani, Nikolaos Theodorakis, Laura De Boel, Yann Padova and Cédric Burton on November 16, 2023 Posted in European Union, Privacy

The Artificial Intelligence Act (AI Act) is the first comprehensive legislation that intends to regulate AI horizontally across all sectors in Europe. It will have far reaching consequences on all companies developing, implementing, or using AI solutions in the EU and beyond. These FAQs provide key information you should know before the AI Act is adopted, and some tips on what you can already be doing to prepare. To learn more, please see Wilson Sonsini’s FAQs below.

FTC Amends Safeguard Rule with Requirement for Non-Banking Financial Institutions to Report Data Security Breaches

By Madeline Cimino, Maneesha Mithal, Demian Ahn and Libby Weingarten on November 6, 2023 Posted in Privacy

On October 27, 2023, the Federal Trade Commission (FTC) announced it is amending the Safeguards Rule of the Gramm-Leach-Bliley Act (GLBA) to include a requirement for non-bank financial institutions to report certain data breaches and other security events to the agency.

New Proposed Rules Published for Cyber Incident Reporting and Cybersecurity Requirements Will Have Major Impacts on Federal Contractors

By Mark Bass, Seth Cowell, Demian Ahn, Timothy Kobes and Madeline Cimino on October 30, 2023 Posted in Cybersecurity, Privacy

Reflective of the Government’s increasing focus on cybersecurity, on October 3, 2023, the Federal Acquisition Regulation Council (FAR Council) released two new proposed rules that will have major impacts on federal contractors. These rules implement the May 2021 Executive Order on Improving the Nation’s Cybersecurity.¹ One rule applies to any federal contractor that uses information and communications technology (ICT) systems in the performance of a federal contract, sets forth cybersecurity incident reporting requirements, and imposes a software bill of materials (SBOM) requirement. The other rule, which applies only to those federal contractors that provide or maintain a Federal Information System (FIS), is intended to standardize cybersecurity requirements for unclassified FISs.

Coalition of States Sues Meta for Alleged Harms to Children and Teens, and Alleged COPPA Violations

By Libby Weingarten, Maneesha Mithal, Brett Weinstein and Dan Chase on October 27, 2023 Posted in Privacy

On October 24, 2023, a bipartisan coalition of 33 states’ attorneys general filed suit against Meta Platforms, Inc., alleging in a lengthy complaint that Meta’s social media platform features are unsafe and designed to induce young users’ compulsive and extended use.^[1] According to the complaint, which is currently heavily redacted, Meta engaged in a four-part “scheme” to exploit young users for profit. The alleged scheme involved the following:

California Enacts One-Stop Mechanism for Data Broker Deletion Requests

By Tracy Shapiro, Edward Holman and Doo Lee on October 25, 2023 Posted in Privacy

California residents may soon be able to click “backspace” on data brokers doing business in the state. On October 10, 2023, California Governor Gavin Newsom signed Senate Bill 362, colloquially known as the Delete Act, into law. The statute amends the state’s existing data broker registration law and builds on the state’s primary privacy law, the California Consumer Privacy Act (CCPA), by adding to residents’ ability to exercise their personal information deletion rights. Most notably, the law establishes a one-stop mechanism where state residents will be able to request—in one verifiable request—that all data brokers delete their personal information.