California Attorney General Mandates CCPA-Covered Businesses Honor the Global Privacy Control and Announces Update on CCPA Enforcement Activity

By Edward Holman and Tracy Shapiro on July 26, 2021 Posted in Privacy

Recently, the Office of the Attorney General of California announced three major updates that 1) added to the California Consumer Privacy Act’s (CCPA) opt-out rules related to the sale of personal information, 2) made it easier for consumers to participate in enforcing the CCPA, and 3) unveiled other focus areas of CCPA enforcement activities. Continue Reading

No Harm, No Foul: Supreme Court Narrows Article III Standing to Require That All Class Members Suffer a Concrete Injury in Fact

By Allison Bender and Edward Holman on July 15, 2021 Posted in Privacy

Overview

On June 25, 2021, the U.S. Supreme Court decided TransUnion v. Ramirez, which held that even when a statute has been violated, and that statute provided a private right of action, plaintiffs still need a concrete injury in fact to have standing to bring a lawsuit in federal court. In this case, the statutory framework at issue is the Fair Credit Reporting Act (FCRA). Though this case arises in the context of the FCRA, its outcome is likely to have a sweeping impact on many areas of class action litigation where the concreteness of injury is at issue, such as data breach litigation. Continue Reading

Colorado Becomes Third State to Pass New General Privacy Law

By Edward Holman and Amanda Irwin on July 1, 2021 Posted in Uncategorized

Colorado may soon enter the national stage for its new privacy legislation. On June 8, 2021, Colorado’s legislature passed the Colorado Privacy Act (SB21-190) (ColoPA). The bill was recently sent to the Colorado governor’s desk, where he will have until July 8 to sign or veto the bill, otherwise it will become law without his signature. If Governor Jared Polis signs the bill or does not act on it (and assuming the act is not put to a referendum), Colorado will become the third U.S. state to enact comprehensive privacy legislation, after California and Virginia. Continue Reading

EU Commission Publishes Template Data Processing Agreement

By Laura Brodahl, Laura De Boel, Jan Dhont, Christopher Foo, Joanna Juzak and Nikolaos Theodorakis on June 18, 2021 Posted in Privacy, Regulatory, Uncategorized

On June 4, 2021, the European Commission published its long awaited new set of Standard Contractual Clauses for outsourced data processing (DPA SCCs). These DPA SCCs are a contract template that organizations can use to comply with the General Data Protection Regulation’s (GDPR) rules on outsourced data processing. Continue Reading

A New Data Transfer Mechanism Is Available for EU Personal Data

By Jan Dhont, Laura Brodahl, Laura De Boel, Cédric Burton, Sam Meijer, Carol Evrard and Joanna Juzak on June 4, 2021 Posted in Uncategorized

New Set of SCCs for Data Transfers to Third Countries

On June 4, 2021, the European Commission (EC) published its long awaited new set of Standard Contractual Clauses (New SCCs). This new data transfer mechanism allows for the transfers of personal data outside of the European Economic Area (EEA) and replaces the current Standard Contractual Clauses (current SCCs). The New SCCs take into account the European Court of Justice’s (CJEU) Schrems II ruling, which invalidated the EU-U.S. Privacy Shield and requires that data exporters and importers take measures to ensure that the SCCs are effectively complied with. Continue Reading