Court Orders Production of a Data Breach Forensic Report, Rejecting Arguments That Attorney-Client Privilege and Work Product Protection Apply

By Beth George, Allison Bender and Megan Kayo on January 19, 2021 Posted in Cybersecurity, Privacy

On January 12, 2021, the District Court of the District of Columbia was the latest court to grant a motion to compel production of a forensic report prepared by an external security-consulting firm in data breach litigation.¹ This case involved a cyberattack on a law firm that led to the public dissemination of the confidential information of the plaintiff, who was a former client of the firm. The plaintiff moved to compel his former law firm to produce “all reports of its forensic investigation into the cyberattack.”² The defendant asserted that it had produced all relevant materials, including materials related to a second-track investigation conducted by its usual cybersecurity vendor, eSentire, for business continuity purposes. However, the plaintiff also sought a report prepared by Duff & Phelps, who was retained by the defendant’s outside litigation counsel. The defendant argued the Duff & Phelps report was protected by the work-product and attorney-client privileges. The court rejected the defendant’s arguments and ordered production of the Duff & Phelps report and associated materials. Continue Reading

U.S. Supreme Court May End Key FTC Consumer Protection Enforcement Practice

By Christopher Olsen, Lydia Parnes and Stephen Schultze on January 14, 2021 Posted in Privacy

Justices Considered Whether Certain Court-Imposed Monetary Remedies Are Legal

On Wednesday, January 13, 2021, the U.S. Supreme Court heard arguments in the much-anticipated case of AMG v. FTC, which challenges the Federal Trade Commission’s (FTC’s) authority to obtain monetary relief in court under Section 13(b) of the FTC Act. The Court’s decision is likely to have a significant impact on the relief the FTC is able to obtain in federal court proceedings. Continue Reading

European Commission Proposes New Rules for Digital Platforms

By Cédric Burton, Jan Dhont, Gorka Navea, Nikolaos Theodorakis, Roberto Yunquera Sehwani, Deirdre Carroll, Carol Evrard, Thomas Martin Pflock and Maximin Orsero on January 13, 2021 Posted in Cybersecurity, European Union, Privacy, Regulatory

On December 15, 2020, the European Commission (EC) unveiled a set of proposals to regulate digital platforms. The draft laws include antitrust-related requirements, addressed by the Digital Markets Act (DMA) and more general regulatory requirements, addressed in the Digital Services Act (DSA). The DMA/DSA package will apply to all digital services, including social media, online marketplaces, and other online platforms, meaning tech companies active in Europe will have a new set of rules to follow. Continue Reading

The Privacy Impact of the New Brexit Deal

By Jan Dhont, Christopher Olsen, Christopher Foo and Lore Leitner on December 30, 2020 Posted in European Union, Privacy, Regulatory

On December 24, 2020, the European Commission (EC) and UK government announced the long-awaited EU-UK Trade and Cooperation Agreement (the Brexit Agreement), which sets out the future relations between the EU and the UK. If approved, the Brexit Agreement will become effective on January 1, 2021, and will have the following repercussions: Continue Reading

Apple Requires Apps to Include New Privacy “Nutrition Label” by December 8, Delays Opt-In for Tracking Requirement Until Early 2021

By Tracy Shapiro, Edward Holman and Stephen Schultze on December 15, 2020 Posted in Cybersecurity, Privacy

Apple recently announced that app developers must check a series of yes/no boxes that will generate a “nutrition label”-style summary of the app’s privacy practices. This new summary, formally called “App Privacy,” will be shown to users within the App Store before they install an app. This is the latest move in Apple’s ongoing effort to make privacy practices more transparent, and it requires app developers to take action now to ensure they can continue to update their apps after December 8, 2020. If developers take no action, their apps will essentially be frozen as they exist on that date. Continue Reading

U.S. Supreme Court Hears Argument over Frequently Litigated Provision of the TCPA

By Tonia Klausner and Brian Levy on December 15, 2020 Posted in Litigation, Privacy, Regulatory

On December 8, 2020, the Supreme Court heard argument in Facebook, Inc. v. Duguid,¹ a case addressing a split among federal circuit courts as to what constitutes an “automatic telephone dialing system”—often referred to as an “autodialer”—under the Telephone Consumer Protection Act (TCPA).² The Court’s decision could significantly reduce the risk of TCPA litigation directed at online platforms and apps with text messaging functionality.