Provides Detailed Specifications Both for Information Security Program and Third-Party Assessments
On June 12, 2019, the Federal Trade Commission (FTC) announced it had reached a proposed settlement with LightYear Dealer Technologies, LLC (doing business as “DealerBuilt”) over allegations that the automobile software provider’s inadequate data security practices had resulted in a data breach in 2016.1
This consent order deserves a close read because the FTC has imposed data security obligations on DealerBuilt that go further than any previous settlement, and the FTC is likely to seek to impose these requirements in future settlements.2 Specifically, the FTC has mandated DealerBuilt to implement an information security program with more detailed specifications than appear in earlier settlements. These modifications are consistent with the FTC’s recent proposed amendments to the Safeguards Rule (a rule that guides FTC implementation of the Gramm-Leach-Bliley Act (GLBA)).3 The FTC has also imposed more specific requirements with regards to third-party security assessments. Continue Reading
On May 29, 2019, in the midst of the legislative amendment process taking place in Sacramento for the California Consumer Privacy Act (CCPA), Nevada has passed its own CCPA-like privacy law, SB 220, taking effect on October 1, 2019, just three months before the CCPA becomes operative. The law’s main focus is to give consumers the right to opt out of the sale of certain personal information about them, though it is substantially narrower than the CCPA in many respects. Here are the key takeaways from the law:
On May 8, 2019, the Brussels Court of Appeal referred the Belgian Data Protection Authority’s (DPA) case against Facebook to the European Court of Justice (CJEU) to address jurisdictional issues regarding which DPA is competent to bring enforcement actions against Facebook. The case deals with Facebook’s collection of individuals’ data through cookies stored in Facebook’s social plugins. The Belgian DPA alleges that Facebook’s data collection is unlawful as it lacks valid consent and does not provide appropriate notice to individuals. Several courts in Belgium have already examined the issues, but it now reaches a new phase as the Brussels Court of Appeal Court referred critical questions to the CJEU dealing with the interpretation of the concept of “Lead Supervisory Authority” under the General Data Protection Regulation (GDPR). 