In Liu v. Securities & Exchange Commission,1 the Supreme Court upheld, but circumscribed, the Securities and Exchange Commission’s (SEC’s) disgorgement authority by holding 8-1 that the SEC may seek disgorgement through its equitable relief power only if the award does not exceed a wrongdoer’s net profits and is awarded to victims. Although this decision is important in its own right, the Court’s underlying reasoning also has significant ramifications on a similar question regarding the Federal Trade Commission’s (FTC’s) power to obtain equitable monetary relief under 15 U.S.C. § 53(b) (Section 13(b) of the FTC Act). Continue Reading
On June 30, 2020 the Federal Trade Commission (FTC) announced that it reached a settlement in its litigation against NTT Global Data Centers (formerly RagingWire Data Centers) over allegations that the company misled customers about its adherence to the EU-U.S. Privacy Shield framework.1 As part of the settlement, the cloud service provider is required to hire a third-party assessor to annually verify its compliance with the Privacy Shield if it chooses to participate in the framework.2 As noted by three commissioners, this order is “more protective of the Privacy Shield Principles than the 14 orders [the] Commission … has approved in prior Privacy Shield Cases.”3 Continue Reading
On June 19, 2020, the Federal Trade Commission (FTC) submitted to Congress two reports that Congress requested in connection with the spending bill that funds the FTC. One of these reports (the “Resources Report”) describes the resources used and needed by the FTC to protect consumer privacy and security, and the second (the “Authorities Report”) describes the FTC’s use of its existing authorities to protect consumer privacy and security. Continue Reading
On June 2, 2020, the California Attorney General announced that it had submitted the final proposed regulations package for the California Consumer Privacy Act (CCPA) to the California Office of Administrative Law (OAL). The OAL now has 30 working days, plus an additional 60 calendar days under COVID-19-related Executive Order N-40-20, to review the package for compliance with California’s Administrative Procedure Act (APA). If approved by the OAL, the final regulations will then be filed with the California Secretary of State and become enforceable. Continue Reading
On May 4, 2020, the European Data Protection Board (EDPB) adopted new guidelines (the guidelines) regarding the use of consent as a legal basis for processing personal data under the General Data Protection Regulation (GDPR). The guidelines update and replace the Article 29 Working Party’s April 2018 guidance on the same topic.
The guidelines remain largely unchanged from the earlier version but do provide helpful clarifications on two points: a) the validity of consent when interacting with so-called “cookie walls”; and b) “scrolling” as a means of indicating consent. Continue Reading
On April 21, 2020, the European Data Protection Board (EDPB) published two sets of guidelines addressing data processing in the context of the COVID-19 pandemic. These guidelines address the use of location data and contact tracing tools to combat the spread of COVID-19 and the use of health data for the purposes of scientific research into COVID-19 (together, the guidelines).
Since March 2020, the EDPB and the European Commission (EC) have been active in addressing the use of data to combat the COVID-19 pandemic. The EC released its recommendation regarding contact tracing apps and the use of mobility data on April 8, while the EDPB issued a letter on April 14 addressing the same issue. The EC then published specific guidance regarding the use of COVID-19 mobile apps. In these most recent guidelines, the EDBP further elaborates on the signposts provided in its earlier letter and provides specific guidance on the deployment of contact tracing apps as well as the re-use of information for scientific research purposes. Continue Reading