On February 2, 2022, the UK privacy regulator (i.e., the Information Commissioner’s Office or the ICO) issued new model clauses to support data transfers from the UK. Subject to approval by the UK Parliament, the new model clauses will become effective March 21, 2022. Companies transferring personal data outside the UK will have until March 21, 2024 to update existing contracts, but should use the new model clauses for any new contracts they sign as of September 21, 2022.

Background
Continue Reading New Model Clauses for Personal Data Transfers Outside the UK

On February 2, 2022, the Belgian Data Protection Authority (DPA) found that the Interactive Advertising Bureau Europe (IAB) Transparency & Consent Framework (TCF), a tool used to record individuals’ online ad preferences, violates the General Data Protection Regulation (GDPR). The DPA fined IAB Europe €250,000 (approx. USD 280,000), and required IAB Europe to present an action plan to bring the TCF into compliance within two months. To reach this conclusion, the DPA concluded that:
Continue Reading Belgian DPA Finds That IAB Europe’s Cookie Consent Framework Violates the GDPR

The Colorado Attorney General’s office is poised to begin the rulemaking process for the Colorado Privacy Act (ColoPA).1 On January 28, 2022, Colorado Attorney General Phil Weiser issued prepared remarks outlining key rulemaking topics and announcing plans to seek input from Colorado consumers, businesses, and other stakeholders over the coming months. Although the ColoPA does not come into force until July 1, 2023, the Attorney General noted that his office “expect[s] to be in a position to adopt final rules around a year from now.”
Continue Reading Colorado Attorney General Announces Privacy Rulemaking

Imagine you receive an inquiry from a state Attorney General (AG) about your privacy or security practices, and you aren’t sure what to do next. Maybe it’s because you have been concentrating on compliance efforts related to the California Privacy Rights Act (CPRA) and other new state privacy laws coming into effect, and you haven’t focused as extensively on the existing suite of state privacy or security laws, or on state AG enforcement of federal privacy laws, that may in fact apply to you. In this advisory, we provide a snapshot of recent privacy and security enforcement efforts by state AGs.1 Next, we offer some general tips on how to avoid getting into trouble with state regulators. Finally, we suggest what to do if, despite your best efforts, you become the subject of an inquiry.

Recent significant state AG enforcement efforts include:
Continue Reading Privacy and Security Enforcement: State AGs Flex Their Muscles

So you’re a fintech startup, buying a fintech company, or expanding the technical capabilities of your financial business. Or you’re a tech company that is getting into the payments space. Where do you start when it comes to figuring out what consumer protection laws apply to you? You should be aware that, for the past several years, the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB) have been actively enforcing consumer protection laws in the fintech space. For example, the FTC has recently brought cases involving an online lender that allegedly charged undisclosed fees, a mobile banking app that falsely promised high interest rates and 24/7 access to funds, promoters of cryptocurrency money-making schemes, and tech platforms offering in-app purchases. The CFPB most recently shuttered a VC-backed online lender for false advertising related to interest rates and loan amounts. Earlier last year, the CFPB had obtained refunds and a civil penalty against a fintech company for enabling merchants to obtain loans for consumers without their authorization.
Continue Reading Fintech and Financial Privacy: Regulatory Developments on the Use of Financial Data

The U.S. Supreme Court’s April 2021 decision in the AMG matter significantly limited the Federal Trade Commission’s (FTC’s) ability to seek monetary redress for consumers under the FTC Act, relief the FTC had successfully obtained for over four decades. Since the Supreme Court announced its decision, the FTC has been deploying new strategies to return money to consumers harmed by unfair or deceptive practices and to otherwise deter such conduct through civil penalties. Companies should pay close attention to these strategies, as they provide a roadmap for future investigations and enforcement. These strategies include the following:
Continue Reading FTC Consumer Protection Remedies After the U.S. Supreme Court’s AMG Decision