A sense of déjà vu descended over the international data transfer landscape on July 16, 2020. In a landmark ruling, the Court of Justice of the European Union (CJEU) announced that Privacy Shield, one of the main mechanisms used by companies to transfer personal data from the EU to the United States, is invalid.
To read the full text of this Duane Morris Alert, please visit the firm website.
As countries grapple with the global threat of COVID-19, some are leveraging user location data and tracking apps to model potential contamination paths. China has tapped into its facial recognition tools to track the virus and has deployed drones that tell people to wear masks. Singapore has launched an app called TraceTogether which uses Bluetooth to determine who could be at risk of infection. And the United Kingdom is reportedly in talks with telecom providers on how to best use location data to stem the crisis.
But the coronavirus turning the world upside down does not mean companies can throw out the General Data Protection Regulation and the California Consumer Privacy Act, as well as other privacy protections.
To read an excerpt from this article, which quotes Duane Morris partner Sandra Jeskie, please visit the firm website.
Frustrated by privacy lapses by US companies, Democrat Senator Ron Wyden of Oregon has introduced proposed federal legislation referred to as the Mind Your Own Business Act (the Act). If enacted, this law could put serious teeth into efforts to protect consumer data.
Indeed, the Act could cause certain executives to find themselves in prison for as many as twenty years if their companies are found to have lied to legal authorities about improper use of consumers’ personal information. On top of that, the Act could lead to such companies incurring special tax penalties corresponding to executives’ salaries.
If this were not enough, the Act would empower the Federal Trade Commission with the ability to fine companies for violating this law up to four percent of corporate annual revenues. For some companies, this could amount to fines in the billions of dollars. Continue reading “Oregon Senator Proposes Robust Federal Privacy Legislation”
By Angelica A. Zabanal
When the California Consumer Privacy Act (“CCPA”) was passed last year, it was generally acknowledged that the CCPA would need to be clarified prior to its January 1, 2020, implementation. A variety of CCPA amendments are now one step closer to full passage.
Last month, the California Senate Judiciary Committee passed seven amendment bills to the California Consumer Privacy Act (“CCPA”). The bills are now headed to the Committee on Appropriations for a vote. Any bills amended by the Senate will need to return to the Assembly for a vote and a possible reconciliation. Lawmakers have until September 13, 2019 to vote on these CCPA amendments, which are summarized in their current form below:
Stay tuned for more updates from Duane Morris LLP regarding the advancement of these CCPA amendments and join us for our CCPA webinar series.
Duane Morris partner Sandra Jeskie was quoted in Legaltech News in an article titled “Amazon Risks Legal Gray Area by Indefinitely Holding Alexa Recordings.” Sandra discussed privacy policies and data retention with the Alexa device.
Please visit Legaltech News to read the full text (subscription required).
Are the robots going to take over the world?! There is no question that artificial intelligence is finding its way into our everyday lives. Some people love interacting with Alexa as part of their daily activities. Others worry about the loss of autonomy and privacy that accompanies the burgeoning AI world, and some dread that someday humans may become secondary to the artificial intelligence we have created. The AI train already is leaving the station, and before it gets too far down the tracks, what is the federal government doing in terms of potential regulation?
In a time of deep partisan divide in which Republicans and Democrats in Congress disagree on practically everything, a bipartisan group of legislators has reintroduced a bill to accelerate the adoption of artificial intelligence in the federal government. Continue reading “The Federal Government Seeks to Get Hip to Artificial Intelligence”
Privacy is like oxygen. It generally is not noticed by a consumer until it is gone. California lawmakers, however, are quite aware of privacy and have recently passed perhaps the most strict privacy law in the United States.
Only days ago, the California Consumer Privacy Act of 2018 (“the Act”) was signed into law by Governor Jerry Brown after it had been approved on a unanimous basis by the California State Assembly and the California Senate. The Act does not become operative until 2020, but when it goes it to effect, it will pack a punch. Indeed, the Act will provide great control to consumers with respect to their own personal data. Continue reading “New California Law Seeks to Lead the U.S. in Online Privacy Protection”
A scholarly law review article talks about the right to privacy in the face of new technology encroachments and speaks of “the right to be let alone.” When was this article written? This year? Last year? No, in 1890, and think of all the technological advancements that jeopardize the right to privacy since then!
The article by Samuel Warren and Louis Brandeis (who later became a renowned U.S. Supreme Court Justice) was titled “The Right to Privacy,” 4 Harvard Law Rev. 193 (1890). It was published in the wake of the development of the portable camera. Obviously, with movable cameras, people could be captured on film doing all sorts of things as never before. This raised a panoply of privacy concerns and heightened the need for the development of laws to address those issues. Continue reading “Vanishing Privacy and the Right to Be Let Alone”
You might like to think that you can move about in the world without being noticed. Perhaps you relish the idea of being able to disappear into a crowd while not being recognized. But such notions of anonymity are disappearing.
Of course, you probably have heard about GPS tracking that can be used to determine the specific geographic whereabouts of a person. And now facial recognition can be used to pinpoint the identity of a person in a crowd or frankly at any location where the technology is implemented. Continue reading “Facial Recognition – You Can Run, but You Cannot Hide”
Since the Supreme Court’s decision in Spokeo v. Robins, courts have begun to ratchet back prior decisions on the minimum standard to plead an injury sufficient to establish Article III standing. The recent Eighth Circuit opinion in Braitberg v. Charter Communications adds to the growing number of cases defendants will rely upon to get data breach cases dismissed at the pleadings stage. Braitberg addressed standing in the context of the retention, use, and protection of personally identifiable information. Although the case did not involve a data breach, its holding is however instructive when defending against such cases.
In Braitberg, plaintiff alleged that he was required to provide personally identifiable information to purchase cable services and that the cable provider improperly retained his information long after he cancelled the services in violation of the Cable Communications Policy Act (“CCPA”).
Prior to Spokeo, such claims would have been sufficient to establish Article III standing because the Eighth Circuit permitted the actual injury requirement to be satisfied solely by pleading that there was an invasion of a legal right that Congress created. The Supreme Court in Spokeo held that Article III standing requires a “concrete injury” even in the context of a statutory violation.
With the benefit of Spokeo’s guidance, the Eighth Circuit acknowledged that Spokeo superseded its prior precedent. Accordingly, the panel affirmed the district court’s dismissal of the complaint for lack of Article III standing and failure to state a claim. In doing so, the panel rejected arguments that CCPA created standing to sue where the defendant merely retained the data in violation of the statute with no other injury. It further rejected an economic argument that retention of the data deprived plaintiff of the full value of the services received from the company.
This decision is important for two reasons. First, the Eighth Circuit further narrowed the scope of allegations that will give rise to Article III standing in a post-Spokeo world. Second, in denying the economic argument, the court cut off an alternative avenue by which plaintiffs have successfully alleged harm.
