Privacy & Cybersecurity

Check out our comprehensive 2024 State Data Privacy Law Round-Up for the latest US State laws in data privacy. While consumer data privacy laws are still relatively new, we are beginning to see evidence of enforcement in some states and far greater attention and resource expenditure internally from businesses working hard to determine which laws apply to their organizations and what steps are necessary to ensure compliance. 

On April 4, 2024, Kentucky Governor Andy Beshear (D) signed the Kentucky Consumer Data Protection Act (“KCDPA”) into law, with a slow roll to the date it takes effect on January 1, 2026. The KCDPA goes a bit easier on businesses and (1) does not impose a requirement to provide a universal opt-out mechanism, and (2) has a permanent cure provision that will afford violators ongoing opportunities to rectify alleged violations of the law. Learn more about the Kentucky Consumer Data Protection Act.

Last fall at the Safeguarding Health Information: Building Assurance Through HIPAA Security 2024 conference, U.S. Department of Health & Human Services Office for Civil Rights (OCR) promised that before year’s end, it would publish amendments to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. On December 27, 2024, OCR made good on that promise and released an unpublished version of the Security Rule amendments proposal.

Minnesota Governor Tim Walz (D) signed into law the Minnesota Consumer Data Privacy Act, which will take effect on July 31, 2025. Learn more about the Minnesota Consumer Data Privacy Act.

Everything you need to know about the Delaware Personal Data Privacy Act as it becomes effective on January 1, 2025. Here's what impacted companies need to gear up and prepare for.

The Nebraska Data Privacy Act (or NEDPA) becomes effective on January 1, 2025.  This relatively short period between signature and effective date left little time for impacted companies to prepare; however, Nebraska’s approach to applicability criteria has cast a specifically tailored net focused on businesses selling personal data of Nebraska residents.

Iowa's consumer privacy law is taking effect soon. Learn more about the Iowa Consumer Data Protection Act or “IACDPA” which becomes effective on January 1, 2025.

Learn about the Oregon Consumer Privacy Law which took effect in July of 2024.

Dark Patterns come into focus as the California Privacy Protection Agency (CPPA) issues September 4 Enforcement Advisory.

In June, the U.S. Court of Appeals for the Ninth Circuit affirmed a social media company’s summary judgment win on BIPA claims, in a sophisticated ruling providing a plausible path forward for technology companies and others offering facial matching services.

The RIDTPPA provides privacy rights to Rhode Islanders and imposes obligations on covered entities largely in line with several other U.S. state privacy laws.

The push by U.S. states to pass data privacy laws continues with Maryland being the 18^th state to join their ranks. However, Maryland has taken a more stringent and comprehensive approach than many of its peers

As U.S. states continue to pass data privacy legislation, Maryland has gone above and beyond in signing both the Maryland Online Data Privacy Act of 2024 (MODPA) and the Maryland Age Appropriate Design Code (HB 603/SB 5712023) into law on May 9, 2024. The Kids Code will go into effect in October and the MODPA will go into effect one year thereafter.

Earlier this week, the Biden-Harris Administration, through the Office for Civil Rights (OCR) announced a Final Rule aimed at protecting protected health information (PHI) related to lawfully provided reproductive health care services.  As we discussed last year, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy was proposed in response to concerns about the confidentiality of PHI related to reproductive health care following the decision in Dobbs v. Jackson Women’s Health Organization.  In the executive summary of the Final Rule, OCR emphasized that the changing post-Dobbs legal landscape “increases the likelihood that an individual’s PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect, including the trust of individuals in health care providers and the health care system.”  The Final Rule defines “reproductive health care” as “health care…that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.” 

Will the U.S. finally join most developed nations and pass a comprehensive federal privacy law?  Some believe this may be the year that the U.S. does just that.

This post provides the details and information you and your business need to know about the New Jersey Privacy Act (NJPA), signed into law by Governor Phil Murphy. 

As promised in the U.S. Department of Health and Human Services (HHS) concept paper in December 2023, the agency published voluntary health care and public health cybersecurity performance goals (HPH CPGs) in January 2024 and then proposed in the HHS FY 2025 Budget to establish certain HPH CPG compliance incentives and penalties for hospitals.

After years of internal discussion, the Board of the California Privacy Protection Agency (CPPA), at their March 8th meeting, voted to progress toward formalizing the proposed regulations on risk assessments and automated decisionmaking technology (ADMT). 

If you have been relying on last year’s court order staying the ability of the California Privacy Protection Agency (CPPA) to enforce regulations promulgated under the California Privacy Rights Act (CPRA) to also stay your own CPRA compliance program --- time to ramp back up.

Consumer privacy protection must have been tops on the New Jersey legislature’s list of New Year’s resolutions. The year was just two weeks old and New Jersey became the first State in 2024 to enact a comprehensive privacy law and is now one of over a dozen states to have its own comprehensive privacy law (together, the Privacy States”). New Jersey Governor Phil Murphy wrote in a recent press release that he is proud New Jersey is better protecting its residents with Senate Bill 332/A1971 (the “Law”). This comprehensive law aims to protect consumer privacy by creating strict requirements for how applicable companies may use and collect personal data from New Jersey consumers and provides such consumers with rights of access, modification and deletion of their personal data.