Privacy & Cybersecurity

It's that taxing time of the year. Employees have received W-2 forms and the tax filing season has begun in earnest.

The latest update related to the Telephone Consumer Protection Act, the latest regulatory activities and a look at what 2017's Congressional committee changes may have in store for legislative outlook on consumer calling issues can be found here.

The Securities and Exchange Commission (SEC) is investigating whether Yahoo! should have reported the two massive data breaches it experienced earlier to investors, according to individuals with knowledge.

With Inauguration Day upon us, it's time for a #MLWashingtonCyberWatch update. President-elect Donald Trump has vocalized his support for the future of “cyber” throughout his campaign – but how will members of his cabinet act, or refuse to act, on his vision for that future?

The U.S. Federal Trade Commission (“FTC”) has filed a lawsuit against device manufacturer D-Link for allegedly deceiving the marketplace about the security of its products and, in turn, unfairly placing customer privacy at risk.

Since September, the Mintz Levin Privacy Webinar Series has focused on the upcoming EU General Data Protection Regulation to help businesses understand the reach and scope of the GDPR and prepare for the potentially game-changing privacy regulation.

It's a new year, and time for the Financial Industry Regulatory Authority (FINRA)'s annual Regulatory and Examination Priorities Letter (the "2017 Letter"). We remind regulated entities of this list of examination priorities every year, because cybersecurity appears high on the list every year.  2017 is no exception.

The New York State Department of Financial Services has announced -- much to the relief of the multitude of financial services companies and insurers regulated by DFS -- that it will revamp its recently proposed cybersecurity rule.

Google’s recent changes to its privacy policy are coming under fire from a complaint filed late last year with the Federal Trade Commission (“FTC”) that accuses the company of downplaying “transformational change” in its handling of user data. 

It's likely that 2017 will see still more data breaches and hacking stories, and companies should be looking closely at cybersecurity as a risk management issue, and not as an IT issue (we've been saying that for years ....).

An old saw defines insanity as doing the same thing over and over again and expecting a different result. Wendy’s shareholders recently flouted that maxim by filing a derivative action this week against officers and directors of the fast-food chain seeking recovery on behalf of the corporation for damages arising from a data breach that affected over 1,000 franchise locations between October 2015 and June 2016.

The Obama White House has grappled with cybersecurity more than any administration in history: China’s 2009 hack of Google, the 2015 Office of Personnel Management breach, and the recent investigation of Russian cyberattacks during the 2016 election, to name just a few examples.

For the past few months, the Mintz Levin Privacy Webinar Series has focused on the upcoming EU General Data Protection Regulation (GDPR) to help businesses understand the reach and scope of the GDPR and prepare for the potentially game-changing privacy regulation.

An attempt to impose liability on corporate officers and directors for data breach-related losses has once again failed. On November 30, 2016, a federal judge in Atlanta issued a 30 page decision dismissing a shareholder derivative action arising out of the September 2014 theft of customer credit card data from point-of-sale terminals in Home Depot stores.

As we reported earlier this week, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights described a phishing campaign that is attempting to convince recipients of their inclusion in OCR’s Phase 2 audit program.

The growing scale of cybersecurity concerns is prompting action from government leadership on the federal level.

Smart machines connected to the internet have become ubiquitous in our daily lives. They make up the Internet of Things (“IoT”), a vast web of interconnected iPhones and Fitbits, tablets and cameras, even baby monitors and implantable medical devices, and all are designed to improve and enrich our lives. 

Even president-elect Donald Trump has been the victim of a data breach. Several times actually. The payment card system for his Trump Hotel Collection was infected by malware in May 2014 and 70,000 credit card numbers were compromised by the time the hack was discovered several months later.  

Developers and operators of educational technology services should take note. Just before the election, California Attorney General Kamala Harris provided a document laying out guidance for those providing education technology (“Ed Tech”).

As we previewed last week, the Federal Communications Commission (FCC) has adopted new privacy rules that govern Internet service providers' (ISPs) handling of broadband customer information.