USA

The California Privacy Protection Agency (CPPA) was supposed to finalize new privacy regulations last July—but missed its deadline by around nine months. The new regulations (which we’ll call “the CPRA Regulations”) arrived on 29 March 2023, giving businesses only a couple of months to comply before the intended deadline of 1 July 2023.…

t’s been a busy legislative season for consumer data privacy. Six states have passed legislation empowering consumers with control over their data, effectively doubling the number of states with such laws. Okay, so only 11 out of 50 states have passed such laws, it’s still progress. Of the six states,…

California Superior Court Stays Some Areas of Enforcement By now, you have likely heard about the California Superior Court decision delaying enforcement until March 29, 2024, of the California Privacy Protection Agency regulations issued on March 29, 2023. The CPPA’s regulations supplement the California Consumer Privacy Act, and the CPRA…

On Friday, July 14, the California Privacy Protection Agency (“CPPA”) Board held a public meeting to address a broad, fourteen-point agenda that ranged from updates on the Agency’s budget to the status of ongoing rulemaking to enforcement. On the issue of enforcement, the Agency’s new Deputy Director of Enforcement, Mr.…

Third attempt of the European Commission to get a stable agreement on EU-US data transfers will be likely back at the Court of Justice (CJEU) in a matter of months. The allegedly “new” Trans-Atlantic Data Privacy Framework is largely a copy of the failed “Privacy Shield”. Despite the European Commission’s…

Link to the original Press Release from the European Commission Today, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework. The decision concludes that the United States ensures an adequate level of protection – comparable to that of the European Union – for personal data transferred from…

Chatter regarding comprehensive U.S. state privacy law picked up steam once again as the calendar turned to 2023. State legislative sessions are ready to commence and questions are swirling about which states could make a run at, or ultimately pass, legislation. However, the story of 2023 might be more about…

On 13 December 2022, the European Commission (“EC”) published its draft adequacy decision for the EU-U.S. Data Privacy Framework (“DPF”) that is intended to foster trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union (“CJEU”) in its Schrems II judgment. The draft adequacy decision…

Two weeks ago, the US supreme court decided that it would hear Gonzalez v Google, a landmark case that is giving certain social-media moguls sleepless nights for the very good reason that it could blow a large hole in their fabulously lucrative business models. Since this might be good news for…

On October 12, 2022, a federal jury in the U.S. District Court for the Northern District of Illinois concluded that a company violated the Illinois Biometric Information Privacy Act (Privacy Act or BIPA) 45,600 times over six years by collecting truck drivers’ fingerprints to verify identities without the informed, written…