Insights
Search Results
Alerts
9.22.23
UK-U.S. Data Bridge Commencement Date Announced
On September 21, 2023, the UK Government announced the establishment of the “UK-US data bridge” (the Bridge), also known as the UK Extension to the EU-U.S. Data Privacy Framework (the DPF). The announcement promises to simplify compliance issues surrounding the transfer of personal data from the UK to the U.S.
Alerts
9.08.23
Into the Final Stretch: Six Gatekeepers Confirmed Under the EU’s Digital Markets Acts
On September 6, 2023, the European Commission (EC) returned from its summer break with full force and announced the designation of six tech companies as so-called “gatekeepers” under the EU’s Digital Markets Act (DMA) and published a Q&A document.
News Articles
9.07.23
Wilson Sonsini Privacy and Cybersecurity Partners Recognized by Who's Who Legal
Wilson Sonsini privacy and cybersecurity attorneys were selected among the best in their fields in Who's Who Legal's annual comprehensive guide to the top data security, data privacy, and data protection lawyers in the world. The listings are a result of an extensive research process that includes continuous data collection and analysis, recommendations, and feedback from eminent practitioners and interviews.
Alerts
9.01.23
CPPA Posts Draft Rules on Cybersecurity Audits and Risk Assessments - Significant New CCPA Compliance Requirements Likely on the Way
On August 29, 2023, the California Privacy Protection Agency (CPPA) posted discussion drafts of its forthcoming regulations on cybersecurity audits and risk assessments as part of the materials for its September 8, 2023, public board meeting. These draft regulations are expected to eventually become part of the CPPA’s second rulemaking package under the California Consumer Privacy Act (CCPA) since the CCPA’s amendment by the California Privacy Rights Act. The CPPA has not yet started its formal rulemaking process for cybersecurity audits and risk assessments, and it has made clear that these draft regulations are meant to facilitate CPPA Board discussion and public participation. Nevertheless, the obligations set forth in the draft rules are extensive and provide an initial window into the onerous new compliance requirements. Notable requirements put forth for discussion under the draft regulations include:
Alerts
8.01.23
SEC Adopts Cybersecurity Disclosure Rules for Public Companies
On July 26, 2023, the U.S. Securities and Exchange Commission (SEC) approved final rules requiring that public companies report material cybersecurity incidents as well as disclose their cybersecurity risk management, strategy, and governance. In adopting the final rules, the SEC noted that disclosure practices under existing guidance1 varied and that trends related to the economy’s dependence on electronic systems and the increasing prevalence of cyber incidents, as well as increasing costs and consequences of incidents, underpin investors’ and other market participants’ need for more timely, reliable, and comparable information. The final rules will be effective 30 days after publication in the Federal Register, with a transition period for compliance (as described below). This client alert summarizes the final rules and provides guidance about what companies should be doing now to get ready.
Alerts
7.31.23
OCR and FTC Issue Joint Letter to Healthcare Companies Warning About Online Tracking Technologies
On July 20, 2023, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) sent a joint letter to approximately 130 hospitals, telehealth providers, health app developers, and other healthcare industry companies warning of the “serious privacy and security risks” related to the use of online tracking technologies integrated into their websites and mobile apps. The FTC released a press release about the joint letter here and OCR released a press release about the joint letter here.
Blog Posts
7.26.23
SEC Adopts Cybersecurity Disclosure Rules
On July 26, 2023, the U.S. Securities and Exchange Commission (SEC) announced that it adopted final rules requiring disclosure by public companies of material cybersecurity incidents in a Current Report on Form 8-K, and of material information regarding their cybersecurity risk management, strategy, and governance in an Annual Report on Form 10-K. Foreign private issuers will be required to make comparable disclosures on Forms 6-K and 20-F.
Alerts
7.21.23
Texas, Oregon, and Delaware Join the Comprehensive U.S. State Privacy Law Landscape
Texas, Oregon, and Delaware are the latest states to join the growing landscape of comprehensive data privacy laws, adding to the many state privacy laws that were passed this year.1 On June 18, 2023, Governor Greg Abbott signed the Texas Data Privacy and Security Act. On July 18, 2023, Governor Tina Kotek signed Oregon Senate Bill 619, referred to as the Oregon Consumer Privacy Act. Similarly, on June 30, 2023, the Delaware legislature passed the Delaware Personal Data Privacy Act. In doing so, Texas and Oregon officially became the 10th and 11th states, respectively, to enact a comprehensive privacy law. Assuming Governor John Carney also signs the Delaware Personal Data Privacy Act, his state would join as the 12th with that status. All three of the most recent laws are substantially similar to the prior state comprehensive consumer privacy laws, but they each include some key particularities that companies should be aware of as they plan their compliance strategies.
Blog Posts
7.20.23
SEC Announces Open Meeting to Consider Cybersecurity Rules
On July 19, 2023, the U.S. Securities and Exchange Commission (SEC) announced that it will hold an open meeting on Wednesday, July 26, 2023, to consider whether to adopt rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incidents by public companies that are subject to the reporting requirements of the Securities Exchange Act of 1934.
Alerts
7.10.23
EU and U.S. Finalize Data Privacy Framework: Here’s How to Get Certified
On July 10, 2023, the European Commission (EC) adopted an adequacy decision in relation to the EU-U.S. Data Privacy Framework (DPF). This paves the way for organizations to certify to the DPF, reducing friction for transfers of personal data from the EU to the U.S., and allowing companies to simplify their compliance with EU data flow restrictions. It thus represents a major development in the regulation of data flows from the EU to the U.S.
Alerts
7.07.23
The Final Countdown: Designation of Digital Platforms Under the EU's Digital Markets Act Formally Underway
Midnight on July 3, 2023, heralded the deadline for potential gatekeepers to notify the European Commission (EC) as to whether they meet the thresholds for gatekeepers set out in Article 3 of the Digital Markets Act (DMA).
Alerts
7.06.23
European Commission Proposes New Rules on Financial Data Access and Use
On June 28, 2023, the European Commission (EC) published a Proposal for a Regulation on Financial Data Access (FIDA). FIDA aims to create a framework through which data holders (e.g., banks, credit institutions) share the financial data they hold with other players in the finance industry (e.g., fintech companies). Customers of financial institutions will be able to control i) which data is shared, ii) with whom, iii) for what purpose, and iv) for how long. If adopted, FIDA will further liberalize financial data sharing in the EU.