On August 14, 2020, California Attorney General Xavier Becerra released final implementing regulations for the California Consumer Privacy Act (CCPA). The CCPA became enforceable on July 1, 2020, and Becerra’s office submitted a final proposed draft of the regulations to the California Office of Administrative Law (OAL) on June 1, 2020. The Proposed Regulations have
“Authorized Access”: The Supreme Court’s First Foray Into The Computer Fraud And Abuse Act
On April 20, 2020, the Supreme Court granted cert in Van Buren v. United States, to resolve an important circuit split over the meaning of “authorized access” under the Computer Fraud and Abuse Act (CFAA). This is the Court’s first foray into analyzing the precise contours of CFAA liability. Van Buren may have far-reaching
Crowell & Moring Releases Regulatory Forecast 2020 — Learn Why Antitrust Investigations into Big Tech Impact Corporate Sector
Crowell & Moring has released its Regulatory Forecast 2020: What Corporate Counsel Need to Know for the Coming Year, a report that explores the impact of regulatory changes on the technology industry and other sectors, and provides insight into thehouse counsel can expect to face in the coming year.
For 2020, the Forecast highlights
Crowell & Moring Releases Litigation Forecast 2020 — Learn how the Internet of Things and AI Expose Companies to Increased Tort, Privacy, and Cybersecurity Litigation
Crowell & Moring has released Litigation Forecast 2020: What Corporate Counsel Need to Know for the Coming Year. The eighth-annual Forecast provides forward-looking insights from leading Crowell & Moring lawyers to help legal departments anticipate and respond to challenges that might arise in the year ahead.
For 2020, the Forecast focuses on how the
California’s Landmark Privacy Law Now in Effect
On January 1, 2020, California’s landmark privacy law, the California Consumer Privacy Act (CCPA), took effect. The CCPA imposes various obligations on covered businesses and provides extensive rights to consumers with respect to controlling the collection and use of their personal information. While some companies have largely completed their CCPA compliance efforts, many others are still digesting the CCPA and draft proposed regulations, and taking steps to meet the CCPA’s myriad compliance obligations.
Confusion persists about how businesses can comply with certain provisions of the CCPA. In October 2019, the California Attorney General issued proposed regulations that provide guidance on a number of key areas, but the regulations are not yet final. If adopted, violations of the proposed regulations will be treated the same as violations of the CCPA itself, with the same penalties. We have summarized the proposed regulations in previous alerts:
- Proposed CCPA Regulations from California Attorney General Just Issued: Part I – An Analysis of Required Consumer Notice
- Proposed CCPA Regulations from California Attorney General: Part II – An Analysis of Handling Consumer Requests under the CCPA
- Proposed CCPA Regulations from California Attorney General: Part III – An Analysis of the Requirement to Verify Consumer Requests and Parental Consents
- Proposed CCPA Regulations from California Attorney General: Part IV – Service Providers & Financial Incentives
Comments on the proposed regulations can be viewed here.Continue Reading California’s Landmark Privacy Law Now in Effect
Prohibition on Expert Testimony Results in New Trial
– GN Netcom, Inc. v. Plantronics, Inc., 930 F.3d 76 (3d. Cir. 2019)
The Third Circuit’s decision in GN Netcom illustrates how Federal Rule of Civil Procedure 37(e) has elevated the bar to obtaining a default judgment based on spoliation, raising the question of what level of egregious conduct would justify that penalty. The decision also is notable for its exploration of the evidentiary support that aggrieved parties should be permitted to submit when the lesser penalty of a permissive adverse inference instruction is ordered. In a split decision, the appellate court granted a new trial because plaintiff’s expert was precluded from testifying as to the degree of spoliation, which might have impacted the outcome of the case.
Defendant’s Spoliation of EvidenceContinue Reading Prohibition on Expert Testimony Results in New Trial
Tips For Making Privilege Logs Less Scary
This time of year, everything tends to be more scary and spooky, but one thing doesn’t have to be – creating a defensible privilege log! Creating a privilege log can be one of the most time consuming, labor intensive and expensive parts of litigation. The last thing you want is to have to spend additional time and money defending or re-doing work on your privilege log.
Federal Rule of Civil Procedure 26(b)(5) only requires that the party withholding material based on a claim of privilege “(i) expressly make the claim; and (ii) describe the nature of the documents, communications, or tangible things not produced or disclosed – and do so in a manner that, without revealing information itself privileged or protected, will enable other parties to assess the claim.” Although this seems simple enough, in practice this can actually be more trick than treat.
Here are some things to keep in mind when creating a privilege log to help make it more defensible and less likely to lead to additional time and money making extensive revisions to the privilege log entries.Continue Reading Tips For Making Privilege Logs Less Scary
Why consent is the weakest link
Consent is only one of the six legal grounds for processing personal data under the GDPR, but it is certainly the most well-known. While it might look safe and solid at first sight, it is becoming the weakest link of the GDPR compliance chain.
First, consent can be withdrawn at any time, and the process
Court of Justice of the European Union Finds that Pre-Ticked Checkboxes Are Not Valid Consents under GDPR
On October 1, 2019, the Court of Justice of the European Union (CJEU) issued a final ruling in the Planet49 case (case C-673/17 – available here).
Following a request for preliminary ruling from the German Federal Court of Justice, the Bundesgerichtshof, the CJEU interpreted the consent requirement of Directive 2002/58/EC, as amended by Directive 2009/136/EC (hereafter the “e-Privacy Directive”) in light of former Directive 95/46/EU (hereafter the “Data Protection Directive”) as well as in light of its successor – the General Data Protection Regulation (GDPR).
The Court made it clear that the placing and reading of tracking cookies on a user’s terminal equipment requires an active and unambiguous consent of the user. A pre-ticked checkbox does not meet these requirements and therefore does not constitute a valid consent. Also, the Court underlined that consent must be specific. In the case at hand, the act of selecting a button to participate in a promotional online lottery cannot be construed as consent of the user to the storage of cookies.
Moreover, the Court clarified that these requirements regarding the consent of the user for usage of cookies are applicable regardless of whether the information stored or consulted on the user’s device constitutes “personal data.”
Finally, the Court held that cookie consent must be “informed” as per the GDPR, which means that service providers must also provide information on the duration of the operation of cookies, as well as in relation to any third party access to those cookies.
Belgian Data Protection Authority Finds Merchant Violated GDPR by Requiring Customers to Provide Electronic ID to Receive Loyalty Card
Executive summary
On September 17, 2019, the Belgian Data Protection Authority (DPA) issued a fine of EUR 10,000 for a breach of the General Data Protection Regulation’s (GDPR). The case related to a merchant who required the use of an electronic identity card as the sole means for the issuance of loyalty cards.
The DPA found that this practice did not comply with GDPR’s standards on (a) data minimization, as the electronic identity card contains much more information about the holder than is necessary for the purposes of creating a loyalty card; and (b) consent, because customers were not offered a real choice on whether they should provide access to the data on their electronic identity card in exchange for a loyalty card. As a result, the customers’ consent was not considered as freely given and therefore invalid.
The DPA also found that the merchant had not done enough to inform customer about its data processing activities, and thereby violated its information duties under the GDPR.