The TMCA

When direct-to-consumer genetic testing company 23andMe Holding Co. and its affiliates (together, “23andMe”) filed for chapter 11 bankruptcy on March 24, 2025, they possessed data from over 15 million customers. Specifically, 23andMe possesses genetic data obtained from analysis of DNA in saliva samples customers provide for analysis and interpretation of their ancestry traits and genetic health risks. 23andMe uses data from certain consenting customers – about 80 percent of those eligible – for research and extrapolates even more information from customer DNA. Genetic data in 23andMe’s possession is no doubt valuable. Indeed, in collaboration with GlaxoSmithKline, it has been used to develop drugs, and it can also be used to study diseases. In 2023, however, a data breach exposed the vulnerability of 23andMe’s data and customers. The perpetrator accessed information for about 7 million customers. Media outlets reported that information obtained through the breach was used to compile and publish online lists of customers with specific types of ancestry. Upon entry into bankruptcy, 23andMe announced efforts to sell all or portions of its assets, including its databases of genetic information. The Office of the United States Trustee (a division of the Department of Justice) and dozens of state attorneys general raised an alarm, stressing the need for privacy protection in connection with the sale of genetic data and personally identifiable information. The attorneys general point out in filings that 23andMe’s records are not subject to HIPAA, though a variety of state laws apply to health information in 23andMe’s possession. On April 29, 23andMe agreed to the appointment of a consumer privacy ombudsman (“CPO”) to assist the bankruptcy court in evaluating proposed sales or leases of customers’ genetic data, health, and personal information. The CPO is tasked with understanding 23andMe’s privacy policies and whether proposed uses of assets violate those policies or applicable laws, evaluating the privacy policies and cybersecurity programs of potential purchasers, and evaluating a proposed sale or lease in light of customer privacy concerns. On May 19, 23andMe announced that Regeneron Pharmaceuticals, Inc. is the successful bidder for substantially all of 23andMe’s assets, for a purchase price of $246 million. A hearing for the bankruptcy court to consider approval of the sale is currently scheduled for June 17, and a report by the CPO regarding the proposed sale is currently due on June 10. 23andMe’s bankruptcy has spurred a bipartisan effort to protect consumer genetic information in bankruptcy cases. On May 22, Senators John Cornyn (R-TX), Amy Klobuchar (D-MN), and Chuck Grassley (R-IA) introduced the “Don’t Sell My DNA Act.” The bill proposes to amend the Bankruptcy Code to: (1) include genetic information as personally identifiable entitled certain protections in bankruptcy cases; (2) require the affirmative consent of consumers regarding the sale, use, or lease of their genetic information in bankruptcy; (3) require provision of notice regarding proposed use, sale, or lease of genetic information in bankruptcy; and (4) require the destruction of genetic information a bankruptcy estate does not sell, lease, or dispose of during bankruptcy. If enacted, the Don’t Sell My DNA Act would make selling genetic data in bankruptcy more difficult, because any transaction would require affirmative consent, such as electing in writing to “opt in” to a sale, from individuals whose genetic information is proposed to be sold. Additionally, provision of notice to all such individuals would add expense to bankruptcy sale processes. These measures, if made law, could mean that, like DNA, 23andMe’s proposed sale of genetic data in bankruptcy will be one-of-a-kind.

A bipartisan Bill aiming to protect individuals from having their voice and visual likeness used without their consent was reintroduced in Congress earlier this month. The Nurture Originals, Foster Art, and Keep Entertainment Safe (No FAKES) Act, was first introduced last year as a response to various celebrities having their image and voice used by generative artificial intelligence (AI) without their consent. The Bill is currently still in committees of both houses of Congress. If passed, the Bill would be historic, as it would create the first ever federal right of publicity. The federal right of publicity would allow individuals to hold other individuals and companies liable if they distribute any unauthorized digital replicas of an individual’s voice or image likeness. This legislation would also act as a carve out to Section 230 of the Communications Decency Act, thus allowing platforms to be held liable for failing to remove unauthorized digital replicas quickly when they have had sufficient notice of a deepfake. The recent reintroduction of the No FAKES Act coincided with GRAMMYs on the Hill Advocacy Day, hosted by the Recording Academy, on April 9th. This is a day for music makers and industry leaders to meet with lawmakers in Washington, D.C. to advocate for musicians’ interests. The Bill was reintroduced and sponsored by Senators Chris Coons (D-DE), Marsha Blackburn (R-TN), Amy Klobuchar (D-MN), and Thom Tillis (R-NC) and Representatives Madeleine Dean (D-PH) and Maria Salazar (R-FL). The legislation has been endorsed from various stakeholders from the music and movie industries including the Recording Industry Association of America, Motion Picture Association, SAG-AFTRA, the Recording Academy, Warner Music Group, Universal Music Group, among others. Perhaps more notably, the Bill has also been supported by technology platforms such as YouTube and OpenAI. The No Fakes Act was originally introduced in the Senate on July 31, 2024, and in the House of Representatives on September 12, 2024, as an attempt to respond to a growing number of deepfake creations. A deepfake is an artificial image or video of a person where their face, body, or voice appears real but has been created and/or manipulated with AI. Deepfakes can appear in various ways. In January 2024, a deepfake of Taylor Swift advertising Le Creuset Cookware appeared online. Drake and The Weeknd appeared to release a viral song titled “Heart on My Sleeve,” only for the music community to later find out the song itself was a deepfake. In the past two years, there has been an increasing number of stories where celebrities have had their visual and vocal likeness used in sinister ways. For example, various celebrities were the targets of visual deepfake photographs, that had the celebrities wearing a shirt that endorsed hate speech. Other celebrities have unknowingly been subjected to deepfake pornography being released. The legislation does not require a deepfake to involve a celebrity or notable figure for a person to have protections. The legislation would entitle every individual to a federal right of publicity so as to have control over their voice and image. For example, the press release for the Bill’s reintroduction discusses how a Maryland athletic director was arrested and charged after creating a deepfake voice recording of his boss, the high school principal, that included racist and derogatory comments that the school’s principal never actually made. This demonstrates how everyday individuals could be impacted and protected by the legislation as well. A draft of the Bill was circulated in late 2023 and at the time there was concern that the Bill could incidentally inhibit free speech rights. Critics voiced concerns that by holding platforms liable for hosting deepfakes, the Bill could incentivize over-removal of content and stifle creativity. Critics voiced further concern that content creators would not know when the Bill applied versus when it did not. For example, if an individual created a parody of a popular figure, critics were concerned this could violate a celebrity’s voice and visual likeness. Many of these concerns were addressed in the version of the Bill that was introduced in 2024, carving out exclusions for digital replicas that are consistent with the public interest such as commentary, criticism, satire, or parody. Following its introduction in July 2024, the Senate Bill went to the Senate Committee on the Judiciary. After the House Bill was introduced in September 2024, it went to the House Committee of the Judiciary. Currently, the No FAKES Act is still before both committees with an uncertain timeline for review. The Bill’s reintroduction is not due to changes to it or the Bill making it out of committee. Rather, the reason for the Bill’s reintroduction was likely two-fold. First, announcing the reintroduction of the bill on GRAMMYs on the Hill Advocacy Day helped to underscore its importance to artists and celebrities. Second, the reintroduction came with the newly announced support of technology companies like YouTube and OpenAI. While the legislation was largely supported by the music industry when it was first introduced, the support from key players in the technology sector could propel the Bill forward this year.

This post was written by Indian Law expert, Cyril Abrol, of the law firm Remfry & Sagar and republished with permission from Remfry & Sagar.  For more information about Remfry & Sagar and their attorneys, please visit: https://www.remfry.com/. On January 03, 2025, the government released the much awaited draft Digital Personal Data Protection Rules, 2025, (Draft Rules / Rules) for public consultation and invited stakeholder feedback by February 18, 2025 (access the Rules here). The Rules aim to provide an operational framework for the Digital Personal Data Protection Act, 2023 (DPDP Act /Act) which was enacted on August 11, 2023, establishing a framework for protecting digital personal data by regulating its processing in India (read a synopsis here and here).  It is also applicable to processing digital personal data outside India, if it involves providing goods or services to data principals (individuals to whom the personal data relates) within the territory of India. Highlights of the Rules include: Notice for consent To obtain informed consent from a Data Principal, a Data Fiduciary must provide it with a clear and standalone notice outlining what data is to be collected, the purpose for the processing, and details of goods /services to be provided or uses to be enabled by the data processing. Additionally, it should contain a direct communication link through which data principals may withdraw consent, file a complaint to the Data Protection Board (‘Board’) etc. Consent Managers The DPDP Act defines a ‘Consent Manager’ as “a person registered with the Board who acts as a single point of contact to enable a data principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.” Under the Rules, a Consent Manager must be a company incorporated in India, having a minimum net worth of INR 20 million to ensure financial stability and have a sound reputation and record of fairness, integrity and operational capacity. Security Safeguards Data Fiduciaries must implement measures such as encryption, obfuscation or masking of personal data, access control, monitoring of breaches and unauthorized activities as well as ensure continuity in processing. The Rules set out minimum technical safeguards that include: (i) implementation of access control measures; (ii) maintenance and monitoring of logs of PD access; and (iii) maintenance of back-up data. Data Breach Notification  The Rules mandate that all personal data breaches must be reported to both affected users and the Board. Upon becoming aware of a breach, organisations are required to immediately notify affected individuals with comprehensive details including the breach's description, nature, extent, timing, location, potential consequences, risk mitigation and recommended safety measures and contact information for inquiries. Similar information must be concurrently reported to the Board within 72 hours of becoming aware of the breach. Data Retention Policies  E-commerce platforms with over 20 million registered users, online gaming intermediaries with over 5 million users and social media intermediaries with over 20 million users must delete user data after 3 years of inactivity. Children's and Disabled Persons’ Data Data fiduciaries must implement measures to ensure that consent for a child’s data is given by their parent and verification is performed to confirm that the consenting party is an adult. Consent for a disabled person is to be obtained from their legal guardian and it must be verified that the guardian has been appointed under applicable guardianship laws. However, there is ambiguity on how it will be established that a Data Principal is a minor or a person with disability. Further, certain Data Fiduciaries, such as healthcare providers or educational institutions, may be exempt from specific obligations when processing children’s data, under defined conditions. For instance, educational institutions are exempt where they track and behaviourally monitor children for educational activities or for safety reasons. Also, processing of personal data for research, archival, or statistical purposes is exempt if it complies with prescribed safeguards (listed in Schedule II to the Rules). Cross-Border Data Transfer Guidelines  Restricted /prohibited territories have not yet been notified. Data fiduciaries must ensure compliance with conditions set by the government, through general or special order, for making personal data available to foreign states or entities. Annual Data Protection Impact Assessments (DPIAs) If the Central Government identifies an entity as a Significant Data Fiduciary based on enumerated factors, including volume and sensitivity of the data processing, that entity must conduct annual DPIAs to assess risks associated with their data processing activities and submit their findings to the Board. Once the Rules are finalised, the government will begin appointing members of the Board. Rules meant for businesses /industry will likely take effect in a staggered manner – one report hints at a two year sunrise period for industry to transition to the new law.

  The U.S. Department of Justice (“DOJ”) published its final rule (“Final Rule”) on January 8, 2025, that will prohibit or restrict transfer of certain data of U.S. persons to countries of concern, including to China. The Final Rule largely tracks with DOJ’s notice of proposed rulemaking (“Proposed Rule”), which we summarized in a previous eUpdate. The Final Rule therefore adopts the basic structure of prohibiting certain data transactions, while permitting restricted transactions only if security requirements are implemented to protect U.S. personal data. In short, knowing the type of data, the type of transaction, and the location of any person who can access the data is required to determine whether a prohibition or restriction applies to the proposed transaction or transfer of the data under the Final Rule. As explained below, the Final Rule reaches many types of transactions, may cover merely providing access to certain data of U.S. persons, and has a framework of exclusions that may allow companies that would otherwise be regulated by the Final Rule to continue to transfer personal data to countries of concern. The Final Rule is generally effective starting on April 8, 2025, meaning that data transfers after that date will be subject to the Final Rule and the potential penalties for transactions that violate the Final Rule. DOJ delayed the effective date for certain due diligence and auditing requirements to October 5, 2025. In its discussion of the Final Rule, DOJ rejected delaying the effective date further due to what it describes as the need to quickly address transfers of sensitive U.S. personal data to countries of concern. DOJ also holds open the possibility of delaying the effective date of the Final Rule, either in part or in full, through general licenses or regulatory changes. This eUpdate summarizes key aspects of the Final Rule, with a particular focus on changes since the Proposed Rule. The eUpdate does not comprehensively describe the Final Rule. In particular, we note our previous summary of the auditing requirements, due diligence, potential penalties, and other details of the Proposed Rule (see link above), most of which are unchanged by the Final Rule. Legal Background By issuing the Final Rule, DOJ has concluded the rulemaking process to implement Executive Order (“EO”) 14117 dated February 28, 2024. As a basis for regulating international data transfers, EO 14117 and the Final Rule declare an international emergency under the International Emergency Economic Powers Act (“IEEPA”). In particular, President Biden in EO 14117 identified efforts to access and exploit government-related data or bulk U.S. personal data by countries of concern as an unusual and extraordinary threat to U.S. national security. DOJ identifies counterintelligence concerns, the risk of blackmail and ransomware, and the ability to use artificial intelligence (“AI”) tools as justifying action under the Final Rule. DOJ also notes a gap in federal law that currently does not address international data transfers to countries of concern. Who is Impacted by the Final Rule? The Final Rule broadly applies to and regulates the activities of U.S. companies and individuals operating in many industries and markets. The framework for the Final Rule is outlined below. Initially, however, it is worth highlighting some examples of activities that DOJ believes are subject to the Final Rule, which are indicative both of the scope of and priorities reflected in the Final Rule. We note these examples with caution, as the status of these examples under the Final Rule could change depending on the precise facts (e.g., amount of data collected), and the activities described below may be permissible if relevant parties adopt security measures, or if the activities qualify for an exemption. We thus refer to these examples as subject to potential restrictions under the Final Rule, depending on the facts and circumstances of the transactions. A U.S. company develops mobile app games that collect data on U.S. users. The U.S. company hires a CEO from a country of concern, who will be provided access to data on the U.S. users. The hiring of the CEO is subject to potential restrictions under the Final Rule. A U.S. company develops social media apps that systematically collect data of U.S. users. A foreign company from a country of concern purchases a minority stake in the U.S. business. The investment agreement allows the foreign company to access the data of U.S. users. The investment agreement is subject to potential restrictions under the Final Rule. A U.S. company operates an app that gathers geolocation data of U.S. users. The U.S. company enters into a vendor agreement with a country of concern to process and store the data. The vendor agreement is subject to potential restrictions under the Final Rule. A medical facility with health data about U.S. patients contracts with a company in a country of concern to provide IT-related services, including by providing access to the data about U.S. patients. The contract is subject to potential restrictions under the Final Rule. A multinational company maintains data about U.S. persons and contracts with a service provider in a country of concern to process and store the data, including the data about U.S. persons. The service agreement is subject to potential restrictions under the Final Rule. A U.S. company hires a data scientist who is a citizen of a country of concern to develop an AI personal assistant intended for the U.S. company’s financial services customers. The data scientist’s responsibilities require access to data on large numbers of U.S. persons. The employment of the data scientist is subject to potential restrictions under the Final Rule. As is apparent from these examples, the Final Rule applies to and potentially restricts the activities of companies in many industries and in a wide range of common IT and business operations. Below we summarize key aspects of the Final Rule. Key Definitions in Final Rule The Final Rule applies to U.S. persons who process sensitive U.S. government or bulk U.S. sensitive personal data as described below, and in particular those who engage in transactions with or have operations in countries of concern. However, the Final Rule also will significantly impact non-U.S. persons or operations involving countries other than countries of concern, to the extent they may be involved with U.S. government data or bulk U.S. sensitive personal data and there is or may be potential access to personal data in countries of concern. DOJ adopts the following key definitions in the Final Rule, all of which are closely aligned with those in the Proposed Rule. “Bulk U.S. Sensitive Personal Data.” The Final Rule adopts “bulk” thresholds consistent with the Proposed Rule. These categories are summarized in the chart at the end of this eUpdate. In a change from the Proposed Rule, DOJ also established a bulk threshold for epigenomic, proteomic, or transcriptomoic data of U.S. persons. “Countries of Concern.” The Final Rule designates six countries—China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela as countries of concern. This list can be expanded upon further designations of countries that pose a risk to U.S. national security. “Covered Person.” The Final Rule prohibits or restricts transfers to a Covered Person in addition to a Country of Concern. DOJ revised the definition of a Covered Person to cover the following: (1) foreign entities that are 50 percent or more owned (individually or in the aggregate) by a Country of Concern, organized under the laws of a Country of Concern, or have their principal place of business in a Country of Concern; (2) foreign entities that are 50 percent or more owned (individually or in the aggregate) by a Covered Person; (3) foreign employees or contractors of countries of concern or entities that are Covered Persons; and (4) foreign individuals primarily resident in Countries of Concern. DOJ also can specifically designate persons, regardless of location, that it determines to be, or to have been, controlled by or under the jurisdiction of a Country of Concern or a Covered Person. “U.S. Person.” A U.S. person includes any individual or entity who is located in the United States; individuals who are U.S. citizens, nationals, or permanent residents, or have refugee or asylee status under U.S. law; and corporations organized solely under the laws of the United States. “U.S. Government Data.” U.S. Government-Related Data includes two types of data, regardless of the volume of the data: (1) geolocation data covering any precise location data within specific longitude and latitude coordinates within areas identified in the Final Rule; and (2) data about U.S. Government personnel marketed as linked to current or recent former U.S. Government employees or contractors. The Final Rule defines “recent employees or contractors” as those who worked for the U.S. Government (including the military and intelligence community) within a two-year period preceding a covered transaction. Prohibited, Restricted, and Exempt Transactions The Final Rule creates a framework of prohibited, restricted, and exempt transactions. Companies will need to consider whether they have transactions of U.S. Government or Bulk Sensitive U.S. Person Data with Countries of Concerns or Covered Persons, and if so, whether those transactions are prohibited, restricted, or exempt. The Final Rule also prohibits facilitating prohibited or restricted transactions, actions taken to circumvent the Final Rule, or causing a violation of the Final Rule. This framework ultimately will allow certain companies to continue working or collaborating with countries of concern. Companies can rely on the categories of exempt transactions to permit sharing of certain data between the United States and a Country of Concern. Alternatively, certain restricted transactions may, however, proceed if companies adopt security requirements specified in the Cybersecurity and Infrastructure Security Agency (“CISA”) rules. The CISA security requirements can be found online and are summarized below. The Final Rule prohibits U.S. persons from engaging in two types of transactions. Data Broker Transactions. The Final Rule prohibits a “Data Brokerage” transaction with a Country of Concern or a Covered Person that involves Bulk U.S. Sensitive Personal Data. A “Data Brokerage” transaction means selling, licensing, or similar commercial transactions where the recipient did not collect or process the data directly from the individuals linked or linkable. By definition, a “Data Brokerage” transaction is not an employment agreement, investment agreement, or vendor agreement as those terms are defined below. These Data Brokerage transactions are defined more broadly than transactions under other data brokerage laws, and the DOJ notes as justification for this broad definition that the operation of ad exchanges, the use of social media, or other “tracking” pixels can allow access to Bulk Sensitive U.S. Personal Data or U.S. Government Data by a Covered Person or in a Country of Concern. Human Genetic Data. The Final Rule prohibits a U.S. person from engaging in a transaction with a Country of Concern or a Covered Person involving bulk human genomic data, or data concerning bulk epigenomic, proteomic, or transcriptomoic as defined below at the end of this eUpdate. The Final Rule makes the following three classes of transaction restricted: (1) employment agreements, (2) non-passive investment agreements, and (3) vendor transactions (collectively, “Restricted Transactions”). Unless the U.S. person adopts CISA’s proposed risk mitigation security requirements, U.S. persons cannot engage in the following Restricted Transactions with Countries of Concern or a Covered Person if they involve Bulk U.S. Sensitive Personal Data. Employment Agreements. Agreements or arrangements where an individual, other than an independent contractor, performs work or job functions in exchange for payment or other consideration, including on a board or committee, executive-level arrangements or services, or employment services at an operational plant. Investment Agreements. The exchange of payment or other consideration for direct or indirect ownership interests or rights in relation to real estate in the United States or a U.S. legal entity. The Proposed Rule excludes from an “Investment Agreement” passive investments such as for publicly traded securities, index funds, or as a limited partner in a venture capital fund. Vendor Agreements. The provision of goods or services, including cloud-computing services, in exchange for payment or other consideration, other than an Employment Agreement. The Final Rule also establishes a framework of exempt transactions that will make many data processing activities and transactions outside of the Final Rule’s prohibitions or restrictions. In particular, the following nine types of activities or transactions may qualify for exemptions under the Final Rule. Personal communications, informational materials, and travel information are exempt under the Final Rule. This exclusion recognizes long-standing exclusions, mandated under the IEEPA statute, from IEEPA-based U.S. economic sanctions administered by the U.S. Department of the Treasury Office of Foreign Assets Control (“OFAC”). Companies will need to carefully consider the scope of these exemptions, which DOJ likely will interpret narrowly, similar to OFAC’s narrow interpretation of them. Activities involving U.S. Government operations. Financial services for banking, capital markets, futures or derivatives, or financial insurance services, e-commerce, and certain investment management services. Corporate group transactions between a U.S. person and its foreign subsidiary or affiliate, if they are ordinarily incident to and part of routine administrative or business operations, such as human resources, payroll, taxes, permits, compliance, risk management, travel, and customer support. Transactions related to certain federal law or international agreements. DOJ cites the following legal instruments as authorizing transactions under this exemption: the Convention on International Civil Aviation (2022); the WHO constitution (1946); various U.S.-China agreements on customs, legal assistance, and taxation; the U.S.-Cuba Extradition Treaty (1905); U.S.-Russia agreements on customs (1994) and legal assistance (1999); the U.S.-Venezuela Legal Assistance Treaty (1997), the International Health Regulations (2005); and certain public health surveillance and response mechanisms. Investment agreements that are subject to mitigation or other action taken by the Committee on Foreign Investment in the United States (“CFIUS”), if CFIUS explicitly designates them as exempt. Transactions that are ordinarily incident to and part of the provision of telecommunications services, including voice and data communications services regardless of delivery method. DOJ lists communications via cable, Internet Protocol, wireless, fiber, or other transmission mechanisms, as well as arrangements for network interconnection, transport, messaging, routing, or international voice, text, and data roaming as potentially qualifying for this exemption. Transactions involving data transfers or access to data with a Country of Concern or Covered Persons involving drug, biological product, device, or combination product approvals or authorizations if such approvals are necessary to obtain or maintain regulatory approval. “Regulatory approval data” means sensitive personal data that is de-identified or pseudonymized under FDA regulations (21 C.F.R. 314.80(i)) and required by a regulatory entity to research or market a drug, biological product, device, or combination product, including post-marketing studies and surveillance. Clinical investigations and post-marketing surveillance data if the transactions are part of clinical investigations regulated by the FDA under sections 505(i) and 520(g) of the Federal Food, Drug, and Cosmetic Act, or to support FDA applications for research or marketing permits for drugs, biological products, devices, combination products, or infant formula, and the data are de-identified or pseudonymized consistent with FDA regulations (21 C.F.R. 314.80(i)). Final CISA Security Rule Under the Final Rule, Restricted Transactions may be permitted on the condition that certain security procedures and controls are put in place to protect U.S. Government Data or Bulk Sensitive U.S. Personal Data (collectively, Covered Data). These security controls must be implemented with respect to any “Covered System” that is used to process Covered Data as part of a Restricted Transaction, regardless of whether Covered Data has been deidentified or encrypted on that system. Further, in a clarification in the Final Rule, the existence of security measures does not affect the application of the Final Rule, in principle, meaning that the existence of comparable security controls (e.g. encryption) does not impact companies’ obligations to comply with other requirements of the Final Rule. Under CISA’s final security rule requirements, there were relatively few changes to the mandatory security processes and controls relative to the proposed CISA rule. However, certain incremental changes were made, and the final CISA rule allows companies to take a slightly more flexible and risk-based approach with respect to certain controls, in particular those relating to vulnerability management, logging, and certain systems documentation. As with the Proposed Rule, CISA’s security requirements borrow heavily from NIST Cybersecurity Framework and Privacy Framework standards. However, the specificity of these requirements, and CISA’s intent to build on the specific national security objectives set out in the Order, mean that these requirements include a number of new and unique obligations for affected organizations. Organizations engaging in Restricted Transactions that must conform to the CISA rules will therefore be required to conduct additional IT system reviews, update applicable policies, and establish additional security controls in order to properly secure Covered Data in Restricted Transactions. Conclusion Companies involved in many industries should consider whether the Final Rule requires adoption of new or revised data policies, including companies involved in cloud computing, e-commerce, education, healthcare, financial services, manufacturing, software design, and others. Summary of Bulk U.S. Sensitive Personal Data Definition “Bulk” Threshold (U.S. persons) Biometric Identifiers Physical characteristics that are measurable or behaviors used to recognize or verify the identity of an individual, including facial, voice, retina or iris, palm, fingerprints, gait, or keyboard usage data that are enrolled in a biometric system and the templates used to create such a system. 1,000 Geolocation Real-time or historical data that identifies the physical location of an individual or a device with a precision of within 1,000 meters 1,000 Human Genomic Nucleic acid sequences that are the entire set or a subset of genetic instructions found in human cells, including the result of an individual’s genetic test and genetic sequencing data. 100 Other Genetic Data (‘omic data) Epigenomic, proteomic, or transcriptomoic data of individuals 1,000 Personal Financial Data about an individual’s credit, charge, or debit card, or bank account, including purchases and payment history; data in a bank, credit, or other financial statement, including assets, liabilities, debts, or trades in a securities portfolio; or data in a credit report or in a consumer report. 10,000 Personal Health Health information about past, present, or future physical or mental health or conditions of an individual; healthcare information about an individual or payment information about healthcare. 10,000 Personal Identifiers Identifiers that in combination with any other listed identifier or other data is linked or linkable to sensitive personal data. This includes names linked to device identifiers, social security numbers, driver’s license or other government identification numbers, and many others. The definition excludes certain data (e.g., demographic data linked only to other demographic data). 100,000

A new frontier emerges in the shadow of Colorado’s majestic peaks – Colorado’s governor signed into law a first-of-its-kind comprehensive artificial intelligence (“AI”) law in May 2024. Senate Bill (“SB”) 24-205, commonly known as the “Colorado AI Act,” regulates the risk of algorithmic discrimination arising from the use of high-risk AI systems in the employment context. Effective February 1, 2026, the Colorado AI Act accomplishes what California is trying to do, and what other states and localities did in limited ways, in passing legislation addressing “algorithmic discrimination.” Algorithmic discrimination occurs when the use of an AI system results in or contributes to unjustified differential treatment or impact based on actual or perceived protected characteristics. California’s Bills Surpassed by Colorado AI Act The Colorado AI Act beat out California’s own proposed AI law impacting the workplace. California first introduced a bill, Assembly Bill (“AB”) 331, over one year ago targeting automated decision tools that failed earlier this year. Now, AB 2930, entitled “Automated Decision Tools,” seeks to prohibit the use of any “automated decision tools” – systems or services that use AI to make consequential decisions, such as those impacting employment – that result in discrimination. If passed, California’s AB 2930 will require developers and users of automated decision tools to provide an impact assessment to identify and eliminate “algorithmic discrimination.” Where a consequential decision is made solely based on the output of an automated decision tool, deployers of the automated decision tools will be required to accommodate a person’s request not to be subject to the tool. AB 2930 passed in the California House, and is now pending before the California Senate. NYC, Maryland, and Illinois Laws Already Passed, But Do Not Go as Far as the Colorado AI Act Besides Colorado, only New York City and two states (Maryland and Illinois) have passed laws addressing AI and automated decision tools in the employment context, but only in limited circumstances: New York City’s Local Law 144 requires employers and employment agencies that use an automated employment decision tool (“AEDT”) to provide notices, complete an annual bias audit, and to publicly share the results of the annual bias audit. Any discrimination claims involving AEDTs are referred to the NYC Commission on Human Rights, which enforces the New York City Human Rights Law. Local Law 144 imposes monetary penalties of no more than $500 for the first violation and between $500 and $1,500 for each subsequent violation. The other two laws addressing automated decision tools apply in the job requisition and interviewing context. Illinois’ Artificial Intelligence Video Interview Act prohibits employers from using AI to analyze video submissions from job applicants unless employers (1) provide notice to the applicants, before the interview, that AI may be used to assess the applicants, (2) explain how the AI system works, and (3) obtain the applicants’ consent to be assessed by AI. Maryland’s HB 1202 prohibits employers from using facial recognition technology in job interviews unless the applicant provides a written consent and waiver stating the applicant’s name, the date of the interview, that the applicant consents to the use of facial recognition during the interview, and that applicant read the waiver. This means that, for now, Colorado has the only state-wide law that regulates AI and algorithmic discrimination in the employment context. While California’s Bill Sits, Colorado AI Act Moves Ahead The Colorado AI Act steps into the lead on state legislation regulating AI in the employment context while California’s AB 2930 awaits passage. Like California’s bill, the focus of the Colorado AI Act is the classification of “high-risk AI systems,” which include systems that make a “consequential decision,” or a decision that has a material legal (or similarly significant) effect on providing or denying a consumer an opportunity, including employment opportunities. The Colorado AI Act requires deployers and developers to use reasonable care to avoid algorithmic discrimination arising from intended (and contracted) usage of high-risk AI systems. Specifically: The Colorado AI Act applies to developers and “deployers” – a person doing business in Colorado that deploys a high-risk artificial intelligence system. Commentators are construing the definition of “deployers” to include employers. Like California’s AB 2930, the Colorado AI Act defines “algorithmic discrimination” as “…any condition in which the use of an artificial intelligence system results in an unlawful differential treatment or impact that disfavors an individual or group of individuals on the basis of their actual or perceived” protected characteristics. If the Colorado Attorney General brings an enforcement action against a high-risk AI system deployer, the Colorado AI Act creates a rebuttable presumption that a deployer uses reasonable care if it is compliant with various measures, including impact assessments, notifications, and risk management policies and programs. A violation of the Colorado AI Act constitutes a deceptive trade practice under Colorado’s Consumer Protection Act, carrying up to a $20,000 civil penalty for each violation. What Employers Should Know California’s AB 2930 has not yet passed, and the Colorado AI Act does not take effect until February 2026. However, both California and Colorado employers can prepare for compliance by: Designing a governance and compliance program meeting the respective statute’s requirements. The Colorado AI Act refers to the “Artificial Intelligence Risk Management Framework” promulgated by the National Institute of Standards and Technology (NIST) as a benchmark for required risk management programs. However, the Colorado AI Act allows covered entities to refer to other comparable nationally or internationally recognized frameworks. Building processes and designating personnel to perform impact assessments, perform bias audits, and report any adverse findings from the assessments and audits. Establishing the infrastructure for documentation regarding notifications provided to job applicants, employees, and other personnel. The Colorado AI Act ushers in a new frontier for Colorado employers who use AI and automated decision tools, requiring employers to be mindful of the tools they may use in the job requisition and assessment processes. Should California’s AB 2930 pass, California employers will be required to meet requirements like those applicable to their Colorado counterparts. Dorsey’s Workplace Privacy team will continue to monitor pending state law, and provide updates as they come.

As the federal government continues to take action in response to events impacting the healthcare landscape, stakeholders must ensure that they are staying up-to-date with health information privacy and security developments in the healthcare industry. This blog post summarizes two recent significant actions: a new HIPAA final rule and proposed federal cybersecurity legislation. New HIPAA Final Rule The U.S. Department of Health and Human Services (“HHS”) has expressed concern about patient trust in the privacy of health care information since the U.S. Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization in 2022. Most recently, on April 22, 2024, HHS’s Office for Civil Rights (“OCR”) issued a new final regulation under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule: HIPAA Privacy Rule to Support Reproductive Health Care Privacy. The final rule strengthens privacy protections for sensitive information about reproductive health care by: Prohibiting covered entities and their business associates from using or disclosing protected health information (“PHI”) for the purpose of an investigation into or proceeding against an individual or entity who seeks, obtains, provides, or facilitates lawful reproductive health care, which includes providing information on or paying for any such services. This prohibition does not apply in situations of suspected abuse, neglect, or endangerment. Prohibiting covered entities and their business associates from identifying any individual or entity for the purpose of any such investigation or proceeding. Requiring covered entities and their business associates to obtain a signed attestation when they receive a request for PHI potentially related to reproductive health care for the purpose of health oversight activities, judicial or administrative proceedings, law enforcement, or coroner or medical examiner disclosures. The attestation must include the individual or class of individuals whose PHI is requested, the covered entity or business associate, the requestor, a statement that the PHI will not be used or disclosed for any prohibited purpose, and a statement acknowledging the criminal penalties for any violation of the Privacy Rule. Prohibiting a provider from refusing to treat a person as the personal representative of a patient merely because they provided or facilitated reproductive health care for a patient. Requiring covered entities to revise their Notice of Privacy Practices. The final rule is scheduled for publication in the Federal Register on April 26, 2024. It will become effective 60 days after publication, with compliance to occur by February 16, 2026 for the Notice of Privacy Practices requirement and within 240 days after publication for all other requirements. As the compliance dates quickly approach, covered entities and business associates must ensure alignment of their policies, practices, and Notices of Privacy Practices with this new final rule. Covered entities and business associates may also need to revise their business associate agreements, to the extent that such agreements would permit a business associate’s use or disclosure of PHI that is prohibited under the new rule. Proposed Federal Cybersecurity Legislation The healthcare industry has seen a recent increase in cybersecurity incidents. According to OCR, over the past few years, the number of large breaches reported and the number of individuals affected by those breaches have doubled. Now, following the Change Healthcare breach, Congress is considering new legislation: Health Care Cybersecurity Improvement Act of 2024 (S.B. 4054). On March 22, 2024, Senator Mark R. Warner (D-VA), introduced the proposed federal legislation, which has been referred to the Senate Committee on Finance. Sen. Warner, who is a member of the Committee on Finance and co-founder and co-chair of the Senate Cybersecurity Caucus, is a well-known advocate of enhanced cybersecurity in the healthcare industry. The proposed legislation charges the Secretary of HHS with setting minimum cybersecurity standards for Medicare’s Accelerated Payment Program and Advance Payments Program. During the COVID-19 public health emergency, the Centers for Medicare and Medicaid Services offered accelerated and advance payments to assist in disruptions to claims payments due to the public health emergency. Under the Health Care Cybersecurity Improvement Act of 2024, if a participating Part A hospital or one of its intermediaries does not meet the set standards, the hospital will not receive accelerated payments under the Accelerated Payment Program where a cybersecurity incident caused the disrupted operations or cash flow problems. Similarly, if a participating Part B provider or one of its intermediaries does not meet the set standards, the provider will not receive advance payments under the Advance Payments Program where a cybersecurity incident caused the delayed claims payments by health insurance companies. Notably, the accelerated and advance payments are only for Medicare Part A and Part B claims payments. Currently, the bill is still in the early stages of the legislative process, and, if the law were enacted, enforcement would not occur until two years after its enactment. However, given the continuing prevalence of cybersecurity incidents in the healthcare industry, additional detailed HIPAA Security Rule cybersecurity guidance, as well as emerging state agency activity (such as New York’s proposed cybersecurity regulations for hospitals), now is the time for healthcare providers and other covered entities and business associates to focus on HIPAA Security Rule compliance to protect against hacking, ransomware and other cybersecurity attacks, and the resulting disruptions to clinical care. If you have any questions about the HIPAA Privacy Rule or Security Rule, proposed cybersecurity legislation, or their potential impact on you or your organization, please contact the authors or your regular Dorsey attorney.

Almost from the very beginning of the internet era, the world has been increasingly afflicted with cyberfraud, exploiting the internet’s potential to enable fraudsters to induce unsuspecting victims to transfer money to overseas bank accounts using another relatively recent technological innovation, electronic funds transfer. Hong Kong is a destination particularly favored by fraudsters for such transfers, due to its open banking system and the ease with which funds can be retransferred from there to mainland China, from which many of the fraudsters operate and where recovery of funds is much more difficult, if not impossible. Recently, a new breed of deception has emerged, in Hong Kong as well as elsewhere, using the powerpost of deepfake technology. Despite robust government measures to combat fraud, fraudsters are getting creative and discovering new methods to take advantage of people. This post will review the most recent fraud statistics and what the government is doing to stop it in Hong Kong, take a closer look at the worrying increase in deepfake scams, and provide practical guidance for everyone to better protect themselves from these growing online dangers. Alarming Statistics According to the statistics announced by the Hong Kong Police Force (HKPF) on February 6, 2024 (the “2023 Statistics”), deception cases in 2023 surged by 42.6%, totaling 39,824 cases. Internet-related scams accounted for approximately 70% of the reports, involving over HK$9 billion (US$1.15 billion). Common fraudulent activities included online shopping scams (8,950 cases, a 2.5% increase), investment fraud (6,330 cases, a 1.2-fold increase), phishing scams (4,322 cases) – newly covered in January 2023, employment fraud (3,930 cases, a 31.2% increase), social media deception (3,372 cases, a 6.5% decrease) and telephone deception (3,213 cases, a 13.5% increase). Government Anti-Deception Efforts – “Scameter+” In our prior article published in June 2023, we discussed the various measures implemented by the Hong Kong Government in response to the rising deception cases. As part of these efforts, the HKPF launched the one-stop scam and pitfall search engine “Scameter+” in February 2023 to assist the public in identifying fraud and online pitfalls. According to the 2023 Statistics, “Scameter+” has recorded over 2.13 million searches and issued nearly 360,000 alerts on frauds and cyber security risks. The HKPF plans to enhance the “Scameter+” app by introducing new features, such as enabling it to send alerts when users encounter suspicious websites or receive suspicious calls, as well as introducing a public reporting mechanism within the “Scameter+” app. Deepfake Scams Despite the government’s anti-deception efforts, there were 3,238 cases of deception reported in the first month of 2024, accounting for 42% of all crimes. The number of deception cases is on the increase worldwide. In the rapidly changing world of cybercrime, fraudsters are constantly seeking new opportunities to exploit vulnerabilities. Their newest tool? Deepfake Technology! This cutting-edge AI-driven technique allows scammers to create highly convincing fake videos and audio recordings, blurring the boundaries between reality and deception. In February 2024, the Hong Kong office of a multinational company fell victim to a sophisticated scam involving deepfake technology. The fraudsters created digital replicas of the company’s chief financial officer and other employees, who appeared to participate in a video conference. By convincingly replicating the appearance and voices of the targeted individuals using publicly available video and audio footage, the fraudsters deceived an employee of the Hong Kong office into making 15 transfers, totaling HK$200 million (US$25.6 million), to multiple bank accounts. This incident marked the first known case in Hong Kong where victims were deceived in a multi-person video conference setting. It is particularly concerning that the company officials only became aware of the scam about a week later and subsequently reported to the HKPF. The delayed realization underscores the importance of raising awareness and educating employees about the risks associated with deepfake technology, as well as other forms of cyberfraud. It is crucial for organizations to implement internal security measures and provide regular training to the staff so that they can recognize and respond to such scams effectively. While deepfakes currently constitute only a small portion of Hong Kong’s wider cyber fraud landscape, it remains imperative that we proactively take steps to safeguard ourselves. As individuals, we play a crucial role in safeguarding our digital lives and ensuring online security. Here are proactive steps to take: Stay Informed:  Keep up-to-date with the latest trends in cyberfraud, common scams and deceptive techniques to better recognize and avoid falling victim to fraud. Verify Sources: Exercise caution when receiving requests for sensitive information or financial transactions, especially during video calls.  Verify the authenticity of individuals by asking them to perform specific actions, such as moving their heads, or by answering questions that confirm their identity. Use of Technology: Leverage AI-driven tools to detect anomalies and inconsistencies in communications. These advanced technologies can help identify potential deepfakes or other fraudulent activities, providing an additional layer of protection. Act Quickly: If you suspect wire fraud, contact your bank immediately to report the incident and request a hold on the transaction, or to recall funds.  Engage a trusted lawyer who has experience in fraud as soon as possible. To learn more about email wire fraud and business email scams, we recommend reading our in-depth guide on protecting against such scams and recovering funds wired to Hong Kong. Our experienced Hong Kong and U.S. wire fraud lawyers have handled numerous cross-border wire fraud cases and are well-equipped to provide expert assistance and guidance. Please visit our International Cyber Crime and Asset Recovery page.   [1] See HKSAR Press Release on 6 February 2024 [2] See South China Morning Post, “Hong Kong police log 15 per cent surge in scams in January, despite integration of anti-fraud app into major payment system” dated 12 March 2024 [3] See RTHK News “Deepfake colleagues trick HK clerk into paying HK$200m” dated 4 February 2024

2023 brought a surge of data privacy developments, with a large expansion of state comprehensive privacy laws, litigation of new claims based on older laws (e.g. wiretapping and VPPA cases), increased scrutiny on data brokers, and more. Because 2024 is shaping up to be equally complex for those who manage data privacy in their organizations, we have compiled a summary of the US data privacy topics to watch in the coming year. More State Privacy Laws January was already a busy month for state privacy legislation, with new comprehensive privacy laws passed in both New Jersey and New Hampshire. The New Jersey law goes into effect January 15, 2025 and applies to businesses that control or process the personal data of 100,000 or more New Jersey consumers or the personal data of 25,000 or more New Jersey consumers and derive revenue from the sale of the personal data. Notably, the New Jersey law’s definition of sensitive information differs from existing state laws, and includes financial information, transgender or non-binary status, and a broad definition of biometric data. Sensitive information can only be processed after obtaining express consent from the consumer. New Jersey’s law also does not include as many exemptions as previous laws: data processed by nonprofits, personal data subject to the Family Educational Rights and Privacy Act (FERPA), and data processed by institutions of higher education are all subject to the law. New Hampshire’s privacy law takes effect January 1, 2025 and affects entities that do business in the state that target residents if they control the personal data of at least 35,000 residents, with some exceptions, or control at least 10,000 residents while deriving more than a quarter of their gross revenue from the sale of personal data. New Hampshire continues the trend of including a broad definition of sensitive data and follows in Delaware’s footsteps by prohibiting the processing of data without prior parental consent for targeted advertising if the controller has actual knowledge that the consumer is thirteen to sixteen years old. Both New Hampshire and New Jersey specify the definition of consent as the same type of express, unambiguous, and unbundled agreement that has been seen in several other state privacy laws. Several other comprehensive state privacy laws will take effect or have deadlines this year, including Oregon and Texas’s comprehensive laws becoming effective on July 1st, and Montana’s comprehensive law on October 1st. On January 1st in California, data brokers were required to be registered with the new California Privacy Protection Agency (CPPA) and starting July 1st data brokers must collect and report information in their privacy policies regarding the types of CCPA requests the brokers have received. In addition, as of March 29, 2024, there is no longer a cure period for enforcement of the CPRA regulations, and companies must ensure they have a data request process in place for HR data, as well as other unique requirements under the California law. The CPPA also released draft regulations for updated cybersecurity audits, which would apply to businesses that receive 50% or more of their gross annual revenue from selling or sharing personal data, as well as businesses that meet a few other yet to be defined thresholds. Looking to Colorado, on July 1st, controllers under the Colorado Privacy Act must recognize approved universal opt-out mechanisms, provide an explanation of how requests using these mechanisms will be processed, and controllers must get consent to process any sensitive data they collected without valid consent prior to July 1, 2023. Finally, in Connecticut, on December 31, 2024 the right to the sixty day cure period ends. Numerous bills have been proposed to amend many existing state privacy laws and to create new laws, including bills proposing to strengthen protections for children’s data, biometric data, requirements relating to AI, and more. The volume of these bills is too great to discuss in this short article, but we are watching these bills closely and will provide further updates if/when these bills become law. My Health My Data Act 2024 will also bring significant obligations from new consumer health data laws, most notably Washington’s My Health My Data Act (MHMDA) which goes into effect on March 31, 2024. MHMDA covers a broad range of entities: it applies to any business, including non-profits, that conduct business in Washington and collect, process, share, or sell consumer health data, which is broadly defined as “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.” Opt-in consent is needed for the sale of such data. Although Washington does not yet have a comprehensive data privacy law, MHMDA provides similar consumer rights and controller/processer duties as other existing state laws. However, the Attorney General’s updated guidelines state that entities should have a separate and distinct privacy policy (with unique requirements) for consumer health data, accessible via a separate link. Because MHMDA offers a private right of action (in addition to enforcement by the state’s Attorney General), we anticipate significant litigation as soon as this law becomes effective. Nevada and Connecticut quickly passed laws similar to the MHMDA. Nevada’s goes into effect the same date as MHMDA, and Connecticut’s is an amendment to its comprehensive data privacy law, which took effect on July 1, 2023, and more states are expected to follow. Federal Agency Developments In addition to advancements at the state level, federal agencies are also expected to continue to change the data privacy landscape in 2024. At the end of last year, the Federal Trade Commission announced a Notice of Proposed Rulemaking to update the Children's Online Privacy Protection Rule (COPPA). The proposed changes would drastically change how companies can control and process the data of minors, potentially requiring parental opt-in consent for targeted advertising and third party disclosures, diminishing companies’ ability to nudge kids to return to their services, limiting retention of minor’s data, formalizing guidance in the ed tech sector, and strengthening data security requirements. The FTC has also indicated its willingness to continue robust enforcement actions in the data privacy space, as illustrated by its enforcement actions in early January against InMarket Media and Outlogic LLC regarding their sales of precise location data, and specifically for failing to disclose how they used location data and retaining the data longer than reasonably necessary. Authorities are also emphasizing the need to regulate artificial intelligence as it relates to privacy in 2024. The FTC broadcasted their AI-powered voice cloning challenge in January and the Federal Communications Commission also opened a Notice of Inquiry to investigate AI generated robocalls. The FTC may also finalize its Health Breach Notification Rule this year and the Consumer Financial Protection Bureau is expected to complete a proposed Personal Financial Data Rights Rule by late 2024 which would compel banks to make transaction data available to consumers and track their data requests. Conclusion Overall, 2024 is looking to be another busy year in the data privacy world. For more information or help navigating the realm of data privacy, please contact Dorsey’s data privacy and cybersecurity team.

The European Data Protection Board (EDPB), a board comprised primarily of representatives of the data protection supervisory authorities of the European Union’s member states, issued surprising new guidance in mid-November explaining how a key component of the European Union’s ePrivacy Directive applies to variety of commonly used technologies used for tracking on the internet. Article 5(3) of the ePrivacy Directive[1] (EPD) has long been a cornerstone of internet and privacy law in the European Union (EU). Under the directive, EU member states were required to pass laws that limited “the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user” to situations where the subscriber or user has been provided “clear and comprehensive information” about the practice and, thus informed, provided consent. The sole exceptions to this requirement are as necessary to transmit the user’s communication over a network or “as strictly necessary in order for the provider of [a service] explicitly requested by the subscriber or user to provide the service.” This aspect of the EPD has long been understood to apply to the cookies stored in users’ web browsers. Indeed, the EPD is often colloquially referred to as the “EU Cookie Directive.” It was logical that the EPD applied to cookies because cookies were designed with the express intention of allowing a website provider to store information in a user’s web browser for later retrieval. Cookies, however, are not the only ways in which a website operator or mobile app provider can store or access information in a user’s terminal equipment. Earlier guidance from the EDPB also confirmed that the EPD also applied to the tracking of a user through the practice of “device fingerprinting.” The EDPB’s new guidance, entitled “Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive,” goes further. It clarifies that the EPD also applies to many newer tracking technologies, many of which are ubiquitous components of the ad-supported internet. The guidance clarifies that the EPD always applies when four criteria are met: (1) the operation in question relates to information; (2) the operation relates to a subscriber’s or user’s “terminal equipment”; (3) the operation is made in the context of a publicly available electronic communications service on a public network; and (4) the operation involves “gaining of access” or “storage.” The EDPB guidance interprets all of these elements broadly enough to cover most or all tracking technologies in use on the internet. For instance, the EDPB’s guidance explains that the EPD applies to tracking of users by means of tracking pixels or tracking links. Tracking pixels are hyperlinked resources that are embedded into content to enable the collection of information about the users of the content. The information might be collected by the sender of the content or by a third party that aggregates tracking data. Tracking pixels also often contain additional information that facilitate tracking across pages, websites, and devices. Tracking links are web links that include additional information to facilitate tracking. The EDPB explains that tracking links are used, for instance, to enable e-commerce partners to identify and pay commissions to referral sources. In both contexts, the EDPB finds that the tracking meets all four of the criteria for the applicability of the EPD: information is both stored on and accessed from the user’s terminal equipment in the context of a public internet service. The EDPB guidance reaches the same conclusion with regard to tracking based on “local processing” or “processing instructed by software distributed on users’ terminal, where the information produced… is then made available to selected actors” by the software. The EDPB explains that if local code sends information “back over the network… such an operation (instructed by the entity producing the client-side code…) would constitute a ‘gaining of access to information already stored.’” This reasoning almost certainly implicates many common tracking technologies, such as Google Analytics, that operate through JavaScript code that execute within a client’s web browser. It also would almost certainly implicate tracking embedded in mobile apps running on users’ tablets and smartphones. The EDPB also explains that, under analogous reasoning, tracking via IP addresses and unique identifiers (even identifiers that are inherent in user authentication) also falls within the technical scope of the EPD. Of course, the fact that these tracking technologies fall within the scope of the EPD does not mean that these technologies cannot be used. However, it does require the providers and operators of these tracking technologies to provide users with information about the tracking and to collect users’ consent to the tracking before it begins. This will require providers and operators of tracking technologies to modify their websites and mobile apps to provide this information and to obtain and track users’ consent. Because the EDPB’s guidance is an interpretation of existing law, users of tracking technology will have no grace period to enact these changes before enforcement efforts can begin. [1] The directive was originally issued as “Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector” and amended in 2009 by “Directive 2009/136/EC.”

Plaintiffs look to the past to take action against modern web tracking As states rapidly enact new consumer privacy legislation, businesses have been working tirelessly to comply with extensive new data protection obligations and build out compliance programs. Despite the fact that these new state laws lack a private right of action for violations associated with online tracking and data sharing, private plaintiffs across the country have found creative workarounds, filing a wide range of novel claims alleging violations of decades-old privacy laws. These claims seek to expand the reach of these older laws to modern technologies, adding a new, dynamic layer to businesses’ privacy concerns. Driving the explosion in litigation are a series of decisions that have given new life to claims under state and federal wiretap laws and for violation of state constitutional common law privacy rights in the context of common online technologies. As a result, private plaintiffs are increasingly bypassing the broad limitations on private rights of action common to state consumer privacy laws, and making demands that go beyond, or potentially conflict, with the requirements set out in those laws. For now, many of these actions are relatively novel claims working through lower courts, often on preliminary motions. The causes of action and defenses continue to evolve, and there remains considerable change and uncertainty as these cases develop. However, recent trends suggest that courts are engaging in critical and nuanced evaluations of these claims in the context of popular online advertising and communications technologies.   What technologies are the focus of Plaintiffs’ claims? The key technologies at issue in these cases are online advertising services, social media “pixels,” “chatbots,” and “session-replay” technologies commonly used by businesses with consumer-facing online services. Online advertising, such as display advertising, retargeting, or remarketing services often involve the use of consumer profiles that are accessed and distributed among myriad companies involved in the ad personalization and bidding process. Social media pixels and other integrations allow companies to connect their website with social media services to obtain insights about consumer demographics and other marketing data and to run targeted marketing campaigns on popular social media sites. Chatbots are third party tools that companies add to their sites that allow customers to seek support, find products, and ask questions. Session replay technologies involve the recording of user interactions on sites for usage, debugging, and similar analytical purposes, but which may involve creating a record of user data entered in form fields, or similar information. In each case, third party providers operate these technologies and are granted access to data relating to the customer’s activity on and other interactions with the business’s online services and, in some cases, communications with the business. In the case of social media pixels, social media companies may have access to information such as the products or content that the user viewed, shopping carts, purchases, and other information revealed by ‘tags’ that companies place on their services. Social media sites then link this information to a user’s social media profile or other information the platform holds about the user, which the business can then use to obtain insights about consumer behavior and to target advertising to similar users on social media sites. What claims are plaintiffs bringing? To challenge companies’ use of these technologies, plaintiffs are looking to the past, bringing challenges under state and federal wiretap acts (telephone privacy), under state constitutional or common law privacy (e.g., invasion of privacy, intrusion upon seclusion), and the Video Privacy Protection Act (“VPPA”), a relatively obscure 1987 law passed in response to the disclosure of supreme court nominee Robert Bork’s video rental history. Each of these laws permit private claims and provide for statutory damages, which may allow private individuals to bring claims without proof of actual damages. The federal Wiretap Act (18 USC § 2511) provides a cause of action against “any person who … intentionally intercepts … or procures any other person to intercept or endeavor to intercept any wire, oral or electronic communication.” Similarly, California’s Invasion of Privacy Act (Cal. Pen. Code § 631(a)) “CIPA”) provides a cause of action against a person who “attempts to read, or to learn the contents or meaning of any message, report, or communication” including anyone “who aids, agrees with, employs, or conspires with any person or persons” to engage in such conduct. However, both CIPA and the federal wiretap act allow such conduct with the consent of all parties to the communication. In addition to the wiretap claims, plaintiffs have brought claims under state constitutional or common law for invasion of privacy. For example, in California a person has a cause of action where another person ‘intentionally intrudes into a place, conversation, or matter as to which the person has a reasonable expectation of privacy and the intrusion is highly offensive to a reasonable person.’ The VPPA (18 USC § 2710) provides a cause of action against a “video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider” without authorization. While the VPPA was originally intended to address videotape rental services, the VPPA also applies to “any person engaged in the business … or deliver or prerecorded video … tapes or similar audio visual material.” For each of these claims, plaintiffs fundamentally allege that behavioral and interaction data collected by online services reveals private information, communications, or other information protected by law. For example, in cases where defendants use online advertising or social media pixels, plaintiffs allege that these services allow the website operators, or their advertisers or social media partners, to collect detailed, private information relating to their demographics, preferences, and behaviors. For businesses with video offerings, plaintiffs further allege that the disclosure of information relating to the videos, e.g., the title, violates the VPPA. Similarly, on sites that use chatbots or session replay technologies, plaintiffs often allege these technologies result in the disclosure of protected communications. The outcome of these claims tend to turn on several of key facts: In all cases: Did the plaintiff provide consent? The quintessential defense to each of these claims is the plaintiff’s consent to the collection or disclosure of the information at issue. However, there remains some dispute over the elements of consent required in each case. Important open questions include the means and extent to which a plaintiff was notified of the alleged conduct (e.g., via a standalone notice or general privacy policy), or whether the plaintiff affirmatively opted-in, acknowledged the use, or if legal notices were available for review when the plaintiff used a service. Was there actual harm? Despite statutory damage provisions, there remain open questions as to whether plaintiffs can bring claims in cases where there is no injury in fact or no allegation of legally cognizable harms. The Supreme Court’s landmark Spokeo and TransUnion cases continue to develop alongside many of these claims. For wiretap claims: Does the technology involve the disclosure of communications content? Generally, wiretap claims require the defendant to have intercepted the content of a communication, not merely information relating to the communication (e.g., number dialed, time, etc.). Wiretap laws such as CIPA also cover interception of the meaning of a communication. In the case of behavioral advertising or social media, there is considerable debate as to whether browsing metadata that reveals demographic information, usage history, or information regarding products viewed or purchased reflects a “communication.” Similarly, in cases of session replay technologies, it may be unclear whether actual communications, or mere interaction data were collected, especially where services offer redaction tools that enable operators to exclude communications content, but the redactions are not visible to the public (or in a manner sufficiently apparent at the pleading stage). Is the party a third party? Where a defendant or their agent is a party to communication, those parties generally cannot be liable under wiretap laws. Therefore, in cases where a service provider is required to provide services only on behalf of a business (i.e., subject to a services agreement and data protection agreement), parties may be able to avoid liability and dismiss claims under wiretap acts under this exception. However, where social media companies or advertisers can use data for their own purposes, it is debatable (and highly context dependent) whether the social media platform could be deemed a party to the communication. For invasion of privacy claims: Does the plaintiff have a reasonable expectation of privacy? Foundational to all invasion of privacy claims is the defendant’s reasonable expectation that the information or communication was private. As with wiretap cases, where a business collets only general commercial information or metadata about a communication—but no actual communication—courts are less likely to find that the defendant has a reasonable expectation of privacy. Where the volume or nature of data reveals only common, or readily observable behavior, courts are also less likely to find a reasonable expectation of privacy. However, where a business collects detailed search histories or other data that collectively reflects the substance of a communication or significant amounts of information about a person, some courts have found that plaintiffs may have a reasonable expectation that such information would remain private. A defendant’s conduct can also give rise to expectations of privacy, e.g., though the provision of opt-out options, or affirmative statements that certain data would not be collected. Was the conduct highly offensive? In additional to the plaintiff’s reasonable expectation of privacy, the defendant’s conduct must be “highly offensive.” There is considerable debate over this element, as courts often must consider vague, and sometimes evolving, social norms. However, in cases where information collected is general commercial information or otherwise non-sensitive, courts often find that such conduct was not offensive enough to support a claim, notwithstanding the plaintiff’s reasonable belief that the information would remain private. For VPPA claims: Is the business is a video tape service provider? The VPPA applies only to video tape service providers that are “engaged in the rental, sale, or delivery of prerecorded video cassette tape or similar audio visual materials.” While courts have expanded this to online streaming services and other online video platforms, courts have found that a party may not be a ‘service provider’ where they merely deliver video content (for no fee) or where the video offering is only ancillary to the business (e.g., a video on a marketing website for a consumer products company). Similarly, courts have found that providers offering live content or livestreams are not video service providers. Is the plaintiff a “consumer”? A consumer for purposes of VPPA is a “renter, purchaser, or subscriber of goods or services from a video tape service provider.” Recent VPPA cases have scrutinized the nexus between plaintiffs’ relationships with the business and the video content at issue. In cases where video is neither core to the business nor the subscription or purchase transaction, courts have found that an individual is not a consumer for VPPA purposes. However, where exclusive video content or similar offerings are made to subscribers as part of a purchase, courts are more likely to find a sufficient nexus between the video content and a subscription or other commercial transaction. Is the disclosed data “personally identifiable”? The VPPA defines personal information “as information that identifies a person as having requested specific video material from the video tape service provider.” This definition is narrower than definitions under modern consumer privacy laws that extend to data that that is identifiable or linked or linkable to a person. Some data from social media services is known to link directly to user profiles that readily identify individuals, and as such may be personally identifiable. However, data that is not directly identifiable, such as anonymous user IDs (isolated from data sufficient to link to a known ID), IP addresses, and the like may not be personally identifiable for purposes of the VPPA. How should businesses respond? In response to the wave of cases, businesses should take steps to ensure that they review and evaluate the implementation of common web technologies, in particular those involving social media, advertising, session replay technologies, and video content. Dorsey’s team of privacy lawyers can provide advice and assistance with measures to mitigate the risks of litigation under these novel claims. Dorsey’s privacy team will continue to monitor these cases and report on updates as courts consider these cases and critical facts continue to develop.

On 10 July 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework (“DPF”). The adequacy decision is designed to relieve U.S.-based businesses and other institutions and organisations that choose to participate in the DPF from legal uncertainties and administrative burdens in relation to personal data records originating from the EU. It is expected that the UK and Switzerland will soon adopt similar decisions that will allow participating organisations to enjoy the benefits of the DPF in relation to data imported from those two countries for processing in the U.S. or by U.S. organisations. The DPF is the third attempt to create a data bridge between the EU – with its heightened concern for protecting privacy interests of individuals – and the U.S., which has been for the past few decades slow in adopting policies and legislation to protect those rights (although more recently consumer privacy legislation is increasingly being adopted by US state legislatures). Even before the EU introduced its General Data Protection Regulation (“GDPR”), there was a self-certification scheme in place – not altogether unlike the new DPF – which allowed US-based companies and organisations to import personal data from the EU on the basis of the organisation’s legal commitment to safeguard the data and to protect the interests of data subjects. Just like the new DPF, under that scheme (the “Safe Harbor” arrangement), mechanisms were put in place to allow the U.S. Department of Commerce to enforce the commitments of participating organisations and to allow individuals to bring complaints. Just like the DPF, the “Safe Harbor” scheme was approved by the EU Commission under applicable EU law. GDPR was designed to allow the “Safe Harbor” scheme to continue to operate. It contained specific provisions empowering the EU Commission to enter into international arrangements like the “Safe Harbor” and the DPF. But in its decision of 6 October 2015 in the Maximilian Schrems v Data Protection Commissioner case (C-362/14), the EU Court of Justice held that the “Safe Harbor” scheme failed to meet the requirements of EU law in relation to the protection of personal data when it is taken outside the jurisdiction of the EU. In 2016, the EU Commission approved a second scheme, known as the EU-U.S. Privacy Shield. That scheme was once again ruled in a subsequent decision of the EU court of 16 July 2020 (Schrems II, C-311-18) to have fallen short of EU legal requirements. In both decisions, the main reason for the EU Court’s decision that personal data transferred to the U.S. under the terms of the schemes was not sufficiently protected, was the evidence that U.S. national security and law enforcement agencies were engaged in wide-range, on-going, and (according to the Court’s findings) indiscriminate mass monitoring and surveillance of communications which the agencies access through “back doors” provided by social media and other digital platforms based in the U.S. The rulings of the EU Court were particularly focused on the absence of legal redress mechanisms in the U.S. for EU individuals whose data is or may be exposed to such surveillance. The EU Commission gave its blessing to the new DPF scheme based largely on the signing by President Biden on 7 October 2022 of Executive Order 14086 on Enhancing Safeguards for United States Signals Intelligence laying down limitations and safeguards for all U.S. signals intelligence activities and on a supplemental Regulation on the Data Protection Review Court (28 CFR Part 302) issued by the U.S. Attorney General. Among other things, the Executive Order and the associated Regulation establish a tribunal and proceedings that affected EU individuals will be able to use to bring complaints regarding the use of their data by intelligence agencies. Those redress mechanisms and the other requirements of the DPF program were considered to be sufficient by the EU Commission to provide adequate safeguards to protect personal data transferred to the U.S. under the scheme. But what does this all mean for U.S. businesses, organisations, and institutions that consider signing up for the DPF program? Participation in the scheme means that the organisation will be free to collect, import, and use personal data records from any source in the EU without having to put in place transfer agreements with each data exporter and carry out transfer impact assessment in each case and without risking challenges against its use of personal data imported from the EU. This could be of real benefit for businesses and organisations that receive data regularly from the EU, particularly if they deal with many different categories of personal data, coming from different sources and processed for many different purposes. Self-certification under the DPF means that there is no need to address each and every one of those data transfers individually. Further, businesses and organisations love to declare that they respect people’s privacy and that they are committed to protecting personal information. By committing itself to the requirements of the DPF program, an organisation may be able to nurture the trust of other businesses, and organisations, and even the public itself, for being an organisation that truly respect the privacy of individuals and is committed to protecting their data. If the scheme is successful in attracting large portions of corporate America as well as various other organisations and institutions that may be eligible for the scheme, it might become a ‘must have’ for large companies in the public eye. The scheme undeniably offers advantage for some, but the administrative effort and the compliance burden in participating in the DPF should not be understated. One of the key criticisms of the defunct “Safe Harbor” scheme was that it lacked any real oversight or enforcement mechanisms. This is not the case with the DPF. The fundamental idea of the DPF (as any other mechanism to legitimise international data transfers outside the EU) is that the self-certifying organisation has to commit itself to a set of basic “Principles” which reflect the fundamental requirements of the GDPR, including securing for data subjects the same rights that they have under EU law. This in itself is a serious compliance burden which any organisation that contemplates joining the scheme should consider carefully. Alongside broad principles of establishing a legitimate basis for the use of data, particular protections for sensitive data, data security, controls over the re-purposing of personal data, and the sharing of data with third parties, the DPF also includes some very specific requirements. These include, among other things, specific information that has to be made available to data subjects regarding the organisation’s participation in the DPF scheme, the internal complaints handling procedures, and the external dispute resolution mechanism to which the organisation commits itself and other information. This means that participants would have to update their privacy policies to include this information. Participating organisations are also required to give data subjects certain specific choices – an opt-out from disclosures to third parties (other than service providers) and an opt-out from re-purposing the data. Apart from the implications of offering those choices, organisations would have to consider the logistics of offering these choices to all EU individuals whose data is being imported by the organisation into the U.S. Further, the DPF introduces a new set of requirements regarding the contractual arrangements that have to be put in place when the imported data is being shared with a third party controlling (that is, not a service provider which deals with the data on behalf of the participating organisation). Organisations will therefore need to set themselves up for new procedures and new contract forms for dealing with onward transfers. Another key element – which was lacking in the original “Safe Harbor” scheme but had already been addressed under the “Privacy Shield” program - is the requirement that the participating organisation must submit itself to external dispute resolution mechanisms. Those could take the form of private dispute resolution organisations, but there is also the option for an organisation to submit itself to the jurisdiction of data protection regulators in the EU. Either way, the requirement is that the mechanism must be free to the complaining individual. Finally, to ensure that participants maintain the privacy and data security standards to which they commit themselves through self-certification, the scheme requires participating organisations to verify their own compliance. Verification can take the form of self-audits or external audits. Either way, the verification needs to demonstrate that the participant’s privacy policy regarding personal information received from the EU is accurate, comprehensive, readily available, conforms to the “Principles”, and – importantly – that it is fully complied with. It must also indicate that individuals are informed of the organisation’s in-house complaint handling procedures and of the independent recourse mechanism(s) through which individuals may pursue complaints. Further, the verification needs to confirm that the participating organisation has in place procedures for training employees in the implementation of the privacy policy, and disciplining them for failure to follow it; and that it has in place internal procedures for periodically conducting objective reviews of compliance with the above. An annual self-certification declaration must be made each year confirmed by the declaration of a corporate officer. Executives would need to ensure their companies are indeed fully compliant before swearing such a declaration. Alongside the compliance burdens and verification and dispute resolution mechanisms, the DPF also includes a number of exceptions and provisions that apply to specific situations, such as allowances for journalism, airlines, and for corporate due diligence exercises, and special rules for clinical trials and medical research and for handling human resources data. These special rules are designed to ensure that the scheme’s requirements are not going to be prohibitive in respect of such activities or for organisations in the relevant sectors. They would require particular attention by affected organisations. Consideration of those sets of special rules is beyond the scope of this note.

Introduction In June 2023, the Privacy Commissioner for Personal Data in Hong Kong (the “Commissioner”) released a new guidance note on data breach handling and notifications (the “Guidance Note”). The purpose of this note is to assist data users in preventing and managing data breaches effectively. The Guidance Note is a comprehensive document which recommends best practices in data governance, risk assessments, technical and operational security measures, data processor management, and remedial actions during data security incidents. In today's new normal, which includes hybrid modes of working and learning, data users face challenges in protecting data privacy and security. The Guidance Note is designed to help businesses minimize the risks of data breaches, which can cause reputational and financial damages. Moreover, it sheds light on essential requirements on the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) (the “PDPO”), compelling data users to safeguard personal data from unauthorized access, processing, erasure, loss, or misuse. The Guidance Note focuses on the following areas concerning data breach: 1. Preparing for Contingency - Data Breach Response Plan A data breach response plan is crucial for organizations to effectively manage and minimize the impact of data breaches. The plan should encompass procedures for identifying, containing, assessing, and managing incidents. It should also define the roles and responsibilities of team members, communication plans, risk assessment workflows, investigation procedures, and record-keeping policies. Taking swift action in response to a data breach can significantly reduce the extent of damage caused. Regular reviews of the plan and adequate staff training are essential to ensure its effectiveness. 2. Handling Data Breaches The recommended steps for handling data breaches demonstrate the data user's commitment to addressing the issue promptly, which can significantly reduce the impact on affected individuals and potential reputational damage. The steps include: Step 1: Gather all relevant information about the breach and escalate the incident to the dedicated data breach response team if necessary. Step 2: Take immediate steps to contain the breach, such as shutting down or isolating compromised servers and disabling relevant system functions. Step 3: Assess the risks of harm to affected individuals by evaluating the nature and sensitivity of the personal data involved and the circumstances of the breach. Step 4: Consider notifying the relevant authorities and affected data subjects as soon as practicable after becoming aware of the breach, particularly if there is a real risk of harm to those individuals. Step 5: Keep a comprehensive record of the breach to facilitate a post breach review, including all relevant details, and use the lessons learned to improve personal data handling practices. 3. Data Breach Notifications Data users need to act quickly in the event of data breaches. They should promptly notify relevant parties, including affected data subjects and the Commissioner, upon becoming aware of a breach. This notification is vital to mitigate potential harm, enable investigative actions, demonstrate commitment to data privacy management, raise public awareness, and seek advice. The notification should include a general description of the breach, date and time of occurrence, source, types of personal data involved, risk assessment, mitigation measures taken, and contact information for the data breach response team. Data subjects can be notified directly or through public announcements, while the Commissioner should be notified using its Data Breach Notification Form, which can be submitted online, by fax, in person, or by post. Oral notifications are not accepted, and the Commissioner provides assistance in completing the form. Conclusion The Guidance Note highlights the complex legal framework in Hong Kong that mandates remedial actions for data breaches and is a valuable resource offering insights and strategies to prevent and handle data breaches effectively. Data users must promptly notify affected parties and the Commissioner, take necessary measures to mitigate harm, initiate investigations, demonstrate commitment to data privacy management, raise public awareness, and seek advice. Non-compliance with these regulations can lead to severe legal consequences. Therefore, preventing data breaches has become increasingly crucial to safeguard personal data, protect reputation, and avoid financial harm. By following the recommendations, businesses can enhance their data governance, security measures, and response strategies, thus reducing the risks associated with data breaches. Vigilance and preparedness will be key to safeguarding personal data and preserving the trust of customers and stakeholders alike for any business. Alongside with the Guidance Note, the Commissioner has introduced an online notification form, streamlining the reporting process for businesses facing data breaches. Currently, failing to report data breaches to the Commissioner or affected parties does not constitute a breach of the PDPO. However, the Commissioner is proactively pursuing amendments to the PDPO. This endeavor includes working towards establishing a mandatory data breach notification mechanism. While the precise timeline for these legislative amendments remains uncertain, the release of well-defined proposals is expected in the near future.

On July 14, 2023, the California Attorney General announced an investigative sweep targeting CCPA compliance efforts by “large California employers.” The Attorney General’s Office stated that it sent inquiry letters to large California employers “requesting information on the companies’ compliance with the California Consumer Privacy Act (CCPA) with respect to the personal information of employees and job applicants.” The California Attorney General’s announcement is a reminder that all aspects of the CCPA are now applicable to employee, applicant, and other HR data. Before January 1, 2023, the CCPA only required covered employers to (a) safeguard HR data, and (b) provide a notice to employees, job applicants, owners, directors, officers, medical staff members, and contractors describing the categories of data collected in those contexts, and how that data would be used. However, California voters approved the California Privacy Rights Act (the “CPRA”) on November 3, 2020, which amended the CCPA and eliminated the exemption for data in the HR context. Effective January 1, 2023, covered employers’ obligations to comply with the CCPA as it relates to HR data expanded significantly. CCPA-covered employers’ HR data privacy obligations now include, among other things, drafting or amending compliant service provider agreements and establishing processes for handling requests from employees, applicants, contractors, and others in the HR context to exercise their rights to access, delete, correct, and opt out of the sale and sharing of their personal data. There is some degree of uncertainty as to how California employers can shape their CCPA compliance efforts. The CCPA regulations do not clearly address HR data, and the California Privacy Protection Agency (CPPA) recently acknowledged the lack of clarity in the CCPA regulations at a May 2023 meeting. The CPPA considered revising the CCPA regulations and/or adding exceptions or specific rules for employee data, given that “the current purposes are not really designed for” employee data, as one CPPA member noted. In addition, many employers who have fulfilled CCPA employee data access requests have been frustrated by the fact that the CCPA statute and the regulations do not contain meaningful exemptions applicable to data to be provided in the HR context, as can be seen in the General Data Protection Regulation, the comprehensive privacy law in the EU and UK, which does include HR data within its scope. Several other states exempted employee and other HR data from their own comprehensive consumer data privacy laws: Virginia, Colorado, Connecticut are currently in effect, and Utah, Texas, Montana, Iowa, Tennessee, and Indiana have enacted new laws to take effect in the next few years. California remains the only state to extend its data privacy law to HR data. Hopefully, the CPPA’s November 2023 meeting will bring clarity for California employers’ compliance efforts. In the meantime, the Attorney General’s announcement of an investigative sweep is a reminder that the CCPA’s statutory requirements, including those that apply to HR data, are enforceable, even though the Superior Court of California issued a ruling delaying enforcement of the new CCPA regulations until March 29, 2024.

AI technology is developing at a tremendous pace and AI image creation is no exception. AI images are even winning art contests. Since AI generates artistic images modeling others’ work, human artists are asking “is it copyright infringement for AI technology to use my work to learn how to create images and produce AI works?” The Northern District of California may answer that burning question. In January 2023 artists Sarah Andersen, Kelly McKernan and Kayla Ortiz filed a class action copyright lawsuit against Stability AI Ltd., Midjourney, Inc., and DeviantArt. The case is listed as Andersen v. Stability AI Ltd, U.S. District Court for the Northern District of California, No. 3:23-cv-00201.The Plaintiffs contend that AI used copyrighted works without their permission to help the technology learn how to copy and analyze works to produce new images. They also contend that the AI technology creates unauthorized derivative works. Put simply, the technology allows a user to type in a prompt of what type of art they want, in what style of artist, and can request it to have certain subjects in the picture. The artists argue that this essentially creates derivative works of their art. Other counts include infringement of the Digital Millennium Copyright Act, state law claims, and infringement of the right to publicity. In April, each Defendant filed a motion to dismiss the artists’ complaint. The Defendants’ argue that the artists failed to identify a “single allegedly infringing output image” that was allegedly used by the Defendants to train their system. The Defendants further argue that the artists cannot show any single image created by AI is substantially similar to an artists’ own copyrighted works. Most recently, on June 2, the Plaintiffs’ filed oppositions to each of the Defendant’s motions to dismiss. A judge has yet to publish a decision on the motions to dismiss. Defendant Midjourney argues that if the court were to resolve the claims of direct copyright infringement, it would have to proceed on an image-by image basis to determine which works are protectable and which are considered fair use. The fair use defense to copyright infringement allows a creator to use a work even if unauthorized and it is still not considered copyright infringement because it is a “fair use” of the copyrighted material. To determine if a work is fair use, a court will look to four factors: 1) the purpose and character of the use, 2) the nature of the copyrighted work, 3) the amount and substantiality of the work used in relation to the whole and, 4) the effect of the use upon the potential market for the work. The defendants may focus on the first and third factors. When looking at the purpose and character of the use, the Defendant’s may point out using any copyrighted works is still transformative in nature – the AI technology is generating new images that differ from the original works. Regarding the amount of the prior work used, the Defendant’s will likely argue that the material copied is an insignificant portion of the input material used by the AI program to generate an image. However, the Plaintiff’s will likely argue that AI will divert sales because the general public can now use AI as a substitute for buying their art. These decisions will be pivotal to determine if works generated through AI are copyright infringement or fair use. This case will have important results for several parties. For artists, the concern is that AI driven image creation may steal from their livelihood. Using AI, anyone can get an image that looks like their favorite artists by providing the system with a clear prompt. For the Defendants, this represents a landmark lawsuit that will determine if and how their company will be allowed to leverage AI going forward. For Stability AI, it will determine if their new AI technology will be able to be utilized and to what extent. For Midjourney and DeviantArt, it will answer if they are able to use Stability’s technology on their platforms to allow users to create their own images using AI technology. This lawsuit represents some of the first litigation to address key questions around AI image creation. As artificial intelligence comes more into the mainstream, it will be up to cases like these to help determine how AI images will be regulated, used, and to what extent. The rest of the world will be watching as this case will send some of the first signals for how the U.S. judicial system may view AI and copyright infringement claims.

The year 2023 will likely go down in history as a major inflection point in the enactment of comprehensive consumer data privacy laws in the United States. At the beginning of the year, only five states (California, Virginia, Colorado, Utah, and Connecticut) had enacted comprehensive consumer data privacy laws. And, of these, only the California and Virginia laws are currently in effect. The privacy laws in Connecticut and Colorado go into effect on July 1, 2023, and Utah’s law becomes enforceable on December 31, 2023. Recently, however, the states of Indiana, Iowa, Tennessee, and Montana have also enacted new state consumer data privacy laws. In addition, state legislatures in Florida and Texas have passed bills to enact consumer data privacy laws; the governors of these states are widely expected to sign these bills into law. Most privacy professionals anticipate that many of the remaining states will also enact privacy laws in the next few years. It is likely that, barring preemptive federal law-making, most or all of the remaining states will eventually enact privacy laws of their own. (The state of Washington also recently enacted a landmark privacy law specific to consumer health data this year that also has some overlap with these comprehensive consumer data privacy laws.) Many businesses and other organizations have expressed concern about the compliance burdens of dealing with these emerging privacy laws, particularly since they can be subject to the laws of each jurisdiction in which they do business. Nevertheless, there is significant commonality among the laws that have passed so far. It is reasonable to assume that laws enacted in the future will continue to have these comment elements. By focusing on these common elements, businesses can design their privacy program with the confidence that it will be well positioned for the future. These common elements include the following features: Applicability thresholds. Although the specific thresholds vary, each of the state laws has applicability requirements that exempt many small and medium businesses that are not heavily involved in personal data collection or sales. Iowa and Indiana’s laws are typical in this respect. For either of those states’ laws to apply, the business or organization must process the personal data of 100,000 or more residents of the state or, if the business derives 50% or more of its gross revenue from the sale of personal data, process the data of 25,000 or more residents of the state. And, except in Colorado, non-profit organizations are exempt from compliance. Each law also has broad exemptions for organizations or personal data that is already protected under existing federal sectoral privacy laws like the Health Information Portability and Accounting Act (HIPAA) and the Gramm Leach Bliley Act (GLBA). Exclusion of personal data of employees, applicants, and former employees. With the exception of California, no state has applied its consumer data privacy law to individuals in their role as members of their employers’ workforces. Emergency contact information and personal data used for benefit administration is often also exempted from the laws’ requirements. Data subject rights. All states provide individuals in the state with rights relating to their personal data. These rights generally include the right to deletion of personal data, the right to correct inaccurate data, the right to know what data the business holds regarding the individual, and the right to receive a portable copy of the individual’s personal data. Most states also give individuals the right to opt out of the selling of their personal data or sharing of their personal data for behavioral advertising. A few states even give individuals the right to opt-out of certain kinds of processing of consumer data. Privacy notice requirements. Each of the states has requirements for privacy-related disclosures. Every state privacy law currently enacted requires businesses to state the categories of personal data that they collect and the purposes for the collection. Some states also require additional disclosures about the sharing and selling of personal data and place limits on the processing of personal data for purposes in excess of what was disclosed at the time of collection. And, all states require that privacy notices (often called privacy policies) explain the rights individuals have regarding their personal data. Sensitive data rules. Many states designate a category of personal data as “sensitive data” to reflect the higher risk of harm that could be associated with its use. Montana’s definition is typical and defines sensitive data as including: “(a) data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, information about a person’s sex life, sexual orientation, or citizenship or immigration status; (b) the processing of genetic or biometric data for the purpose of uniquely identifying an individual; (c) personal data collected from a known child; or (d) precise geolocation data.” Some states require consent from the individual to process sensitive data, while others allow individuals to opt out of the processing of sensitive data. Security requirements. All of the state privacy laws require organizations to protect personal data with reasonable information security safeguards. Data protection agreements. Most of the state privacy laws require businesses that engage processors (e., third parties that process personal data on their behalf) to have a contract with the processor that contains specific requirements, such as instructions for the personal data processing, the nature and purpose of the processing, the type of data subject to processing, the duration of the processing, return or deletion of the personal data at the end of the relationship, and assisting in demonstrating compliance with the law. Data protection assessments. Many of the state privacy laws have provisions that require businesses that engage in processing of personal data involving a high risk to the data subject to thoroughly analyze the processing, weigh the risks and benefits, consider ways to mitigate risks, and possibly consider alternatives and safeguards. (This assessment is sometimes also called a data protection impact assessment or privacy impact assessment.) Most of these laws consider the processing of personal data for targeted advertising or selling personal data to be activities for which an assessment is required. Similarly, the processing of sensitive data requires an assessment in many states. No Private Enforcement. In general, state privacy laws allow only governmental enforcement, and do not grant individuals a private right of action to sue for damages. California is the sole exception, but even in California, an individual can sue only if the individual was a victim of a data breach. Cure periods. Many laws provide that, prior to enforcement, a business is entitled to notice of an alleged problem and a right to cure the violation within a certain specified period. Civil penalties. All of the laws provide for civil penalties, often of $7,500 or more per violation. The following table describes how Iowa, Indiana, and Tennessee have addressed these common elements. Feature Iowa Indiana Tennessee Montana Applicability threshold Process personal data of 100,000 residents or Process personal data of 25,000 residents and receive 50% or more of gross revenue from sale of personal data Process personal data of 100,000 residents or Process personal data of 25,000 residents and receive 50% or more of gross revenue from sale of personal data Have $25 million or more worldwide annual gross revenue and process personal data of 175,000 residents or Process personal data of 25,000 residents and receive 50% or more of gross revenue from sale of personal data Process personal data of 50,000 residents or Process personal data of 25,000 residents and receive 25% or more of gross revenue from sale of personal data Data subject opt-out rights Sale of personal data, targeted advertising, sensitive data processing Targeted advertising, sale of personal data, profiling with significant consequences Sale of personal data, targeted advertising Targeted advertising, sale of personal data, profiling with significant consequences Other data subject rights Confirm processing, deletion, receive a copy, appeal Confirm processing, correction, deletion, receive a copy, appeal Confirm processing, correction, deletion, receive a copy, appeal, request information about data sales Confirm processing, correction, deletion, receive a copy Exclusions for data covered by HIPAA and GLBA and for institutions of higher education Yes Yes Yes Yes Requirement for a privacy notice required that is organized by categories and purposes and including information on rights Yes, and it must also list categories of personal data shared with third parties and categories of third parties Yes, and it must also list categories of personal data shared with third parties and categories of third parties Yes Yes, and it must also list categories of personal data shared with third parties and categories of third parties Privacy notice serves as a processing limitation (i.e. the law limits processing personal data for purposes other than those described at collection) No Yes Yes Yes Data protection assessments required No Yes Yes Yes Reasonable data security requirement Yes Yes Yes Yes Data processing agreement requirements Yes Yes Yes Yes Private right of action No No No No Right to cure Yes, 90 days Yes, 30 days Yes, 60 days Yes, 60 days, but it expires on April 1, 2026. Effective date Jan. 1, 2025 Jan. 1, 2026 July 1, 2024 Oct. 1, 2024 Civil penalty Up to $7,500 per violation Up to $7,500 per violation Up to $15,000 per violation Yes, with no explicit cap     By building a privacy compliance program that can effectively deal with these common elements, business and other organizations can feel confident that their program will also satisfy many of the elements that will be present in future state data privacy laws. Here at the TMCA, we will continue to keep stakeholders updated on further developments in the fast-moving area of consumer privacy legislation.

It is safe to say that the use of artificial intelligence (AI) went mainstream in 2023. With the widening acceptance of AI, dozens of industries have raced to adopt the technology into various operations at a staggering pace – including adopting AI in human resources (HR) processes in the workplace. But, employers and HR departments should keep pace with federal agencies seeking to mitigate risks associated with AI in the workplace. Last week’s released guidance from the Equal Employment Opportunity Commission (EEOC) illustrates how federal agencies seek to keep up with technological advances. AI in the Workplace AI in the workplace is moving at a fast clip. According to the EEOC, as many as 83% of employers, and as many as up to 99% of Fortune 500 companies, are using some form of AI to screen or rank candidates for hiring. The use of AI in the workplace is not new from an HR perspective. Employers have long been able to use AI to perform certain HR functions in the recruiting process, such as resume screening. But now, employers can use AI for other recruitment functions, such as administering personality and aptitude tests or analyzing video interviews. Once workers are on-boarded, employers can use AI to help with worker safety, protection, management, and productivity through real-time locating systems and other technologies. Federal Agencies’ Guidance While business use of AI can involve great benefits, federal agencies seek to reduce potential negative consequences by issuing guidance, requesting information, and devising plans for AI in the workplace in the following ways: On January 26, 2022, the federal Occupational Safety and Health Administration (OSHA) issued a trade release announcing an update and expansion of a chapter in the OSHA Technical Manual on Industrial Robot Systems and Industrial Robot System Safety. The update notes that advances in AI boost the abilities and uses of robot systems in industrial applications. The revisions add current “technical information on the hazards associated with industrial and emergent robot applications, safety considerations for employers and workers, and risk assessments and risk reduction measures.” On May 12, 2022, the EEOC issued its guidance on AI “discuss[ing] how existing ADA requirements may apply to the use of [AI] in employment-related decision making and offers promising practices for employers to help with ADA compliance when using AI decision making tools.” The same day, on May 12, 2022, the Department of Justice issued guidance that “outlines issues that employers should consider to ensure that the use of software tools in employment does not disadvantage workers or applicants with disabilities in ways that violate the ADA.” On October 31, 2022, the National Labor Relations Board (NLRB) General Counsel issued a memorandum recommending that the NLRB “apply the Act to protect employees, to the greatest extent possible, from intrusive or abusive electronic monitoring and automated management practices that would have a tendency to” interfere with protected concerted activity. On January 10, 2023, the EEOC issued a draft strategic enforcement plan which announced that the agency would focus “on employment decisions, practices, or policies in which covered entities' use of technology contributes to discrimination based on a protected characteristic. These may include, for example, the use of software that incorporates algorithmic decision-making or machine learning, including artificial intelligence; use of automated recruitment, selection, or production and performance management tools; or other existing or emerging technological tools used in employment decisions.” On May 1, 2023, the White House Office of Science and Technology Policy (OSTP) announced that it will be releasing a public request for information (RFI) “to learn more about the automated tools used by employers to surveil, monitor, evaluate, and manage workers.” The OSTP states that responses to the RFI “will be used to inform new policy responses, share relevant research, data, and findings with the public, and amplify best practices among employers, worker organizations, technology vendors, developers, and others in civil society.” On May 18, 2023, the EEOC issued its guidance explaining the application of Title VII to an employer’s use of automated systems, including AI, noting that the scope of the guidance “is limited to the assessment of whether an employer’s ‘selection procedures’—the procedures it uses to make employment decisions such as hiring, promotion, and firing—have a disproportionately large negative effect on a basis that is prohibited by Title VII.” Employers should expect to see more federal guidance on AI as technologies continue to develop. What Employers Can Do to Stay in the AI Race With federal agencies’ guidance in mind and an expectation of more regulation to come, employers should take proactive steps to ensure the use of AI in the workplace keeps pace with developing law. These steps include: Understanding that AI in the workplace is governed by several different laws, including privacy laws, data security laws, and anti-discrimination laws at the state and federal levels. Considering including references to the use of AI in the recruiting, hiring, and employment process in employment policies and notices. Partnering with HR, IT, and legal counsel to ensure that AI practices remain competitive while compliant with local and federal law. The idea that AI can create several benefits in the workplace seems to be gaining traction. Federal guidance issued in 2022 and 2023 signal that regulation of AI in the workplace will strive to keep up with the strides made in technological advances. Employers and HR can stay ahead of the curve by keeping abreast of, and following, regulations applicable to their company.   A version of this article was published on Dorsey's Employment blog, Quirky Questions. EEOC, Other Federal Agencies Set the Pace for Employers Using AI in the Workplace | Quirky Questions (quirkyemploymentquestions.com)

This spring, Utah legislators gave parents new legal tools to control use of social media by children and teens, including introducing a private right of action with statutory damages. To comply, social media companies will need to fundamentally redesign their systems by March 1, 2024, unless they fit within one of the laws’ exceptions. Tech-savvy kids will surely attempt to defeat or work around the new restrictions. Utah Governor Spencer Cox signed into law two sweeping bills designed to restrict minors’ usage of social media in Utah on March 23, 2023. Senate Bill 1521 and House Bill 3112 are the first laws of their kind in the United States. The Utah Social Media Regulation Act, SB 152, requires certain social media companies to, among other things, verify the age of all current and future users, limit the hours of access for minors, and obtain parental or guardian consent when users under the age of 18 seek to open an account or use an existing account on their platforms. Failures can expose companies to regulatory enforcement and lawsuits by users seeking statutory damages. Concurrently, Utah HB 311 prohibits social media companies from using any practice, design, or feature on the company's social media platform that causes a Utah minor account holder to have an addiction to the social media platform.3 Following Utah’s enactment of its new laws, Arkansas followed suit with its Social Media Safety Act, signed by Arkansas’ governor on April 11, 2023, which also requires age verification of social media users, requires parental consent for use by minors, and enables a private right of action with statutory damages.4 Background Lawmakers have long sought to protect children online. Since the passage of the Children’s Online Privacy Protection Act (“COPPA”) in 1998, the Federal Trade Commission (“FTC”) and state attorneys general have brought multimillion dollar actions against the likes of Google and YouTube5 for illegally collecting personal information from children without their parents’ consent. Most recently, the FTC finalized an order requiring Epic Games, the maker of the video game Fortnite6 (which has been popular among teens and preteens), to pay $245 million for tricking players into making unwanted purchases by using “dark patterns.” The FTC alleged in the case that Epic’s confusing and counterintuitive design made it easy for children to make one-click, in-game purchases without requiring any parental consent. Nevertheless, the new Utah bills are the first state laws aimed at specifically regulating minors’ access to social media platforms (although they conceptually overlap somewhat with California’s Age-Appropriate Design Code). Utah lawmakers say that the bills are required to combat the negative effects of social media on youth mental health.7 To comply, social media companies will likely need to make sweeping changes to the operations of, access to, and advertising on their respective platforms if they seek to remain operational within the state. Scope Utah SB 152 and HB 311 apply to “Social Media Companies,” which are defined as a person or entity that: provides a social media platform that has at least 5,000,000 account holders worldwide; and is an interactive computer service.8 A “Social Media Platform” under the new law is defined as an online forum that a Social Media Company makes available for an account holder to: create a profile; upload posts; view the posts of other account holders; and interact with other account holders or users.9 Certain online services, websites, and applications such as email providers, e-commerce, and streaming services, among others, that meet defined exceptions are excluded from the bills.10 Even if initially excluded, companies will want to regularly re-evaluate whether they are within scope if minor users begin to use their platforms for new purposes. Requirements To comply with SB 152 and HB 311, which can be enforced on March 1, 2024, Social Media Companies will be required to: Verify the age of all existing or new Utah social media account holders using a government-issued ID card and, if the existing or new account holder is a minor, confirm that the minor has consent of a parent or guardian; Grant parents or guardians access to view all posts made and messages sent to and from their child’s social media account; Hide minors’ accounts from public search results and only allow minors to receive messages from accounts with which they are linked “through friending”;11 Prohibit the display of advertising as well as “targeted or suggested groups, services, products, posts, accounts, or users”12 in the minor’s account; Stop collecting or using any personal information from the posts, content, messages, text, or usage activities of the minor’s account other than information that is necessary to comply with, state or federal law (such as birth date and the parent or guardian's name); Prohibit minors from accessing their social media account during the hours of 10:30 p.m. to 6:30 a.m., unless granted by a parent or guardian; Permit parents and guardians to limit the number of hours per day the minor may use the account; and Discontinue the use of any practice, design, or feature that the social media company knows, or should reasonably know, causes Utah minor account holders to have an addiction to the social media platform. The Utah Division of Consumer Protection is tasked with drafting rules on age verification, identification, parental consent, and other aspects of the new law. Penalties SB 152 contains a private right of action through which a Utah resident may file suit against a Social Media Company for violations as of March 1, 2024. If a court finds that a violation has occurred, plaintiffs may receive: an award of reasonable attorney fees and court costs; and an amount equal to the greater of $2,500 per each incident of violation; or if the court determines that the harm is a direct consequence of the violation actual damages for financial, physical, and emotional harm incurred by the person bringing the action. HB 311 provides for additional civil penalties of: $250,000 for each practice, design, or feature shown to have caused social media addiction in minors; and $2,500 for each Utah minor account holder who is shown to have been exposed to the practice, design, or feature found to have caused the addiction or actual damages, whichever is greater. For Utah minors under the age of 16 seeking recovery of damages, the law introduces a rebuttable presumption that the alleged harm occurred and that the harm was caused “as a consequence of using or having an account on the social media company’s social media platform.” The Utah Division of Consumer Protection will also enforce the new laws and may impose administrative fines of $2,500 per violation or bring cases in Utah courts against companies that violate the new laws. With the technological development burdens of the new legal requirements, the loss of advertising revenue based on use by minors, and the potential statutory damage exposure, some social media companies may decide to ban use by those under 18 in Utah. However, even if they do so, they will still need to verify user age and will need to wait for regulations from the Utah Division of Consumer Protection on how to do so. 1 Senate Bill 152 2 House Bill 311 3 HB 311, Sec. 13-63-201(2). 4 Arkansas Act 689, SB 396. 5 Google and YouTube Will Pay Record $170 Million for Alleged Violations of Children’s Privacy Law | Federal Trade Commission (ftc.gov) 6 FTC Finalizes Order Requiring Fortnite maker Epic Games to Pay $245 Million for Tricking Users into Making Unwanted Charges | Federal Trade Commission 7 The Impact of Social Media on Teens' Mental Health | University of Utah Health | University of Utah Health 8 SB 152, Sec. 13-63-101(8). 9 SB 152, Sec. 13-63-101(9)(a). 10 SB 152, Sec. 13-63-101(9)(b). 11 SB 152, Sec. 13-63-103(1)-(2). 12 SB 152, Sec. 13-63-103(5).

A deepfake is an image or video of a person, often a celebrity, who has been digitally altered using an artificial intelligence (“AI”) application to appear to be someone else. Deepfake technology has the potential to be either a boon or a bane to celebrities. As a boon, celebrities can use deepfake technology to extend their professional opportunities. For example, Bruce Willis licensed his likeness to AI-based content creation company, Deepcake, to create a “digital twin,” which was used in a Russian telecom commercial. Even though Willis might have health issues that limit some activities, his digital twin effectively allows Willis to continue his professional career indefinitely, regardless of his health or age, and without the need for his physical presence. Deepfake technology can also be a bane to a celebrity when used to exploit their likeness without compensation or authorization, which is the alleged situation in Kyland Young v. NeoCortext, Inc., No. 2:23-cv-02496-DSF-PVC (C.D. Cal.). Defendant NeoCortext’s deepfake app, Reface, allows a user to swap their face with someone else, including a celebrity, but the celebrity has not necessarily authorized NeoCortext or the user to show or manipulate their likeness. Reface uses the likeness of former Big Brother contestant, Kyland Young, among others, without authorization. Consequently, Young filed a complaint against NeoCortext on April 3, 2023 asserting a single cause of action—violation of the California Rights of Publicity Statute (Cal. Civ. Code § 3344). Young filed the case as a putative class action on behalf of an indefinite number of other similarly situated citizens of California. California’s Right of Publicity Statute protects individuals from having their likenesses used by others, knowingly and without permission, on products or to advertise or sell goods and services. Young claims that NeoCortext has violated this statute by using his likeness, and the likeness of other celebrities, to encourage users to pay to upgrade their version of the app. The basic version of Reface is free. It includes access to the Reface “Pre-sets catalogue” which, according to Reface’s Terms of Use, is a library of images and videos to use for face swapping that may include third party content from a variety of publicly available sources, such as mybestgif.com, Google Video, and others. Young alleges that the Pre-set catalogue contains images and videos of himself and many other celebrities, often including their most famous and recognizable scenes and appearances. This suggests that in addition to rights of publicity claims like Young’s, NeoCortext might also be at risk of copyright infringement claims from whoever owns the rights to those scenes and appearances. Young alleges that when a user initially opens the app, it shows them a background video of a user swapping his face with several celebrities and well-known fictional characters. Next, the app provides the user with access to the Pre-sets catalogue, which the user can search until they find an individual they want to become. They then upload their own image or video to the app. Reface scans the user’s uploaded image or video and generates a new image or video swapping the face of the individual in the Pre-set catalogue with the face from the user’s uploaded image or video. An image generated by the free version of the app contains a prominently-displayed, irremovable watermark stating “made with reface app.” The free version of the app also has a button labeled “Watermark” that shows a picture of a water drop crossed out. Clicking that button prompts the user to upgrade to the “Pro Version” of Reface for a monthly subscription fee or a single lifetime payment, which allows the user to generate deepfakes without watermarks. Young alleges that NeoCortext commercially exploits his likeness and the likenesses of other class members to promote paid subscriptions in two ways: (1) allowing users to pay to remove watermarks which detract from the images; and (2) using watermarks as free advertising to attract new users to Reface. This case is in its very early stages and remains pending. This case is a reminder that creators and users of deepfake apps and other generative AI technology should be mindful of third party rights, especially when they exploit those rights for their own commercial benefit. An image or video is not in the public domain merely because it is available on a public website, and different rights in a work (e.g., rights of publicity and copyright) might have different owners and restrictions. Moreover, while the face swapping by apps like Reface appears to go only one way (i.e., replacing the face of an individual in the Pre-set catalogue with a face in an image uploaded by the user), creators whose apps allow face swapping in the other direction (i.e., putting a celebrity’s face onto someone else’s body), could give rise to even more issues.

On February 1, 2023, the Federal Trade Commission (FTC) filed a complaint in the U.S. District Court for the Northern District of California alleging that digital health platform GoodRx violated the FTC Act by repeatedly sharing personal health information with advertising companies and platforms, such as Facebook and Google, and failed to report the unauthorized disclosures pursuant to its Health Breach Notification Rule (16 C.F.R. § 318).  Though GoodRx maintains that it shared all health information appropriately, according to the proposed stipulated order, the digital health platform has agreed to pay a $1.5 million civil penalty.  Once the proposed order is approved by a federal court judge, the monetary penalty, as well as several non-monetary sanctions, will go into effect.  This settlement may signal the beginning of a new era of health privacy enforcement, where the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is not the only federal health privacy law for which organizations must ensure compliance. The FTC’s Health Breach Notification Rule is not new—even though the GoodRx complaint marks its first enforcement action.  The rule went into effect in September 2009 and was the subject of a 2021 FTC policy statement.  Substantively, the Health Breach Notification Rule is very similar to HIPAA’s Breach Notification Rule (45 C.F.R. §§ 164.400-414).  Pursuant to both rules, a data holder must notify the subject of any unsecured “individually identifiable health information” and the agency responsible for enforcing the applicable rule in response to a breach of such information.  Also pursuant to both rules, if a breach of unsecured personal health information involves more than 500 individuals (and, in the case of the Health Breach Notification Rule, if a breach involves exactly 500 individuals), the data holder must notify the media. The primary differentiating factor between the rules are the types of entities to which they apply.  The HIPAA Breach Notification Rule is specific in scope and only applies to Covered Entities and their Business Associates.  A Covered Entity is limited to a: (1) health plan, (2) health care clearinghouse, or (3) health care provider, who also electronically transmits health information in connection with transactions for which HHS has adopted standards.  A Business Associate is a person or entity who, on behalf of a Covered Entity, performs or assists in performance of a function or activity involving the use or disclosure of individually identifiable health information. The FTC’s Health Breach Notification Rule is broader in scope and applies to all vendors that “offer or maintain a personal health record (PHR).” A PHR is an electronic record of “individually identifiable health information,” as defined in section 1171(6) of the Social Security Act (42 U.S.C. 1320d(6)), that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual. The FTC has stated that an example PHR Vendor might be a health app that collects information from consumers and can sync with a consumer’s fitness tracker. The Health Breach Notification Rule also applies to “PHR related entities” and “third-party service providers.”  A PHR Related Entity interacts with a PHR Vendor by either offering products or services through the Vendor’s website, offering products or services through a Covered Entity’s website that offers individual’s health records, or by accessing information in a PHR or sending information to a PHR.  The FTC states that an example of a PHR Related Entity might be a company that offers a fitness tracker and sends information to health apps.  A Third Party Service Provider is an entity that provides services to a PHR Vendor in connection with the offering or maintenance of a PHR or to a PHR Related Entity in connection with a product or service offered by that entity; and accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds, uses, or discloses unsecured PHR identifiable health information as a result of such services.  The FTC states that an example of a Third Party Service Provider might be a company that provides billing, debt collection, or data storage services relating to health information for a PHR. In light of the GoodRx complaint and the FTC’s enforcement of the Health Breach Notification Rule, all entities that utilize or maintain personal health information—and especially those offering healthcare apps, connected devices, and wearables, that often do not fall under the definitions of Covered Entities and Business Associates—should evaluate the applicability of the Health Breach Notification Rule to their organization and its business practices.  Entities that fall under the definitions of PHR Vendor, PHR Related Entity, and Third Party Service Provider, should be sure to have an effective privacy and security program in place, including procedures for conducting regular risk assessments and risk management trainings to ensure proper identification of and response to a breach of personal health information.  Such entities should also review their privacy policies, both internally and externally-facing, to ensure they reflect current data-sharing practices, and should review their vendor contracts to take inventory of any permissions or restrictions on how personal health information is used and disclosed to ensure they are obtaining the necessary consent. For more information on the Health Breach Notification Rule, the FTC’s Health Privacy webpage offers a variety of resources—including a simplified explainer of the rule, compliance tips, and an interactive tool geared toward mobile health apps.

Since the emergence of the Internet, under current European Union rules, services that host user-generated or user-contributed content have enjoyed legal immunity from liability, provided they take down unlawful content once notified of it. This existing regime gave online platforms, such as search engines, social media platforms, e-commerce sites and numerous other digital services, the freedom to determine their own rules on how their services can be used and – most importantly – the freedom to decide to what extent they wished to enforce their terms and conditions and user policies.  This hands-off approach is now set to change dramatically with the introduction of new regulatory frameworks in the European Union and the United Kingdom for the operation of digital platforms designed to protect users from unlawful and unsafe content, which means significant new compliance obligations for the operators of such services. Each of the UK and the EU have recently produced new regimes for combatting online harm and protecting the safety of online users. In the EU, the Digital Services Act (DSA) has been accepted as law and will come into force in February 2023. While the UK’s parallel Online Safety Bill (OSB) is still the subject of parliamentary debate, it is also expected to become law in April 2023 and intends to make the UK the “safest place in the world to be online”. These new regimes will drastically change the way digital platforms need to regulate their services and reduce online harm to users. They consist of wide-reaching measures designed to minimize unlawful content and to protect children in particular from harm online, and will introduce a serious compliance burden on any online platform, regardless of size, provided it has more than a negligible UK or EU presence. The laws will apply to almost all social media and content sharing platforms. The overall intention of the regimes is to minimize the presentation of harmful content to users by placing a duty of care on the providers of that content. Once in force, it is hoped these will create a safer environment for internet users, but this will come at a cost of more onerous obligations for platforms that host user-generated content, and harsh penalties if they do not comply. These new regulatory frameworks will supplement, rather than replace, the existing rules that have governed content dissemination in both the UK and the EU since 2000 and which provide hosting services with immunity from liability for user-contributed content (subject to take-down obligations). Platforms will continue to enjoy legal immunity in respect of content posted by users; however, regulatory obligations will now require service providers to take proactive measures to keep their platforms lawful and safe rather than simply respond to takedown obligations initiated by others. For businesses operating online, understanding the applicability of the legislation and the obligations imposed will be very important: large fines, business suspension and even imprisonment can result. Territorial application of the legislation Importantly, the new regimes extend to businesses outside of the UK and EU. The obligations apply regardless of the place of establishment of the company running the service, instead focusing on the location of its users. The UK’s OSB will apply to services that have “links with the UK” – meaning a “significant number” of UK users – or those where the UK is a target market.  Similarly, the EU’s DSA applies insofar as a platform offers services with a “substantial connection” to the EU, and notably requires such businesses having no establishment in the EU to appoint a legal representative there (who, where necessary, would be the target of regulatory enforcement action and liable for the service provider’s failures to meet its regulatory obligations). Types of digital services covered The OSB covers search engines and any user-to-user platform, which has a wide definition, encompassing any online service that allows user-generated content to be shared between users. This will extend to any app or website that has this functionality, such as those that allow users to talk with each other through messaging, comments and forums, as well as those that host users’ images, videos and other content. This means, for example, that certain online games and storage platforms may be covered, as well as the obvious messaging and content sharing apps and sites. The only platforms exempted are those that allow solely for emails, SMS, MMS and voice calling functionality, and this exemption does not extend to over-the-top messaging apps like WhatsApp. There are also exemptions for recognized news publisher content, and for sites where the only user-to-user content posted is in the form of comments or reviews. Under the DSA, search engines and intermediary services that are simply hosting, caching or functioning as a mere conduit, have some obligations. But, similar to the UK’s OSB, the most onerous obligations under the EU legislation are placed on those services that are deemed “online platforms”, being those that host and disseminate user content such as marketplaces and social media platforms. Each of the two regulatory regimes in the UK and the EU imposes additional obligations on the largest platforms: services deemed “high risk and high reach” under the OSB will have additional duties, such as having to provide users with empowerment tools and the option to verify their identity. Under the DSA, “very large online platforms” having 45 million users or more in the EU will have additional obligations. For smaller platforms, duties are less onerous; in line with this, the OSB applies a concept of proportionality in which measures required to be taken to comply with obligations will be proportionate to the risk level, size and capacity of the service provider. Key obligations imposed The duties relate mainly to illegal content and content harmful to children, and involve conducting risk assessments, having appropriate systems and processes in place, taking action in relation to illegal or harmful content, keeping records and reporting to the regulator. Importantly, these will need to be undertaken extensively and properly, and there is a duty to publish risk assessments or transparency reports under both regimes.  Regulatory oversight will be applied to ensure the services discharge their duties in accordance with guidelines and policies to be developed in due course by the national regulators (in the UK and in EU member states). With respect to illegal content posted on platforms under the OSB, service providers will need to carry out an assessment to understand the risks of such content being presented on their platform. A large focus of the OSB is on child sexual exploitation and terrorism content, but the duties relate to any criminal offence where the victim is an individual (with a few exceptions). Platforms must take proportionate measures to mitigate and manage the risk of such content, and must have systems in place to minimize the exposure of users to illegal content, allow users to report the content and have processes ensuring it is swiftly taken down. There is also a duty to report UK-linked child sexual offences to the National Crime Agency. Under the DSA, all online platforms are obligated to remove content that is illegal in any EU Member State, suspend accounts that disseminate such illegal content, and report criminal offences. Very large online platforms need to produce an annual risk assessment and independent audit, have risk mitigation measures in place, and appoint a compliance officer for illegal content obligations. Platforms that are likely to be accessed by children have additional obligations that extend beyond strictly illegal content, and each service provider must assess whether the platform is likely to be accessed by children. Under the OSB, platforms likely to be accessed by children need to carry out a children’s risk assessment for harmful content. Obvious examples are pornographic and violent content, but this could also extend to things like cyber bullying, self-harm promotion, or content about eating disorders, as well as anything that risks causing a child psychological or physical harm. The platform must implement proportionate measures to mitigate and manage the risk of harm to children to prevent them from encountering the harmful content. These include having proper age assurance mechanisms in place. Related to this, there is a specific provision requiring services that publish pornographic content to prevent children from accessing it, again, likely through age verification measures. In the case of the DSA, platforms “accessible to minors” must have appropriate measures in place to ensure that minors have a high level of privacy, safety and security.  Specific obligations are not listed in the same way as they are in the UK Bill, so operators of services will need to assess and limit the risks their platforms pose to children. Best practices for doing this are expected to be developed over time by regulators and quite likely by the industry itself. As originally proposed, the OSB outlined duties in relation to the management and mitigation of legal but harmful content to adults. The UK government recently announced that those duties have been dropped from the bill following political controversy not only over the fact that it is a heavy obligation to monitor legal but harmful content, but also over freedom of expression concerns. By comparison, under the DSA, there is no general duty on platforms to mitigate against harmful content to adults which is not unlawful. However, very large online platforms will have a risk assessment duty requiring them at least once a year to identify, analyze and assess “systemic risks” coming from their service regarding not only the dissemination of illegal content, but also serious harm to physical and mental wellbeing and to society in general. Consequences The OSB will be overseen by the UK’s communications regulator, OFCOM, which will have a range of powers to address non-compliance, including applying to the courts for an order that a business be blocked for use in the UK in cases where urgent action is required. Such an order is temporary but can be made permanent, and can require internet service providers, search engines and app stores to block the platform or take it down. In addition, fines of up to the greater of £18 million or 10% of the business’s annual revenue can be imposed. OFCOM will also have rights of entry and inspection and can request information at any time; a failure to comply with such a request, or the deliberate withholding or destroying of information, can result in the imprisonment of a senior manager. Under the DSA, each EU Member State will designate a competent authority to ensure compliance. The national regulators will be empowered to interview operators, carry out inspections, access data, request documents and information, and carry out searches and seizures. Again, in urgent situations, restriction of access can be ordered. The regulator can order a cessation of DSA infringements, and impose fines of up to 6% of annual turnover. How to prepare Preparation for compliance with the new regulatory regimes is essential for all affected digital platforms. The DSA will come into force on 17 February 2023, with most providers needing to publish an initial statement of usage by that date but otherwise having a one-year general grace period to comply with their remaining obligations. However, those that the regulator designates as “very large online platforms” will only have four months from such designation to comply. The OSB is likely to pass in April 2023; if it is delayed further than this, under Parliament rules, the bill will need to be dropped entirely and the legislation process will have to be restarted, which is something the Government will want to avoid. To help service providers comply with the OSB, OFCOM will publish Codes of Practice within three months of the Bill becoming law that can be taken as authority for compliance purposes. In practice, compliance with the regimes will likely involve developing and/or operating automated tools and algorithms, specialty compliance staff, secondary manual review systems, age assurance processes, user control mechanisms, policies, transparency, audits and record keeping. In the meantime, it is prudent for digital service providers to assess whether the OSB and DSA apply to their business, to prepare to implement such systems and processes, and to assess and adapt their existing systems and policies relating to user-generated content for risk.

2022 has been a whirlwind year for cybersecurity, data, and privacy counsel who are navigating an expanding regulatory landscape and unique sets of legal requirements from numerous jurisdictions. This trend is likely to continue and grow more complex in the new year as additional states adopt and implement privacy laws. A growing trend across privacy legislation is requiring company websites to respond to universal opt-out mechanisms, also known as “Global Privacy Control.” If ignored, a business exposes itself to liabilities that can result in legal and financial consequences. As businesses look toward 2023, we encourage them to examine their compliance obligations in connection with universal opt-out mechanisms and if applicable, develop an implementation plan. Universal Opt-Out – The Basics For those who are unfamiliar with the term, universal opt-out is a mechanism by which consumers can exercise their right to “opt out” of a platform or technology processing their personal data for targeted advertising or of the sale of their personal data. In practice, a consumer sets their preferences in their browser or with a plug-in to “opt out” of data sharing. Once the preference is set, a signal indicating the consumer’s preference is automatically sent each time they visit a website. If required, the website operator must respond to that signal by opting the person out of targeted advertising, the sharing of their personal data, or other sharing limited by statutes and regulations. The website operator also must inform its vendors and other third parties with which the consumer’s information has been shared of the opt-out request and they must honor it as well. Current Legal Requirements The most time-sensitive legal requirements come from California. On January 1, 2023, California’s Privacy Rights Act (CPRA) will be in effect. Under the current draft implementing regulations, businesses that interact with consumers online are required to respond to opt-out preference signals as well as to offer another opt-out option. While the CCPA previously included a 30-day cure period for violations, this is no longer available come January 1. Colorado’s Privacy Act (“CoPA”) goes into effect on July 1, 2023, and contains a similar requirement to respond to universal opt-out signals by July 1, 2024. Colorado’s draft regulations anticipate that a universal opt-out could be achieved in other ways than through a browser or plug-in signal, such as through a do not sell list that website operators would be required to query. The Colorado Department of Law plans to release a list of approved universal opt-out mechanisms no later than April 1, 2024. Connecticut’s Data Privacy Act (“CTDPA”) includes a universal opt-out requirement that goes into partial effect July 1, 2023, and into full effect July 1, 2025. Other states are considering similar provisions in their data privacy legislation. While only time will tell how these regulations will play out and how companies will manage to comply with the requirements, the Sephora case highlights the ease by which a regulator can allege legal violations and the monetary and reputational consequences this can have. This past August, the California Attorney General’s office announced a settlement with Sephora, Inc. alleging, among many things, that Sephora failed to process users’ requests to opt out of the sale of their data through the Global Privacy Control. The AG’s office lauded its settlement with Sephora and AG Rob Bonta emphasized that, “I hope today’s settlement sends a strong message to businesses that are still failing to comply with California’s consumer privacy law. My office is watching, and we will hold you accountable.” Technical and Legal Challenges Currently, only certain internet browsers (DuckDuckGo, Brave, Mozilla Firefox) or a separately installed plug-in enable universal opt-out signals. Notably, Google Chrome and Apple’s Safari do not enable such signals. Without support from major browsers, the technical implementation of responding to universal opt-out signals is naturally haphazard. Without more consumers opting to opt out in this way, the business pressure on companies to conform with opt-out requirements may not be omnipresent. The regulatory pressure to conform with the rules, however, remains and cannot be ignored (see, e.g., Sephora). Consent management platforms such as OneTrust are working on helping their customers integrate universal opt-out into their existing consent management program. Effects of Consumers Opting Out and How to Plan for the World of Universal Opt-Out In the short term, consumers opting out of sharing their personal data can have immediate strategic and financial consequences for business. The growth of importance of first party data may also present new business opportunities. It is critical, therefore, to bring together key company stakeholders to best address these changes and properly prepare. No one wants to be caught off guard, and the sooner companies can bring together their legal, business, and data privacy teams to discuss these changes, the more time they will have to pivot, adapt accordingly, and strongly position themselves. As the industry navigates this “new normal,” companies can no longer rely on previous advertising and consumer data business models. This is a time to think creatively and utilize the collective knowledge of company decision makers to implement new solutions. Dorsey’s Cybersecurity, Privacy and Social Media Practice Group would be happy to assist in these discussions.

On August 30, 2022, the Hong Kong Privacy Commissioner for Personal Data (the “PCPD”) released a guidance note (the “Guidance Note”) on data security measures for information and communications technology to provide data users with recommended data security measures to facilitate their compliance with the relevant provisions under the Personal Data (Privacy) Ordinance (Cap 486 of the Laws of Hong Kong)(the “PDPO”). The PDPO was amended last year to criminalize doxxing, which we wrote about last year. According to the PCPD, in recent months, data users have been confronted with considerable challenges with respect to protection of data privacy and data security in light of the new normal consisting of hybrid modes of working and learning. In the first seven months of 2022, the PCPD received 68 data breach notifications from organizations, a quarter of which involved vulnerabilities of information and communication technology systems of data users. In light of these cybersecurity incidents, the PCPD issued the Guidance Note to provide comprehensive recommendations on best practices to strengthen data security systems in organizations, especially small and medium-sized enterprises. Background Data Protection Principle (“DPP”) 4(1) of Schedule 1 to the PDPO requires data users to take all practicable steps to ensure that personal data held by it is protected against unauthorized or accidental access, process, erasure, loss or use. In essence, it requires an organization to take into account the kind of data and the harm that could result if a data security incident occurs. The resulting harm from a data security breach depends on the volume and sensitivity of the relevant personal data and required steps to ensure security and compliance with the PDPO will need to be accordingly proportionate to the volume and degree of sensitivity. Summary of Recommended Data Security Measures To help guide organizations in their compliance efforts in protecting personal data, PCPD’s Guidance Note provides recommendations on data security measures in the following areas: Data Governance and Organizational Measures. An organization should establish clear internal policy and procedures on data governance and data security that cover areas including, among other things, roles and responsibilities of staff in maintaining systems and safeguarding data security, data security risk assessments and handling of data security incidents (such as an incident response plan and reporting mechanism). It may make reference to the IT security or cybersecurity standards and best practices set by reputable organizations and review and revise its policies and procedures periodically based on prevailing circumstances. A data user should also appoint suitable personnel specifically responsible for personal data security (such as a Chief Information Officer) and should provide sufficient training for staff members to educate and inform them of the organization’s data security policies and procedures. It may also include confidentiality obligation in its employment contracts with its staff members where appropriate. Risk Assessments. An organization is recommended to conduct risk assessments on data security for new systems and applications before launch and periodically thereafter. The PCPD also recommends SMEs to consider engaging third party specialists to conduct security risk assessments to identify relevant risks so as to address them promptly. Technical and Operational Security Measures. The Guidance Note provides a non-exhaustive list of technical and operational measures that an organization may consider putting in place to ensure data security. It should be noted that the adequacy of the security measures will depend on the circumstances and may vary on a case by case basis. Some of these measures include securing computer networks, establishing a database management system, adopting access control measures, setting up firewalls and anti-malware, protecting online applications, using encryption when transferring or storing data, preventing misuse of and filtering emails, setting up backup systems and ensuring timely destruction or anonymization of unnecessary or expired personal data. Data Processor Management. The Guidance Note recommends for organizations to properly manage data processors. Since it is common to engage contractors such as data processors for processing personal data (such as cloud and data analytics service providers), organizations should note that they may be liable for acts of its agents including data processors. As such, organizations should consider factors when engaging data processors such as competency and reliability of data processors, nature of personal data being transferred, security measures taken by data processors, protocols for reporting on data security incidents, and conducting field audits to ensure compliance with the data processing contract by data processors. Remedial Actions in the event of Data Security Incidents. DPP4(1) provides that organizations must take all practicable steps to protect the personal data they hold having regard to harm resulting from a data security incident. The Guidance Note, therefore, provides some common remedial actions organizations may take in the event of such incidents. These include: disconnecting the affected systems, changing passwords and ceasing access, changing system configurations, notifying affected individuals, reporting to PCPD and other relevant regulators, fixing the security weakness and following up on the lessons learnt. Monitoring, Evaluation and Improvement. The Guidance Notes recommends for organizations to engage an independent task force, such as an internal or external audit team, to monitor compliance with the organization’s data security policy and evaluate the effectiveness of the data security measures periodically. Other data security measures and recommendations including cloud services, ‘Bring-Your-Own-Devices’ (“BYOD”) and portable storage. As working remotely from the office has become increasingly more common, it is also common that data is transferred out from an organization’s information and communications systems. As a result, organizations may be exposed to a variety of security issues. The Guidance Note provides recommendations applicable to such circumstances and issues to consider with respect to using third-party cloud services, protecting personal data of an organization in BYOD situations and where portable storage devices are used. Conclusions The Guidance Note provides useful guidelines with specific measures that businesses should take to strengthen their data security systems and to minimize risks of data breaches which could cause reputational and financial damages. It would be a good time for businesses to review the adequacy and effectiveness of their existing data security policies and measures or putting in place one that is in line with the prevailing circumstances.

The first California Consumer Privacy Act (CCPA) settlement was announced on August 24, together with a strong message from California Attorney General Rob Bonta regarding compliance with the CCPA. The settlement involves Sephora USA, Inc., and resulted from a sweep of enforcements by the Attorney General last year. As part of the settlement, Sephora agreed to pay $1.2 million and comply with requirements related to its CCPA obligations. Prior to the AG investigation, Sephora was notified of its alleged CCPA violations but failed to cure within the 30-day period allowed under law. This failure prompted the AG to initiate the enforcement action. The definition of “sale” under the CCPA is extremely broad, and includes “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating” personal information “for monetary or other valuable consideration.” According to the complaint, Sephora made consumers’ information available to third parties in connection with targeted advertising and “analytics” services, both of which the complaint indicated constituted a “sale.” The complaint alleges further that Sephora’s vendors were not subject to appropriate “service provider” contracts necessary for the vendor’s processing to not be considered a sale for purposes of CCPA. At the time, the Sephora privacy policy stated that it did not “sell” personal information, and did not include an opt-out of sale link. Taking these issues into account, the complaint alleged that Sephora violated the CCPA by failing to: (i) display a “do not sell my personal information” link on its homepage, (ii) describe the categories of personal information sold or shared in its privacy policy, and (iii) honor opt-out requests, including through response to the Global Privacy Control (GPC), a browser plugin designed to enable consumers to automatically opt-out of data sales on numerous websites with a single setting. In addition to curing these violations, the settlement also requires Sephora to conform its service provider agreements to the CCPA’s requirements, properly configure service provider products and services, and provide reports to the California Attorney General relating to its sales of personal information, its relationships with service providers, and its ability to honor requests via GPC settings. The complaint also previewed to Sephora that the technologies it used may create additional risks for consumers’ sensitive information related to health conditions. This, by extension, could create risk of non-compliance with forthcoming CCPA requirements applicable to businesses’ processing of sensitive personal information. Companies should note that CCPA requirements are complex to implement, and the 30-day cure period may be insufficient to make all needed changes. In addition, the cure period currently allowed under the law will expire as of January 1, when the CPRA amendments to the CCPA becomes effective. It is therefore critical for companies to evaluate their CCPA compliance posture prior January 1, 2023, as the California Attorney General’s office, together with the new California Privacy Protection Agency, appear poised to increase their enforcement efforts, and may be less tolerant of non-compliance. In a press release issued together with the Sephora settlement, Attorney Rob Bonta stated: “I hope today’s settlement sends a strong message to businesses that are still failing to comply with California’s consumer privacy law. My office is watching, and we will hold you accountable. It’s been more than two years since the CCPA went into effect, and businesses’ right to avoid liability by curing their CCPA violations after they are caught is expiring. There are no more excuses.” Together with announcing the Sephora settlement, the Attorney General’s office also issued notices to a number of other businesses alleging non-compliance relating to their failure to honor opt-out requests via the GPC or similar controls. Recipients of these notices will have 30 days to cure the violations, or they will face enforcement actions. Businesses receiving such notices after January 1, 2023, however, will have no such opportunity to cure. Examples of the notices to cure sent by Bonta’s office can be found at oag.ca.gov/ccpa. There are several important lessons in the Sephora settlement. The California AG is treating GPC as a requirement, rather than an option. Although the statutory text of the CCPA does not mandate compliance with the GPC, the AG suggested this was a requirement in the 2021 amendments to the CCPA regulations, and in the CCPA FAQ page in July, 2021. Whether or not this constitutes sufficient notice and a true statutory requirement is somewhat debatable, but companies should take notice and ensure GPC compliance in order to avoid potential enforcement for non-compliance. Any doubts regarding whether third-party online behavioral advertising and profiling constitute data sales have now been removed (though such relationships are likely to fall within the scope of the CPRA’s new “sharing” opt-out requirements once the CPRA amendments take effect). Privacy policies must clearly disclose the categories of data sold, the fact that sales are taking place, and other requirements specified in the CCPA. Companies engaging in data sales must have a “do not sell” link on their homepage and in their privacy policy, with the required means to opt-out enabled. Service provider contracts must meet CCPA’s service provider contract requirements in order for the relationship to be exempt from the “sale” definition. Note that each relationship must, in fact, meet relevant service provider requirements, and language alone will not accomplish this. Similarly, service provider technologies may require additional configuration for processing to be in scope of the service provider agreement. Companies should be aware of using targeted advertising in a manner that implicitly reveals sensitive information (e.g. pregnancy or other health conditions). With the CPRA and other state laws becoming effective in the next year, companies have numerous tasks to do to prepare. For companies engaging in data sales, GPC implementation should be near the top of the to-do list, and more information is available at Global Privacy Control — Take Control Of Your Privacy

California employers have navigated the ever-changing privacy landscape when it comes to employee and personnel personal information (“human resources data”). For years, California employers’ obligations were narrow in scope compared to covered businesses’ broader obligations to consumers under the California Consumer Privacy Act (“CCPA”). The California Privacy Rights Act (the “CPRA”) expanded these obligations and set a deadline for employer compliance by January 1, 2023. Now, with two pending privacy bills on the horizon, California employers may need to meet additional obligations in 2023 and beyond. As previously shared, employers already have existing obligations under the CCPA regarding human resources data – the personal information of a job applicant, employee, owner, director, officer, medical staff member, or contractor of a covered business collected and used (1) in the context of the covered business’s relationship with the employee or personnel, (2) to maintain emergency contact information on file, or (3) to administer benefits. Under the CCPA, California employers must provide a notice to employees and personnel describing the categories of human resources data to be collected and the purposes for which the categories shall be used. By the time the CPRA goes into effect on January 1, 2023, California employers will need to have revised the notice to meet three broader obligations. First, the notice must disclose whether the employer sold the human resources data. California employers should keep in mind that CPRA broadly defines “sale” – if a California employer receives monetary or “other valuable consideration” for “selling, renting, disclosing, disseminating, making available, or otherwise communicating” human resources to a third party, the notice must disclose this as action as a sale. Second, the notice must describe the retention period that applies to the human resources data. California employers can meet this obligation by describing either (a) “the length of time the business intends to retain each category of personal information, including sensitive personal information,” or (b) “the criteria used to determine that period” provided that the human resources data is not retained for longer than is necessary for the disclosed purpose. Third, the notice must disclose categories of “sensitive personal information” as a separate category if the information is collected or processed with “the purpose of inferring characteristics” about the employee or personnel. “Sensitive personal data” includes, among other things, a Social Security, driver’s license, state identification card, or passport number; an account log-in, financial account, debit card, or credit card number in combination with credentials needed for access to the account or cards; precise geolocation; racial or ethnic origin, religious or philosophical beliefs, or union membership; mail, email, or text messages contents unless the business is the intended recipient; and, genetic data (this would likely mean that the notice should disclose that certain sensitive personal information is submitted to the Department of Fair Employment and Housing should Senate Bill 1162 pass). California employers can meet the broader CPRA obligations by January 1, 2023 by taking steps now. Aside from broadened obligations under the CCPA and the CPRA, California employers may need to account for two privacy bills when collecting and processing human resources data should the bills become law. Assembly Bill 1651 (“AB 1651”), coined as the “Workplace Technology Accountability Act,” seeks to build upon the CCPA and CPRA regarding human resources data. Introduced by Assembly Member Ash Kalra, AB 1651 seeks to “impose various duties on employers and their vendors regarding the ability to collect and use worker data, as defined.” The proposed definition of “worker data” includes “any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular worker.” “Worker data” includes some categories of data already covered by the CCPA and CPRA, such as biometric information, but also includes “human resources information” such as a personnel file or performance evaluation. Like the CCPA and CPRA, AB 1651 would require California employers to provide a notice “at or before the point of collection” that informs workers about the specific categories of worker data to be collected, the specific purpose for which the specific categories of worker data are collected or used, and whether and how the data is related to the worker’s essential job functions. However, the AB 1651 enlarges the CCPA and CPRA by generally prohibiting “audio-visual monitoring of a workplace in a worker’s residence, a worker’s personal vehicle, or property owned or leased by a worker” unless that audio-visual monitoring is strictly necessary to accomplish compelling purposes. The bill also generally prohibits electronic monitoring systems that incorporate facial recognition, gait, or emotion recognition technology. AB 1651 further requires employers or vendors to submit to the labor agency a summary of its uses of algorithms, also referred to as “automated decision systems,” and to complete an algorithmic impact assessment before using the system to make or assist an employment-related decision. The bill has been met with criticism from several groups, including the California Chamber of Commerce. AB 1651 was referred to the California State Assembly Committee on Privacy and Consumer Protection last month, but was later withdrawn from consideration prior to a hearing in the Assembly’s Committee on Labor and Employment. The bill currently sits with the Committee on Privacy and Consumer Protection. California employers may have additional obligations under Senate Bill 1189 (“SB 1189”), which also seeks to build upon the CPRA by further refining obligations for biometric information. Introduced by Senator Bob Wieckowski, SB 1189 seeks to require private entities in possession of biometric information, as defined, to develop and make available to the public a written policy. The proposed definition of “biometric information” includes a “faceprint, fingerprint, voiceprint, retina or iris image, or any other biological characteristic that can be used to authenticate the individual’s identity.” Human biological samples used for valid scientific testing or screening and information captured by a health care provider under the federal Health Insurance Portability and Accountability Act are not covered by the proposed bill. Similar to the CPRA, SB 1189 would require California employers to develop a retention schedule and guidelines for destroying biometric information by earliest of (a) the date on which the initial purpose for collecting or obtaining the biometric information is satisfied; (b) one year after the individual’s last intentional interaction with the private entity; or (c) within 30 days after the private entity receives a verified request to delete the biometric information submitted by the individual or the individual’s representative. Should the bill pass, California employers would need to develop this policy by September 1, 2023. SB 1189 was referred to California Senate Appropriations Committee last month. At the May 19, 2022 Appropriations Hearing, the bill was taken under submission. Will California employers have more obligations beyond the CCPA and CPRA if AB 1651 and SB 1189 pass? Yes. In addition to supplementing the CCPA/CPRA required notice, California employers will need to expand the notice to include worker data as defined by AB 1651 and to assess workplace monitoring systems and any use of algorithms. California employers will also need to revise retention schedules to set clear guidelines for destroying biometric information. For now, California employers will need to wait and see if these bills become law. In the meantime, the CCPA/CPRA-required notices should be revised in preparation for January 1, 2023. Additionally, other states have introduced similar legislation. National employers should monitor pending legislation in Minnesota, New York, Washington, and Virginia.

Get ready, large employers. After years of amendments exempting the personal information of employees and other personnel from the California Consumer Privacy Act (“CCPA”), covered employers now have a firm deadline by which to comply with the CCPA’s requirements in protecting employee and personnel personal information (“human resources data”). The deadline – January 1, 2023 – may appear far off, but certain provisions trigger obligations for 2022. Below are the steps large employers should take to comply with the CCPA. Step 1: Be familiar with the rights afforded to consumers under the CCPA. The CCPA was enacted on June 28, 2018, creating one of the most comprehensive frameworks for regulating digital privacy in the United Sates. The law currently grants California consumers the right to know what personal information is collected, used and processed by covered businesses; the right to access the personal information; the right to request that covered businesses delete the personal information; the right to know whether and to whom the personal information is sold or disclosed; the right to opt out of the sale of personal information; and, the right to the same quality of service as that provided to consumers who do not opt out. The CCPA’s effective date was January 1, 2020. Step 2: Determine if the CCPA applies to the employers’ business. The CCPA applies to for-profit companies that do business in California that either have an annual gross revenue of over $25 million; buy, sell, receive, or share the personal information of at least 50,000 California residents, households, or devices for commercial purposes; or derives at least fifty percent of their annual revenue from selling California residents’ personal information (“large employers”). Step 3: Understand the extent of the CCPA’s current “employee” exemption. Human resources data is largely exempt from the CCPA for the time being. Under the CCPA’s current “employee” exemption, the personal information of a job applicant, employee, owner, director, officer, medical staff member, or contractor of a covered business are exempt from the CCPA as long as the covered business collects and uses the personal information (1) in the context of the covered business’s relationship with the employee or personnel, (2) to maintain emergency contact information on file, or (3) to administer benefits. Despite the employee exemption, employers should understand that there are existing obligations concerning human resources data. The CCPA requires employers to safeguard human resources data and to provide a notice to employees and personnel regarding the human resources data collected by the employer and how the information is used. Although no model notice has been provided under the CCPA, the notice must describe “the categories of personal information to be collected and the purposes for which the categories of personal information shall be used.” The CCPA privacy notice must be given to employees “at or before the point of collection” and provide a copy of, or link to, the employer’s privacy policy. Employers should also know that California residents can seek to recover statutory damages for certain data breaches, including those involving human resources data. Step 4: Understand the new obligations for human resource data under the CCPA. Human resources data was exempt from the CCPA’s requirements until January 1, 2021. With the approval of Assembly Bill 1281 on September 29, 2020, the January 1, 2021 deadline was extended to January 1, 2022. California voters approved the California Privacy Rights Act (the “CPRA”) on November 3, 2020, which amended the CCPA and extended the employee exemption to January 1, 2023, the effective date of the CPRA. The extra year is helpful for large employers, as the CPRA expands consumers’ rights. In addition to the CCPA rights, the CPRA grants California consumers the right to correct personal information; the right to limit the use and disclosure of sensitive personal information; and, the right to opt out of the sharing of personal information. Additionally, the CPRA has a 12-month “look-back” provision, meaning that employers should be tracking their collection, use, and disclosure of human resources data up to twelve months before the January 1, 2023 effective date. Thus, employers should be prepared to provide information going back to January 1, 2022. Enforcement of these additional rights lies with the ability of employees and personnel to seek to assert a private right of action for data breaches. The CPRA adds an additional enforcement mechanism by establishing the California Privacy Protection Agency, which administratively enforces the CCPA as amended by the CPRA. Step 5: Create an action plan to comply with the CCPA as amended by the CPRA. Although the January 1, 2023 deadline seems far away, large employers should take steps to ensure compliance with the CCPA and CPRA concerning human resources data. These steps include: engaging in data mapping of human resources data; continuing to provide CCPA privacy notices to employees and personnel; ensuring the accuracy of privacy policies; evaluating physical, technical, and administrative safeguards concerning human resources data (which includes evaluating contracts with vendors such as payroll providers and benefit administrators); and implementing a plan to ensure the tracking of human resources data from January 1, 2022 and onwards. These five steps provide a great starting point in working towards CCPA/CPRA compliance. Large employers should take advantage of the extra year granted under the CPRA to develop and implement California-compliant programs so that by January 1, 2023, employers can provide information about the collection, use, and disclosure of human resources data.   * A version of this blog post was originally published in the Orange County Business Journal on November 15, 2021.

On October 8, 2021, the Personal Data (Privacy) (Amendment) Ordinance 2021 containing initiatives to combat doxxing acts became effective in Hong Kong. The anti-doxxing regime under the Amendment not only defines broad and encompassing offences coupled with hefty penalties but also confers new investigative and enforcement powers to the Privacy Commissioner that have extra-territorial effect. Platform providers, operators or users should adopt appropriate approaches to potentially doxxing messages and ensure compliance with the Amendment. Doxxing as an Offence “Doxxing” (sometimes spelled “doxing”) is a term used for the cyberbullying technique of gathering the personal data of a target person or related person(s) (such as family members, relatives or friends) through online search engines, social platforms, discussion forums, public registers, and other means, and disclosing such personal data on the internet, social media or other public platforms. This practice has become rampant in Hong Kong in recent years, and includes numerous cases of illicit disclosures including that of patient medical records from hospitals, as well as disclosure of personal data of police and judicial officers and their family members without their consent. Between June 2019 and 2021, the Privacy Commissioner handled over 5,800 doxxing complaint cases intrusive to personal data privacy. During that time, only about 70% of requests to online platforms by the Privacy Commissioner for removal of doxxing content were complied with. This created a need to amend the existing regime and to criminalize acts of non-consensual disclosure of personal data in order to protect the personal data privacy of the general public. Under the Amendment, section 64 of the Ordinance was revised to provide a new two-tier doxxing offences which criminalize the disclosure of personal data where the data was disclosed without consent of the data subject, and with an intent to cause specified harm to the data subject or their family, or being reckless to such harm happening. The definition of specified harm is broad and captures (i) harassment, molestation, pestering, threat or intimidation, (ii) bodily harm or psychological harm to a person, (iii) harm causing a person to be concerned for their safety or well-being, or (iv) damage to a person’s property. The penalty for such summary offence is a fine of HK$100,000 and up to two years’ imprisonment. An indictable offence is committed if a specified harm is caused to the data subject or a family member of the data subject due to the disclosure of personal data. The penalty for such indictable offence is a fine of up to HK$1,000,000 and up to five years’ imprisonment. The Commissioner’s Powers and its Extra-Territorial Effect The Privacy Commissioner is also conferred with new investigation and enforcement powers, including powers to request a person to provide materials and assistance to facilitate investigation into doxxing offences, to obtain search warrants, carry out specified investigation in premises and to seize and detain any evidence for purposes of the investigation. The Privacy Commissioner may also arrest, stop and search any person reasonably suspected of having committed doxxing offences, and may apply to the Hong Kong Court of First Instance for an injunction against a person who engaged, is engaging or is likely to engage in conduct which contravenes the doxxing offences. The Privacy Commissioner may serve a notice in the case of doxxing if the data subject is a Hong Kong resident or is present in Hong Kong regardless of whether the disclosure was made in Hong Kong. Cessation notices may also be served inside or outside of Hong Kong depending on whether the doxxer or the service provider is inside or outside of Hong Kong. The Amendment Ordinance equips the Privacy Commissioner with the flexibility necessary to take appropriate action given the global reach and vast nature of the internet. Any doxxer or service provider served with a cessation notice that either fails to comply or establish an appropriate defence may commit a criminal offence and be subject to penalties or imprisonment.   To read the original publication regarding this Amendment, please click here.

Certain Colorado companies and others targeting Coloradans will soon be subject to the newly enacted Colorado Privacy Act (“CPA”), signed into law by Gov. Jared Polis on July 8, 2021. Colorado joins California and Virginia as the third state to enact its own comprehensive consumer data privacy legislation. Who must comply with the new CPA rules? Starting on July 31, 2023, businesses will be subject to the CPA if they are located in Colorado or intentionally target Colorado consumers, and either: (1) control or process personal data of more than 100,000 Colorado consumers per calendar year; or (2) derive revenue from the sale of personal data and control or processes the personal data of at least 25,000 Colorado consumers, unless they meet one of several exemptions. The law applies directly to both “controllers” and “processors,” meaning that the law may apply directly to some out of state service providers that agree to handle data subject to the CPA. However, the CPA does include broad exemptions for companies and data that are subject to specific state and federal laws, such as HIPAA, GLBA, the FCRA, COPPA, and FERPA, as well as data processed in connection with employment and in business-to-business contexts. To what data does the CPA apply? The CPA applies to “personal data,” which is defined broadly as information that is linked or reasonably linkable to an identified or identifiable individual. As with other recent privacy laws, there are also specific requirements for sensitive data, such as data relating to biometrics, race, ethnic origin, religious beliefs, mental/physical health, sex life/sexual orientation, or citizenship status. The law exempts from its requirements data that is de-identified, and defines specific criteria that must be met in order for data to be considered de-identified. Uniquely, the CPA also has specific requirements relating to the handling of ‘pseudonymized’ data, which was sometimes unclear under other state privacy laws. The CPA also exempts certain publicly available data that has either been made available through government records, or that the consumer made available to the public. What rights does the CPA give consumers? Although the CPA does provide consumers with many of the same rights available under the California and Virginia privacy laws, there are some important differences, which will require the implementation of new procedures. Colorado’s consumer rights fall into five main categories, described below. As in other states, these rights may be enforced by the individual directly, or through an agent: 1. Opt out. Consumers can opt out of the processing of their personal data for purposes of: a. targeted advertising; b. the sale of personal data (defined broadly to include most exchanges of personal data for monetary gain or other valuable consideration), or c. profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer. 2. Access rights. Consumers may obtain a copy of  personal data and confirm if a company is using or otherwise processing their data. 3. Correction. Consumers can correct inaccuracies in their personal data. 4. Deletion. Consumers may request the deletion of their personal data. 5. Portability. Consumers have the right to obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format. What are companies’ duties and obligations? The CPA’s requirements are broadly similar to the rights under CCPA/CPRA, and GDPR. Generally, the CPA includes the following core requirements: Transparency. Provide a transparent, clear, and meaningful privacy notice to ensure that it is easy to understand, meaningful to consumers, and in compliance with the CPA. Purpose Specification. Limit processing to what is necessary and appropriate for the specified purpose. Minimization. Only collect data that is adequate, relevant, and limited to what is necessary for the specified purpose. Consent to Secondary Use. Avoid using personal data beyond what was disclosed to the customer, except with prior consent. Care. Implement reasonable measures to protect against unauthorized acquisition. Nondiscrimination. Duty not to unlawfully discriminate. Impact Assessments. Companies must conduct data protection assessments prior to engaging in targeted advertising, profiling, and when processing presents high risks to consumers. Vendor Management. Companies must enter into data processing contracts with subcontractors, requiring them to protect personal data, assist in data rights compliance, and process personal data only for specified purposes. How could this impact my business? If your company is subject to the CPA, you must be sure that you understand all of the personal data collected or otherwise processed by your company, where it is throughout its lifecycle, who has access to it for what purpose, and which vendors may interact with the data. You may need to implement new procedures to respond to consumer data rights requests (typically within 45 days). Companies will likely need to update their privacy notices, as well as their contracts with service providers and others, and implement opt-out mechanisms and related notices, as needed. Companies who run afoul of the CPA may be fined up to $20,000 per violation. Who can enforce this new law? The CPA does not allow for a private right of action. Only the Colorado Attorney General and District Attorneys may bring enforcement actions. Additionally, the CPA authorizes the attorney general to promulgate rules relating to certain aspects of the CPA. Giving a nod to how difficult a pivot to compliance may be in Colorado, companies will have a 60-day time period to cure a violation of the CPA until January 1, 2025. However, the cure period expires on January 1, 2025.

The impact of COVID-19 restrictions and precautions, combined with trending consumer preferences to shop online, is fueling bankruptcy filings of well-known brick-and-mortar brands. As customers bid farewell to fond strip mall haunts, savvy and imaginative purchasers reap the benefits by snapping up household names like RadioShack, Pier 1 Imports, and Toys “R” Us. The retail market is poised for a restructuring of its own kind—a shift of major brand names into exclusively ecommerce businesses. General Wireless Operations, Inc. dba RadioShack, Inc., which emerged from a bankruptcy in 2018, is a recent example. In November, Retail Ecommerce Ventures (“REV”) purchased the rights to use RadioShack’s brand, private label names, and website in the U.S. and certain other countries. REV has earned a reputation for acquiring distressed retail brands, like Pier 1 Imports, dressbarn, Modell’s Sporting Goods, and Linens ’n Things. Transformations from bankrupt brick-and-mortar to .com are often accomplished through the acquisition of a debtor retailer’s intellectual property from its bankruptcy estate. For instance: Last week, REV won a bankruptcy auction for the intellectual property, domain names, social media accounts, and other assets of Stein Mart with a $6 million bid. It announced plans to relaunch Stein Mart as online-only. Last year, Marquee Brands, purchased the ecommerce business, intellectual property, and other assets of Destination Maternity Corp., which includes the brands Motherhood Maternity and A Pea In The Pod, from Destination Maternity’s chapter 11 estate. Marquee partnered with liquidation specialists Gordon Brothers and Hilco Merchant Resources, on the winning $50 million bid, which included the rights to operate store-closing sales for all remaining physical locations. In 2018, lenders of Toys “R” Us acquired the intellectual property and other assets of the famed toy retailer after the assets were marketed in a bankruptcy sale process. With the exception of two shopping mall locations, Toys “R” Us now operates entirely online. In August, Hong Kong-based Newtimes Group purchased the assets of women’s clothing retailer and former bankruptcy debtor Coldwater Creek from the estate created by an assignment for the benefit of creditors. So-called “ABCs” are a state-law governed alternative to federal bankruptcy options. The Newtimes Group purchase agreement allocated over 93% of the $12.2 million purchase price toward intellectual property, with the remainder allocated toward inventory. As these sales illustrate, an insolvent, big-name retailer’s most prized asset is often its brand. Trademark-protected names, logos, patents, copyrights, trade secrets, and data have become more significant with the rise of ecommerce. The upside for purchasers who shell out millions for intellectual property and related assets includes generating income through licensing and royalty transactions, without the overhead associated with brick-and-mortar stores. Assets obtained through bankruptcy and other distress-type sales are often discounted, adding to the appeal of “brand shopping” for investors. Advantages specific to bankruptcy sales include the ability to acquire assets free and clear of most liabilities, the ability of the debtor to assign executory contracts (i.e., contracts where the parties have performance still outstanding) to a purchaser, a relatively quick sale process, and the protection of a federal bankruptcy court order. The sale process typically transpires in accordance with court-approved sale procedures, which contemplate marketing of the assets, a bid process, an auction, and approval of the sale through an order after a hearing, all with related deadlines. The bankruptcy court often approves sales of assets free and clear of liens, claims, and other encumbrances, provided that applicable non-bankruptcy laws permit such sales. The court’s order operates as an injunction that bars the debtor’s creditors from bringing claims against the purchaser. Bankruptcy debtors have the power to determine whether they will continue to perform and “assume” or refuse to perform and “reject” executory contracts. Assumed contracts can be assigned to third parties, even if—with some exceptions—those contracts contain non-assignability clauses. A debtor-seller’s assignment of assumed, favorable contracts to a purchaser facilitates the immediate continuation of operations and beneficial relationships upon closing of the sale. Conversely, bankruptcy debtor can reject an executory contract, which functions as a breach and leaves the counterparty with a claim it can file against the bankruptcy estate for damages arising from the breach. Notably, under the Bankruptcy Code and case law, most intellectual property licensees may continue using licensed IP for the duration of their license agreements, regardless of a debtor licensor’s rejection of the agreement. Prospective purchasers interested in capitalizing on brand sales in the wake of an online shopping surge, or otherwise considering purchasing assets from a distressed company or bankruptcy estate, should seek qualified counsel to navigate the sale process and negotiate and execute on their bids.

In a dramatic and widely reported decision of 12 July 2020 in the case known as Schrems II (Data Protection Commissioner v Facebook Ireland Ltd), the Court of Justice of the European Union (“CJEU”) invalidated the decision of the EU Commission that gave legal effect in the EU to the EU-US Privacy Shield scheme. In other words, personal data transfers from the EU to the US can no longer be lawfully undertaken in reliance on the scheme. Intelligence services surveillance powers and the privacy of EU citizens The decision follows a previous judgment of the same court in the same case from October 2015 (known as Schrems I) in which the Safe Harbor scheme, a predecessor of the EU-US Privacy Shield, was also invalidated by the Court. Both decisions proceeded on the same basis, that is, that electronic surveillance programs operated by the US intelligence services under US legislation and under Presidential Executive Orders do not provide legal redress (or at least do not provide sufficient legal redress) to EU citizens whose data may be accessed unlawfully. Therefore, it was held, the schemes, which were designed to allow the free flow of personal data between the EU and the US for participating organisations, did not meet the requirements under EU law to ensure that data subjects have equivalent legal protection to their privacy rights in the US as they have in the EU. In part, the finding of insufficient judicial redress is based on the Court’s conclusion that the constitutional protection provided in the US Constitution under the 4th Amendment (in relation to unlawful searches and seizures) is effectively only available to US individuals, whereas an EU citizen (or resident) is unlikely to have standing in a US court. Further, some of the surveillance programs are based on Executive Order 12333, which provides no judicial redress at all. So, can data still be transferred lawfully to the US? The decision of the CJEU raises many interesting questions but it is now a political matter for the EU and the US to resolve. In the meantime, the practical question for enterprises and institutions that rely on the flow of personal data from the EU to the US (and indeed to other countries) is how to ensure that such data flows are not disrupted. Most companies and organisations do not rely on the EU-US Privacy Shield, as the likelihood of its invalidation by the CJEU has been long anticipated. Many rely instead on the “Standard Contractual Clauses” (“SCCs”) that have been approved by the EU Commission in a series of decisions as a lawful basis for transferring personal data to countries outside the EU. The Court in Schrems II rejected a challenge to the validity of the EU Commission’s decisions adopting the SCCs. However, it does not follow from the decision by any means that the transfer of personal data in reliance on the SCCs remains lawful. In fact, the decision throws serious doubts on that question. The implications of the CJEU’s decision in respect of the use of SCCs are very uncertain. What is clear is that it is the responsibility of the parties to the data transfer (the data controller who transfers the data from the EU and the party that receives the data outside the EU under the terms of the SCCs), and the responsibility of national privacy regulators in the EU member state from where the data is transferred, to ensure that the SCCs provide adequate protection to the privacy rights of the data subjects. It is also clear from the Court’s decision that to ensure adequate protection, the SCCs (together with any additional safeguards that may be put in place) must guarantee that the level of protection that data subjects have in relation to the use of their personal data outside the EU must be equivalent to the protection they enjoy under EU law. The Court made the point very clearly that the SCCs – which naturally do not bind national intelligence authorities in the US – cannot guarantee that personal data that is transferred to the US will not be subjected to surveillance powers without adequate judicial redress to EU data subjects. However, the Court did not say that this means that the SCCs necessarily cannot provide a lawful basis for transferring data to the US. In what circumstances the SCCs can still provide the lawful basis for data transfers and what other “safeguards” can be put in place to ensure that data subjects enjoy an equivalent level of protection for the privacy rights are questions that were left unanswered by the Court. What is the risk and what can be done about it? The current position as a result of the decision in Schrems II is rather extraordinary. EU legislation authorised the EU Commission to adopt the SCCs as a framework for lawfully transferring personal data to countries outside the EU that do not provide an adequate level of protection to privacy rights. The CJEU has determined that the decisions of the EU Commission adopting the SCCs were valid. However, at the same time, the Court held that the transfer of data in reliance on the SCCs may still be unlawful, and it is down to the parties to the transfer (and to national authorities) to determine whether the conditions are met for ensuring the transfer is lawful. For any company based in the EU this is a highly unsatisfactory position. An organisation may have to make the difficult choice between suspending all data transfers to the US (and to other countries where national authorities may have surveillance powers without giving EU citizens sufficient legal redress), which could have serious economic consequences, or taking the risk that continuing such transfers might be held unlawful. The organisation could be open to regulatory action, investigations and legal claims by data subjects and regulators and it could risk significant potential penalties, injunctions and damages claims by data subjects. Organisations that rely on data transfers between the EU and the US will have to develop strategies to avoid or minimise the risk. Some may take the view that as long as national authorities in the relevant member state do not adopt a decision (in general or in specific cases) holding that the transfer of data in reliance of the SCCs is unlawful, it is reasonable to continue to rely on the SCCs. After all, they are based on valid decisions of the EU Commission. It should be noted in this regard that it has been reported that some national regulators (including in Germany and Ireland) have already expressed the view that data transfers to the US under the SCCs should probably no longer be treated as lawful given the rationale of the decision of the CJEA. A more cautious approach may require carrying out a risk assessment and putting in place additional safeguards to the SCCs. The CJEU did not indicate what these safeguards might be. It only pointed to the fact that the relevant provisions of GDPR make reference to such “appropriate safeguards”. Until some guidance emerges, it is for each organisation in each case to consider what additional measures can be put in place, given the circumstances and the assessment of the risk of the transfer in each specific case. Such safeguards can include, for example, encryption and anonymisation of data, introducing additional contractual provisions, procedures and warranties or additional diligence that would at least minimise the risks of data being exposed to surveillance by national intelligence authorities. Finally, organisations can seek to rely on a set of derogations under the GDPR to the rule that restricts the transfer of personal data to countries outside the EU. These derogations include, among others, transfers made with the explicit consent of the data subject, transfers that are required for the performance of contractual obligations and transfers required for the establishment, exercise or defence of legal claims. For many good reasons, organisations historically tended not to rely on those derogations as a sole basis for international transfers of data. Following Schrems II, however, the SCCs can no longer be considered an entirely safe legal route and so in appropriate circumstances it may be better to rely on those derogation.