Conceptual image about how a laptop computer with internet open a virtual door to worldwide information sharing.Keypoint: Maryland lawmakers have introduced a bill that would allow Maryland residents to opt-out of certain types of personal information transfers but that would stop far short of creating CCPA-like rights for Maryland residents.

On January 17, 2020, Maryland House Delegates Courtney Watson and Ned Carey introduced HB0249. If enacted in its current form, the bill would allow Maryland residents to opt-out of certain types of transfers of their personal information to third parties. However, it would not create other CCPA-like privacy rights such as the right to deletion and would not require businesses to make disclosures regarding their privacy practices.

Maryland joins a growing list of states considering consumer privacy legislation, including Florida, Illinois, Virginia, Washington state, Nebraska, New Jersey, New Hampshire, and Hawaii. Members of Husch Blackwell’s privacy and data security practice group will be hosting a webinar on February 4 at noon CST to discuss these proposed laws and to provide an update on the CCPA. To register, click here.

Below is our analysis of the Maryland legislation (as introduced).

Continue Reading Analyzing the 2020 Maryland Right to Opt Out of Third-Party Disclosures Act

Conceptual image about how a laptop computer with internet open a virtual door to worldwide information sharing.Keypoint: The Virginia Privacy Act would create CCPA-like rights for Virginia residents while the Sale of Personal Data Act would create rights vis-à-vis “data sellers.”

Lawmakers in Virginia have proposed two bills that, if enacted, would create a number of privacy rights for Virginia residents and compliance burdens for covered entities.

The first bill – the Virginia Privacy Act (HB 473) – was prefiled on January 3, 2020, and offered on January 8, 2020. It would create CCPA-like rights for Virginia residents and new obligations on businesses such as a requirement to conduct risk assessments.

The second bill – which is unnamed but for our purposes will be referred to as the Sale of Personal Data Act (SB 641) – was prefiled on January 7, 2020, and offered on January 8, 2020. Among other things, it would require data sellers to implement reasonable security measures to protect personal data, respond to certain types of privacy requests, and notify Virginia residents of data breaches.

In addition to Virginia, lawmakers have proposed consumer privacy legislation in Florida, Illinois, Washington state, Nebraska, New Jersey, New Hampshire, and Hawaii. Members of Husch Blackwell’s privacy and data security practice group will be hosting a webinar on February 4 at noon CST to discuss these proposed laws and to provide an update on the CCPA. To register, click here.

Below is our analysis of Virginia’s proposed legislation (as introduced). We will first analyze the Virginia Privacy Act and then separately analyze the Sale of Personal Data Act.

Continue Reading Analyzing the 2020 Virginia Privacy Act and Sale of Personal Data Act

Keypoint: Florida lawmakers have proposed legislation that would require certain operators of websites to make online disclosures and accept requests to opt-out of sales of personal data but that would stop far short of creating CCPA-like privacy rights for Florida residents.

Florida lawmakers have introduced companion bills in the Florida House (HB 963) and Senate (SB 1670) that would create limited online privacy rights and obligations in the state. The legislation – which is yet to be named but for our purposes will be referred to as the 2020 Florida Consumer Privacy Act (Act) – appears to be very similar to the Nevada Online Privacy Protection Act, which was amended last year to add a right to opt-out of sales of covered information. The Act is therefore distinguishable from the California Consumer Privacy Act (CCPA) and more akin to the California Online Privacy Protection Act (CalOPPA).

Florida joins a number of other states considering consumer privacy legislation, including Illinois, Washington state, Nebraska, New Jersey, New Hampshire, Virginia, and Hawaii. Members of Husch Blackwell’s privacy and data security practice group will be hosting a webinar on February 4 at noon CST to discuss these proposed laws and to provide an update on the CCPA. To register, click here.

Below is our analysis of the Florida legislation (as introduced).

Continue Reading Analyzing the 2020 Florida Consumer Data Privacy Act

data privacyKeypoint: Nebraska lawmakers will consider proposed legislation that would create CCPA-like privacy rights for Nebraska residents.

On January 8, 2020 Nebraska state Senator Carol Blood introduced the Nebraska Consumer Data Privacy Act (LB746) (the “Act”).

Below is our analysis of the proposed legislation (as introduced).

Continue Reading Analyzing the 2020 Nebraska Consumer Data Privacy Act

Conceptual image about how a laptop computer with internet open a virtual door to worldwide information sharing.Keypoint: Illinois lawmakers have proposed legislation that would create CCPA-like privacy rights for Illinois residents.

On January 8, 2020, Illinois state Senator Thomas Cullerton introduced the Illinois Data Transparency and Privacy Act (SB2330). This comes on the heels of last year’s legislative session in which two consumer privacy bills failed to pass.

Below is our analysis of the proposed legislation (as introduced).

Continue Reading Analyzing the 2020 Illinois Data Transparency and Privacy Act

data privacyKeypoint: Washington lawmakers will be filing the 2020 version of the Washington Privacy Act on Monday, January 13, 2020.

Those who follow privacy law will remember that last year Washington state came close to becoming the second state (after California) to enact consumer privacy legislation. That legislation – called the Washington Privacy Act (WPA) – overwhelmingly passed the state senate but failed in the house, in part, based on disagreements as to how the statute would be enforced and its facial recognition provisions. (See our prior post here.) The bill’s proponents; however, vowed to push the legislation again in 2020.

On Friday, January 10, 2020, the Washington Senate Democratic Caucus publicly released the 2020 version of the WPA. The release came in advance of the opening of the Washington legislature on Monday, January 13, 2020. The bill’s sponsors also will be holding a press conference on January 13, 2020, to discuss the bill.

Below is our analysis of the 2020 version of the WPA.

Continue Reading 2020 Washington Privacy Act Released

Conceptual image about how a laptop computer with internet open a virtual door to worldwide information sharing.Keypoint: 2020 promises to be another ground-breaking year in privacy and cybersecurity law in the United States.

2019 was an exciting year in privacy and cybersecurity law. In the United States, the California Consumer Privacy Act (CCPA) was the most significant story, but there also were developments in states such as New York and Nevada. Numerous other states also considered consumer privacy legislation, and federal lawmakers even jumped into the fray, proposing a variety of bills and regulations. Overseas, GDPR garnered the most headlines of course, but other countries, such as Brazil, also made news.

But 2019 was just the start. There is no doubt that privacy and cybersecurity law is undergoing a fundamental change in the United States. If nothing else, the legal landscape of privacy law in the United States promises to look very different by the end of the year.

Below we discuss what we anticipate will be the biggest stories in 2020 and beyond.

Continue Reading The Year to Come in U.S. Privacy & Cybersecurity Law

Safety concept: Police on digital background

Key Point:  If you consider your cybersecurity defensive measures to be a one-time investment, that is what the criminals are banking on.

Most people enjoy improvements and innovations when it comes to consumer electronics, but the unfortunate truth is that cybercriminals are innovating and improving their techniques and tactics as well. These innovations include “getting a second bite from the ransomware apple” and using ransomware to cause “physical vulnerabilities at your business.” Hopefully the anecdotes below help to convince the decision-makers in your business to follow the Coast Guard’s motto Semper Paratus – Always Prepared.

Continue Reading Looking for a New Year’s Cyber Resolution? Perpetual Vigilance.

As Husch Blackwell discussed in a recent client alert, the U.S. Department of Commerce recently issued a proposed rule (the “Proposed Rule”) which intends to give the U.S. Secretary of Commerce the authority to block, unwind or modify information and communications technology or services (“ICTS”) transactions involving “foreign adversaries” if the Commerce Secretary determines that such transactions threaten U.S. critical infrastructure, the U.S. digital economy or U.S. national security. There were many aspects of the Proposed Rule which were unclear, but the U.S. Department of Commerce indicated its willingness to consider comments from the public which were received on or before Friday, December 27, 2019.

On Monday, December 23, 2019 the U.S. Department of Commerce announced that it had extended the Proposed Rule’s comment period in order to consider comments received before the close of business on Friday, January 10, 2020. This extension will provide potential respondents with an additional 14 days to prepare comments to the Proposed Rule.

Conceptual image about how a laptop computer with internet open a virtual door to worldwide information sharing.Keypoint: Those hoping that the final CCPA regulations will clarify its requirements may be disappointed. 

According to an article in Bloomberg Law, California Attorney General Becerra does not anticipate his office making substantial changes to the regulations as proposed when it issues the final regulations.

The AG’s office published the proposed regulations on October 10, 2019. The AG’s office held public hearings on the proposed regulations in early December, and the deadline for written comments passed on December 6. In past reports, the AG’s office signaled that they will move swiftly to issue the final regulations.

The CCPA goes into effect on January 1, 2020, but the AG’s office cannot enforce the statute until July 1, 2020. Nonetheless, Attorney General Becerra told Bloomberg Law that enforcement actions can cover activities in the first six months of 2020.

Commentators pointed out numerous areas of ambiguity with the proposed regulations during the hearing and comment period. However, at this point, it is unclear how much the AG’s office will do to address those concerns. In the interim, best efforts should be made to comply with the proposed regulations by January 1. This will come as little comfort to businesses that are struggling with operationalizing the CCPA and regulations in light of its lack of specificity and clarity on numerous topics.