Key Point: The European Commission has adopted an adequacy decision for the EU-U.S. Data Privacy Framework, which allows certain businesses to transfer data from the EU to the U.S. without the need for additional transfer mechanisms. 

On July 10, 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework (“Privacy Framework”). This decision declared that United States companies that self-certify under the Privacy Framework will be deemed to provide an adequate level of data protection, which removes the requirement for those companies to implement additional safeguards when transferring data from the EU to the U.S. These safeguard requirements have been standard for decades but have been most recently required under the General Data Protection Regulation (“GDPR”).

Keypoint: June 2023 maintained a trend of mostly favorable outcomes for defendants as courts continue to grant motions to dismiss in session replay and VPPA cases.

This is the fifth installment in our monthly data privacy litigation reports to provide updates on how courts in the United States have handled emerging data privacy trends in the past month. In this post we look at decisions to dismiss session replay and VPPA claims coming out of California courts.

There are many courts currently handling data privacy cases across the nation. Although illustrative, this update is not intended to be exhaustive. If there is another area of data privacy litigation about which you would like to know more, please reach out. The contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following us on LinkedIn.

Keypoint: Enforcement by the California Privacy Protection Agency of the new CCPA regulations will be delayed until March 2024, but the Agency can still enforce the CCPA statutory changes as of July 1, 2023.

As first reported by Amy Miller at mlex, on June 30, 2023, Judge Arguelles of the Superior Court of California entered an Order granting, in part, the California Chamber of Commerce’s Petition for Writ of Mandate and Compliant for Declaratory and Injunctive Relief. In so doing, the Court held that enforcement of any final regulation published by the California Privacy Protection Agency must be stayed for a period of 12 months from the date that regulation becomes final. This means the Agency cannot enforce the new California Consumer Privacy Act (CCPA) regulations finalized on March 29, 2023, until March 29, 2024. Importantly, the ruling does not prohibit the Agency or the Attorney General’s Office from enforcing the statutory changes to the CCPA that went into effect on January 1, 2023.

Keypoint: Delaware is the twelfth state to pass consumer data privacy legislation with a bill that closely resembles the Connecticut law but with some notable differences.

On June 30, 2023, the Delaware legislature passed the Delaware Personal Data Privacy Act (HB 154). Subject to the procedural formalities in the legislature, the bill will move to Delaware Governor John Carney for consideration.

Assuming the bill becomes law, Delaware will become the twelfth state – and seventh this year – to pass a consumer data privacy law. The other states that have passed bills this year are Indiana, Iowa, Montana, Oregon, Tennessee, and Texas.

The Delaware bill closely resembles last year’s Connecticut Data Privacy Act (CTDPA) with some notable differences discussed in the below article.

As with prior bills passed this year, we have added the Delaware bill to our chart providing a detailed comparison of the laws enacted to date.

Keypoint: The AI Act is the first legislation of its kind and is expected to have a significant impact on companies globally.

The European Parliament recently voted in favor of the Artificial Intelligence Act (“AI Act”) with overwhelming majority. Once finalized, the AI Act will have widespread impact for entities using artificial intelligence (“AI”) in their business operations. Similar to the European Union’s (“EU”) General Data Protection Regulation, the AI Act will apply extraterritorially to providers placing on the market or putting into service AI systems in the EU, irrespective of whether those providers are established in the EU or in a third country.

The AI Act is dense and expansive. For entities looking for an introduction to the topic, below we provide a brief overview of the current legislation, as well as what you can expect procedurally as the AI Act progresses toward final passage.

Keypoint: Oregon is the eleventh state to pass consumer data privacy legislation with a bill that is one of the strongest passed to date.

On June 22, 2023, the Oregon legislature passed the Oregon Consumer Privacy Act (OCPA) (SB 619). Subject to the procedural formalities, the bill will move to Oregon Governor Tina Kotek for consideration.

Assuming the bill becomes law, Oregon will become the eleventh state – and sixth this year – to pass a consumer data privacy bill. It is the first Democrat-controlled state to pass a consumer data privacy bill in 2023.

The OCPA – which is the product of a work group led by the Oregon Attorney General’s office – is based on the Washington Privacy Act model that has been used by all of the non-California states. However, the bill contains some notable and unique provisions discussed in the below article.

Click here if you would like to see a more detailed comparison of the OCPA against the ten other state laws enacted to date.

Keypoint: Our final weekly update of the 2023 legislative session provides a recap of bills that are still alive.

Below is the twenty-third – and final – weekly update on the status of proposed state privacy legislation in 2023. With the legislatures in many states now adjourned for the year, we are concluding our weekly updates. However, as discussed below, there are still a handful of bills pending. We will continue tracking those bills and provide updates on an as-needed basis.

Keypoint: Last week the Nevada legislature passed a health data privacy bill, the Delaware House passed a consumer data privacy bill, the Oregon House passed a data broker bill, and the New York Senate passed consumer and health data privacy bills although the New York legislature closed without further movement on the bills.

Below is the twenty-second weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.

First, we are regularly updating our 2023 State Privacy Law Tracker, 2023 State Children’s Privacy Law Tracker, and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Keypoint: May 2023 saw victories for defendants as courts dismissed wiretapping claims based on website chat functionality and VPPA claims.

This is the fourth installment in our monthly data privacy litigation reports to provide updates on how courts in the United States have handled emerging data privacy tends in the past month. In this post we look at California courts who have dismissed wiretapping claims based on website chat functionality and VPPA claims.

There are many courts currently handling data privacy cases across the nation. Although illustrative, this update is not intended to be exhaustive. If there is another area of data privacy litigation about which you would like to know more, please reach out. The contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following us on LinkedIn.

Keypoint: Last week the Connecticut legislature passed Senator Maroney’s consumer health data / children’s privacy bill.

Below is the twenty-first weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.

First, we are regularly updating our 2023 State Privacy Law Tracker, 2023 State Children’s Privacy Law Tracker, and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.