Global Privacy & Security Compliance Law Blog

Privacy Enhancing Technologies — A Panacea for Data Protection Compliance?

By Latham & Watkins LLP on Posted in Privacy, Security

The Information Commissioner’s Office published draft guidance on privacy enhancing technologies that can be used to comply with privacy-by-design requirements.

By Gail Crawford, Fiona Maclean, Irina Vasile, and Amy Smyth

On 7 September 2022, the Information Commissioner’s Office (ICO) published a draft guidance on privacy-enhancing technologies (Draft Guidance) in which it explains what privacy enhancing technologies (PETs) are and how organizations can use them to meet privacy-by-design requirements. PETs incorporate data protection principles by (amongst others) minimizing use of personal data, ensuring security, and facilitating data subject rights. Organizations that want to use PETs should first conduct a data protection impact assessment to determine whether such technologies are indeed adequate for their processing activities. Continue Reading

CCPA Will Now Fully Regulate Personnel and B2B Information

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Privacy

Businesses will need to take additional steps to ensure compliance as exemptions under the California Consumer Privacy Act expire at the end of 2022.

By Robert Blamires, Michael H. Rubin, Robert W. Brown, and Jennifer Howes

The California legislature adjourned its 2022 session without extending the exemptions under the California Consumer Privacy Act (CCPA) for personal information collected about California residents in a personnel/HR or business-to-business (B2B) context. Therefore, starting next year all obligations (and rights) in the CCPA, including those introduced under the California Privacy Rights Act (CPRA), will extend to such information. Continue Reading

California Attorney General’s Office Announces First Public CCPA Enforcement Action

By Latham & Watkins LLP on Posted in Privacy

Aggressive enforcement may be on the horizon now that businesses have had more than two years to comply with California’s landmark privacy law.

By Michael Rubin, Joseph Hansen, Robert Brown, Max Mazzelli, and Wesley Tiu

On August 25, 2022, the California Office of the Attorney General (OAG) announced that it had settled a complaint against Sephora alleging violations of the California Consumer Privacy Act (CCPA). The public settlement was the first since the CCPA became enforceable more than two years ago. Continue Reading

UK Data Protection Bill: Overview of Proposed Changes (Part 1)

By Latham & Watkins LLP on Posted in GDPR, Legislative & Regulatory Developments

The bill would largely build on the UK data protection regime’s EU GDPR-style framework, albeit with UK-specific provisions.

By James Lloyd, Fiona M. Maclean, Calum Docherty, Irina Vasile, Alex Ford-Cox, and Amy Smyth

The UK government introduced the Data Protection and Digital Information Bill (the Bill) to Parliament on 18 July 2022, following the publication of its response to the consultation “Data: a new direction” (the Consultation). (For more information on the Consultation, see this Latham blog post.)

The Bill details the government’s proposals for reforming the current UK data protection regime (consisting primarily of the UK Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR)).

This article presents an overview of the proposed changes. In part 2, we provide a deeper dive into certain key provisions.

In summary, the proposed changes — while broad in scope — do not amount to a wholesale change in direction for UK data protection laws. Assuming the Bill is passed without amendment, the UK regime would largely build on the current EU GDPR-style framework, albeit with UK-specific provisions. The changes can be grouped into two categories: (1) a more risk-based / outcome-focused approach and (2) developments in key areas around accountability, data subject rights, security, and legal grounds for processing. Continue Reading

UK Data Protection Bill: Examination of Key Provisions (Part 2)

By Latham & Watkins LLP on Posted in GDPR, Legislative & Regulatory Developments

Areas of interest include anonymisation, “recognised legitimate interests”, and the ICO’s role.

By James Lloyd, Fiona M. Maclean, Calum Docherty, Irina Vasile, Alex Ford-Cox, and Amy Smyth

The UK Data Protection and Digital Information Bill (the Bill) sets out the government’s proposals for reforming the current UK data protection regime (consisting primarily of the UK Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR)). While broad in scope, the proposals do not amount to a wholesale change in direction for UK data protection laws. Assuming the Bill is passed without amendment, the UK regime would largely build on the current EU GDPR-style framework, albeit with UK-specific provisions. The changes can be grouped into two categories: (1) a more risk-based / outcome-focused approach and (2) developments in key areas around accountability, data subject rights, security, and legal grounds for processing.

This article provides a deep dive into certain key provisions of the Bill. In part 1, we provide an overview of the proposed changes. Continue Reading

UK Data Protection Reform: Examining the Road Ahead

By Latham & Watkins on Posted in Legislative & Regulatory Developments

UK government sets out ambitious proposal for reforming the UK data protection landscape.

By Gail E. Crawford, Ian Felstead, Fiona M. Maclean, Irina Vasile, Timothy Neo, and Amy Smyth

On 17 June 2022, the Department for Culture, Media and Sport (DCMS) published its response to its consultation “Data: a new direction” (the Consultation), setting out the government’s plans to reform the UK data protection regime.

These reforms are part of the UK’s National Data Strategy, which seeks to shift focus from prescriptive requirements to a risk-based approach, thereby making data protection less burdensome for businesses and enabling them to protect personal data in a proportionate and appropriate way. The DCMS has indicated, in comments at a recent conference, that the intention and direction of travel is to build on, improve, and clarify the approach that the UK will take with the UK GDPR in a way that benefits businesses whilst maintaining the same level of data protection for individuals.

This blog post scrutinises some of the Consultation’s key takeaways. For a full list of proposals that are being taken forward pursuant to the Consultation, see this response Annex. Continue Reading

CJEU AG Sets High Bar for Responses to Data Subject Access Requests

By Latham & Watkins on Posted in GDPR, Legislative & Regulatory Developments

The Advocate General argues that organisations should provide individuals with information on the specific recipients of their personal data.

By Tim Wybitul, James Lloyd, Isabelle Brams, Irina Vasile, and Amy Smyth

Advocate General Giovanni Pitruzzella (AG) of the Court of Justice of the European Union (CJEU) recently delivered an opinion (the Opinion) regarding the interpretation of an individual’s right of access to their data under Article 15 GDPR (often known as a data subject access request, or DSAR/SAR). Specifically, the Opinion addresses an individual’s right to access information about “the recipients or categories of recipient to whom the personal data have been or will be disclosed […]”, pursuant to Article 15(1)(c) GDPR. The AG delivered the Opinion in the context of Case C-154/21 (the Case), which is currently pending before the CJEU. Continue Reading

EDPB Emphasizes “Dissuasive” Fines in New Draft Guidelines on GDPR Fine Calculation

By Latham & Watkins LLP on Posted in GDPR, Privacy, Security

The EDPB sets out relevant steps and factors that EU supervisory authorities should consider when calculating administrative fines under the GDPR.

By Gail Crawford, Ian Felstead, James Lloyd, Tim Wybitul, Irina Vasile, Sami Qureshi, and Amy Smyth

On 16 May 2022, the European Data Protection Board (EDPB) adopted draft Guidelines 04/2022 on the calculation of administrative fines under the GDPR (Draft Guidelines).[1] The Draft Guidelines are currently subject to public consultation and comments may be submitted until 27 June 2022 (at the latest). The EDPB’s aim is to create a harmonised methodology for the calculation of GDPR fines. All EU supervisory authorities (SAs) must use the same starting points, on the basis of which administrative fines can be subsequently calculated and further tailored for individual cases. The EDPB clearly emphasizes that the Draft Guidelines are not drafted to enable controllers/processors to precisely calculate the expected fine; this determination will rather depend on all the individual circumstances of the case. SAs will need to ensure that fines are effective, proportionate, and dissuasive, taking into account the particularities of each case. While the EDPB acknowledges that SAs retain discretion to account for these particularities, they are clearly expected to follow the methodology set out in the Draft Guidelines. Continue Reading

Cyber Risk in Finance: A Q&A With Latham Partners

By Latham & Watkins LLP on Posted in Privacy, Security

The evolution of cybersecurity-related representations and warranties in M&A transaction documentation has had an impact on financing transactions.

Major M&A transactions and IPOs have become the target of increasingly sophisticated cyberattacks, in some cases affecting thousands of companies along the supply chain. Regulators have responded with stepped-up enforcement, extending their reach not just to victim companies but also to third parties like payment processors and insurance carriers.

Today’s most pressing cybersecurity risks can have a significant effect on borrowers and their lenders, who should take several context-specific steps to limit risk, in addition to undertaking standard diligence including document review, management interviews, and analysis of publicly available information.

Latham & Watkins partners Robert Blamires, Tony Kim, and Jane Summers discuss in this Q&A how cybersecurity representations and warranties have evolved in M&A transactions, how cybersecurity risks can be addressed in the loan market, and how credit agreements can deal with cybersecurity.

New Cyber Incident Reporting Requirements on the Horizon in the US

By Latham & Watkins on Posted in Security

Companies should take steps now to prepare for the new rules and expectations.

By Jennifer C. Archie, Tony Kim, Serrin Turner, Alexander L. Stout, Ryan J. Malo, and James A. Smith

The US government continues to expand regulatory requirements around notification and disclosure of major cyberattacks or incidents. New measures are arriving on the heels of high-profile ransomware attacks on US companies and critical infrastructure, such as the Colonial Pipeline hack that caused gas shortages in the eastern United States last summer.

Announced shared cybersecurity priorities across the Executive Branch include:

  • Cyber hygiene in the public and private sector, especially where critical infrastructure is involved
  • Operational collaboration between the public and private sector for tier one events
  • Disruption of the flow of cryptocurrency or other consideration to attackers
  • Fulsome, accurate, timely disclosure to investors and other stakeholders
  • Comprehensive reporting of incidents

Continue Reading

LexBlog