Global Privacy & Security Compliance Law Blog

Category Archives: Security

Subscribe to Security RSS Feed

EDPB Publishes Regulatory Guidance on Territorial Scope of GDPR

By Latham & Watkins LLP on Posted in GDPR, Security
The Guidance provides helpful clarifications for service providers and their customers on both sides of the Atlantic. By Robert Blamires, Fiona M. Maclean, and Danielle van der Merwe Long-awaited guidance on the territorial scope of the General Data Protection Regulation (GDPR) has been published by the European Data Protection Board (EDPB) for public consultation (Guidance). … Continue Reading

German GDPR Fine Proceedings Conclude Favourably for Defending Company

By Latham & Watkins LLP on Posted in GDPR, Legislative & Regulatory Developments, Privacy, Security
Germany’s first GDPR fine offers lesson for companies planning a data breach policy. By Tim Wybitul, Wolf-Tassilo Böhm, and Isabelle Brams In November 2018, Germany’s first fine under the General Data Protection Regulation (GDPR) was imposed — and it was much lower than many expected. The favourable outcome of the proceedings for the defending company … Continue Reading

A New Era for Data Protection in Brazil

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Security
Brazilian Congress passes a data protection bill that seeks to improve privacy and cybersecurity. By Amadeu Ribeiro and Thiago Luís Sombra (Mattos Filho, Veiga Filho Marrey Jr e Quiroga Advogados) and Jennifer Archie and Terese Saplys The Brazilian Congress has been working on a bill relating to the protection of personal data for over eight … Continue Reading

FCA Speaks Out on the Ethics of Big Data

By Latham & Watkins LLP on Posted in Privacy, Security
FCA Chair hints that new regulation addressing data ethics in the FinTech space may be on the horizon. By Nicola Higgs, Fiona Maclean and Terese Saplys Will societies of the future be ruled by algocracy, in which algorithms decide how humans are governed? Charles Randell, Chair of the Financial Conduct Authority (FCA) and Payment Systems … Continue Reading

National Cyber Security Centre Releases NIS Directive Guidance

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Security
The UK agency’s principles-based guidance on cybersecurity for OES adds important detail to NIS Directive obligations. By Gail Crawford, Mark Sun, Fiona Maclean, and Malika Sajdik The National Cyber Security Centre (NCSC) has published introductory guidance for operators of essential services (OES) on the new cybersecurity rules under the EU’s Security of Network and Information … Continue Reading

US Government Contractors Face New Cybersecurity Requirements

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Security
By Jennifer Archie, Serrin Turner, Kyle Jefcoat, Dean Baxtrasser and Morgan Maddoux As of December 31, 2017, many United States government contractors face a new compliance requirement involving cybersecurity. This requirement will govern most new Department of Defense (DoD) contracts and, significantly, will apply to many current DoD contracts that include the applicable standard contract … Continue Reading

Call for Cybersecurity Guidelines in International Arbitration

By Latham & Watkins LLP on Posted in Security
By Hanna Roos and Jennifer Archie Cybercrime has become a regular feature of global news. The question is not if another attack will happen, but when. Prominent examples include the leak of millions of attorney-client documents from law firms Appleby and Mossack Fonseca, and the “Petya” attack, which brought DLA Piper’s system to a standstill. … Continue Reading

Court Rules on D-Link Motion to Dismiss in FTC Matter

By Latham & Watkins LLP on Posted in Security
By Michael Rubin, Scott Jones, Cooper Rekrut On September 19, 2017, Judge Donato of the Northern District of California ruled on Defendant D-Link System Inc.’s (D-Link) Motion to Dismiss, which challenged claims by the Federal Trade Commission (FTC) that D-Link’s conduct constituted unfair and deceptive trade practices in violation of Section 5 of the FTC Act. … Continue Reading

Trump Administration Issues New Executive Order Focused on Strengthening Federal Cybersecurity

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Security
By Steven Croley*, Jennifer Archie and Serrin Turner The Trump Administration has issued a much anticipated Executive Order (EO),“Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure,” directing federal executive agency heads to undertake various cyber-related reviews and to report findings back to the White House within prescribed timetables. Unlike some of the Trump Administration’s … Continue Reading

Ransomware Attacks: When Is Notification Required?

By Latham & Watkins LLP on Posted in Security
Ransomware Attacks: When Is Notification Required?By Jennifer C. Archie, Serrin Turner and Marissa Boynton Ransomware is one of the most prevalent cybersecurity threats afflicting businesses today. When an attack hits, a victim company must confront the difficult question whether to pay the ransom demanded in order to regain access to the company’s files and restore business operations. But there is an … Continue Reading

Germany Implements GDPR

By Latham & Watkins LLP on Posted in Privacy, Security
By Ulrich Wuermeling Well ahead of the implementation deadline for the European General Data Protection Regulation (GDPR), the German Parliament (Bundestag) passed a new Federal Data Protection Act (Bundesdatenschutzgesetz) on April 27, 2017. The Federal Council (Bundesrat) could confirm the Act before the summer, but may require further amendments. If the Parliament and the Council fail to … Continue Reading

US Magistrate Judge Upholds Search Warrants for Google Data Stored Overseas, “Shards” and All

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Privacy, Security
By Serrin Turner and Megan Behrman Another front recently emerged in the legal battle over whether US law enforcement authorities can use a search warrant issued under the Stored Communications Act (SCA) to obtain data stored overseas. Until now, the battle has been focused in New York, where Microsoft filed a challenge in December 2013 … Continue Reading

Keeping Your Company’s Data Safe This Tax Season

By Latham & Watkins LLP on Posted in Privacy, Security
By Jennifer Archie and Alex Stout Tax-related identity theft is nothing new, but tax season 2016 took tax schemes to a new level. Last year, our cyber experts advised a large cluster of clients (public and private companies) over a period of only two weeks, following a nationwide explosion of deviously simple attacks—mostly targeted at … Continue Reading

Financial Institutions Await Response to Concerns Over New York State Department of Financial Services’ Proposed Cybersecurity Rules

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Security
By Jennifer Archie, Alan Avery, Serrin Turner, and Pia Naib Dozens of financial institutions and trade associations have lodged emphatic objections with the New York State Department of Financial Services (NYSDFS) in response to the Department’s September 28, 2016 Notice of Proposed Rulemaking entitled “Cybersecurity Requirements for Financial Services Companies” (the Proposed Rules). As published … Continue Reading

Around the Table: Behind the Headlines of Evolving Cyberthreats

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Privacy, Security
Latham partners Serrin Turner, Jennifer Archie and Jeffrey Tochner sat down with Eric Friedberg, Executive Chairman at Stroz Friedberg, and Matt Olsen, President – Consulting at IronNet Cybersecurity, to discuss current cyberthreat levels and the growing need for companies to devote resources for future risk mitigation.    … Continue Reading

Prevent and Prepare for a Cybersecurity Breach

By Latham & Watkins LLP on Posted in Security
By Jennifer Archie, Gail Crawford, Andrew Moyle, Serrin Turner, and Brian Meenagh Hacking of organizations’ systems is becoming increasingly commonplace, even with advancements in security practices. To mitigate risk, a company must have an enterprise-level, cross-functional incident response plan that is rehearsed and practiced. In the event of an incident a company with a rehearsed … Continue Reading

Anonymous or Not: Court of Justice Issues Ruling on IP Addresses

By Latham & Watkins LLP on Posted in Privacy, Security
By Gail Crawford and Ulrich Wuermeling On October 19, 2016, the Court of Justice of the European Union (CJEU) issued a ruling on the question of whether IP addresses constitute personal data. The ruling has direct implications on the general question of when data can be regarded as anonymous and, thus, fall outside the scope of data … Continue Reading

“Yarovaya” Law – New Data Retention Obligations for Telecom Providers and Arrangers in Russia

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Privacy, Security
By Ksenia Koroleva On July 6, 2016, Russian President Vladimir Putin signed Federal Law No 374-FZ. This law is also known as the “Yarovaya” law (named after a Russian senator who was the main driving force for the law to come into existence). The Yarovaya law introduces amendments to certain Russian federal laws. The majority … Continue Reading

Proposal of EU-US Privacy Shield Leaves Businesses in State of Uncertainty

By Latham & Watkins LLP on Posted in Privacy, Security
By Ulrich Wuermeling, Gail Crawford and Jennifer Archie Earlier this week, the European Commission announced that a “political” agreement has been reached on a new framework for data flows from the EU to the US. The announcement highlights a few changes from the old Safe Harbor regime, such as more direct and active oversight by US … Continue Reading

MEPs Agree to Europe’s First-Ever EU Cybersecurity Law

By Latham & Watkins LLP on Posted in Legislative & Regulatory Developments, Security
By Gail Crawford and Andrea Stout On December 7th, members of the European Parliament (MEPs) and the Luxembourg Presidency of the EU Council of Ministers provisionally agreed to the text of the long awaited network and information security directive also known as the cybersecurity directive (Directive). While the text of the proposed Directive has yet … Continue Reading

St. Elizabeth’s Medical Center Pays $218,400 to Settle Alleged HIPAA Security Case Stemming from Use of Cloud-Based Document Sharing Service

By Latham & Watkins LLP on Posted in Privacy, Security
By Jennifer Archie, Susan Ambler Ebersole, and Kasey Branam Alleged HIPAA Violations Resulted from Medical Center’s Failure to Risk Assess Internet-Based Document Sharing Application and Inadequate Breach Response The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) reached a settlement in the form of a Resolution Agreement and Corrective Action … Continue Reading

SEC Issues Regulation SCI Upping Information Security Requirements for Key Market Participants

By Jennifer Archie and Kevin Boyle on Posted in Legislative & Regulatory Developments, Security
The SEC today published in the Federal Register its Regulation SCI (Regulation Systems Compliance and Integrity), which requires key market participants to have and implement written policies and procedures reasonably designed to ensure the availability, confidentiality and integrity of their systems as necessary to assure the fair and orderly operation of the markets.  Among the … Continue Reading

Singapore’s first data breach?

By Luke Grub and Sally Murphy on Posted in Privacy, Security
The Straits Times reported on 14 August that Singapore’s Personal Data Protection Commission (the “Commission”) is investigating a complaint from a user that Xiaomi has breached the Personal Data Protection Act 2012 (“PDPA”). This is believed to be the first investigation under the main PDPA rules unrelated to the Do Not Call registry which came … Continue Reading
LexBlog