The guidance encourages organisations to formulate a data breach response plan, and outlines recommendations for handling an increasing number of data breach incidents.

By Kieran Donovan and Jacqueline Van

On 30 June 2023, the Office of the Privacy Commissioner for Personal Data of Hong Kong (PCPD) issued revised guidance titled “Guidance on Data Breach Handling And Data Breach Notifications” (the Guidance Note). While the Guidance Note broadly aligns with the last update in January 2019 (the 2019 Guidance), it also contains further details and recommendations to organisations on how to respond to data breaches.

The PCPD published the Guidance Note following a surge in reported data breach incidents, which have increased by more than 20% in the first half of this year compared to the second half of 2022.

The California Attorney General’s investigative sweep is a potential harbinger of increased focus on employers’ data privacy compliance with respect to employee data.

By Robert Blamires, Michael H. Rubin, Joseph C. Hansen, and Kathryn Parsons-Reponte

On July 14, 2023, the California Attorney General announced an investigative sweep targeting large California employers, focusing on employers’ compliance with the California Consumer Privacy Act’s (CCPA’s) recently expanded coverage of employees and job candidates. The announcement follows the expiration of a prior exemption for personnel and business to business (B2B) data under the CCPA (for more information, see this Latham blog post).

Covered companies will need to take additional steps to comply with the law in light of the new obligations relating to consumer health data and minors under 18 years old.

By Marissa R. Boynton, Serrin Turner, Joseph C. Hansen, Jennifer Howes, and Dyllan Brown-Bramble

On June 6, 2023, the Connecticut legislature passed Substitute Senate Bill No. 3 (SB3), which significantly amends the Connecticut Data Privacy Act (CTDPA), thereby broadening its reach. While the CTDPA took effect on July 1, 2023, the amendments do not yet apply.

The provisions in SB3 concerning consumer health data were originally drafted to take effect on July 1, 2023, alongside the rest of the CTDPA. However, a day after SB3 passed, the state budget bill amended the provisions related to consumer health data. The provisions will now take effect on October 1, 2023.

Separately, the requirements for dating app operators will take effect on January 1, 2024; the requirements for social media platforms will take effect on July 1, 2024; and the requirements for online providers of services, products, or features used by minors under 18 will take effect on October 1, 2024.

Florida’s law introduces novel provisions that depart from existing US state privacy laws, which businesses will need to carefully consider.

By Jennifer C. Archie, Clayton Northouse, Joseph C. Hansen, and Austin L. Anderson

Key Takeaways:

  • On June 7, 2023, Florida’s governor signed the Digital Bill of Rights into law, set to go into effect on July 1, 2024.
  • Unique to Florida, the law mainly targets very large enterprises, adopting a revenue threshold of at least $1 billion gross annual revenue for many of its requirements, and regulating companies engaged in specific enumerated digital lines of business.
  • The law also imposes obligations on all for-profit businesses (regardless of revenue threshold) that do business in the state and “sell” the sensitive personal data of Florida consumers.
  • Many of the law’s requirements are modeled off of Virginia’s privacy law, but covered businesses will need to pay special attention to unique requirements around consumer rights, privacy policy disclosures, and restrictions on data obtained from consumers under the age of 18.
  • The Florida Attorney General has exclusive enforcement authority, and penalties can reach up to $150,000 for certain violations, including failure to correct or delete a consumer’s personal data.
  • Favorably, the law provides a discretionary 45-day right to cure.

A California court has held that the regulations the California Privacy Protection Agency adopted in March 2023 may not be enforced until March 2024.

By Michael Rubin, Joseph Hansen, Austin Anderson, and Max Mazzelli

On June 30, 2023, a day before the California Consumer Privacy Act (CCPA) as amended by the California Consumer Privacy Act (CPRA), and the accompanying regulations issued by the California Privacy Protection Agency (Agency), were set to come into force, the Superior Court of California granted a petition to restore a key aspect of the voter-enacted law: covered businesses must receive a one-year grace period between final adoption and enforcement of the CCPA regulations. Certain forthcoming regulations will also receive a one-year grace period.

The French Data Protection Authority has imposed a €40 million fine for GDPR infringements.

By Myria Saarinen and Charlotte Guerin

On 15 June 2023 the French Data Protection Authority (the CNIL), acting as Lead Supervisory Authority pursuant to the cooperation procedure under Article 60 GDPR, handed down a decision against the French adtech company Criteo SA (Criteo). The CNIL imposed a €40 million fine for five infringements of the GDPR, in particular for failing to verify that data subjects had consented to the processing of their personal data for the purpose of targeted advertising.

Founded in 2005 and headquartered in France, Criteo specializes in behavioral retargeting, which involves tracking browsing patterns through cookies placed on users’ devices to facilitate personalized advertisements. Criteo collects browsing data tied to a cookie that is being placed when users visit certain partner websites (the Criteo cookie), and then uses the data to generate personalized online ads. Criteo will then show these ads to users when they visit other partner or customer websites. According to its corporate website, Criteo serves 5 billion ads per day and partners with more than 19,000 customers.

The amended PDPL diverges from international privacy laws in several areas, including personal data transfers, penalties, and breach notification.

By Brian A. Meenagh and Lucy Tucker

An amended version of the Kingdom of Saudi Arabia’s Personal Data Protection Law (PDPL) was published in the Official Gazette of the Kingdom of Saudi Arabia on April 7, 2023. The amended PDPL contains the same wide extra-territorial scope as the original PDPL. It applies to any processing of personal data that takes place in the Kingdom, and applies to the processing of personal data of individuals located in the Kingdom by organizations outside of the Kingdom.

The amended PDPL contains concepts and requirements similar to those in international privacy laws, such as the GDPR, including concepts, such as personal data, controllers and processors, data processing principles, certain data subject rights, and the requirement to maintain a record of processing activities. However, the PDPL diverges from international privacy laws in several important areas, notably in relation to transfers of personal data outside of the Kingdom and penalties for non-compliance.

The stringent law introduces several novel obligations and a unique approach to determining applicability that may broaden its reach.

By Clayton Northouse, Michael H. Rubin, and Robert Brown

On June 18, 2023, Texas enacted the Texas Data Privacy & Security Act (TDPSA), which will largely take effect in just over a year on July 1, 2024. The TDPSA follows in the footsteps of 10 other comprehensive US state privacy laws but sits decisively on the more stringent end of the spectrum.

While the TDPSA is generally modeled after the Virginia Consumer Data Protection Act (VCDPA), it adopts many of the more consumer-friendly components of more recently enacted laws. It also introduces several novel obligations and a unique approach to determining applicability that may broaden its reach.

In light of these factors and considering the size of the Texas economy and population, the TDPSA may prove to be the most impactful state privacy law since the California Consumer Privacy Act (CCPA), which was enacted in 2020.

The French Data Protection Authority imposed a €280,000 fine for GDPR infringements and a €100,000 fine for violation of French cookie rules.

By Myria Saarinen

On 11 May 2023 the French Data Protection Authority (the CNIL) handed down its decision on the health website Doctissimo, imposing a €280,000 fine for the infringement of four provisions of the GDPR and an additional €100,000 fine for the violation of Article 82 of the French Data Protection Act (the French Cookies Rule).

Founded in 2000 by medical doctors, Doctissimo is one of the most widely visited health and well-being websites in France, with the majority of visitors located in France and Belgium. The website hosts articles, tests, quizzes, and forums related to health and well-being.

The new laws introduce novel applicability thresholds and other requirements that businesses should consider when preparing for compliance with US state privacy laws, including those coming into effect from 2023 onwards.

By Robert Blamires, Marissa Boynton, Michael H. Rubin, Joseph Hansen, and Austin Anderson

Key Takeaways:

(i) Indiana, Montana, and Tennessee have all enacted general data privacy legislation, bringing the total to nine US state data privacy laws.

(ii) Montana will be the first of the three new laws to take effect on October 1, 2024, followed by Tennessee on July 1, 2025, and Indiana on January 1, 2026.

(iii) For businesses subject to existing similar general data privacy laws in other US states, many of the requirements will look familiar. The laws in Indiana and Tennessee generally follow in the wake of Virginia’s privacy law, while Montana’s law tracks more closely to Connecticut’s privacy law.  

(iv) All three laws will be exclusively enforced by the respective state attorneys general, but the penalties and applicable cure periods vary.