The SEC today published in the Federal Register its Regulation SCI (Regulation Systems Compliance and Integrity), which requires key market participants to have and implement written policies and procedures reasonably designed to ensure the availability, confidentiality and integrity of their systems as necessary to assure the fair and orderly operation of the markets. Among the specific requirements are periodic testing, annual systems review and disclosure of “SCI events” – including both functional and security issues. In addition to security issues,
The “Right to be Forgotten” Landmark Decision: Beyond the Headlines
By Larry Cohen and Gail Crawford
While the popular press has been full of stories about the European Court of Justice’s (“ECJ”) ruling creating a “right to be forgotten” (ahead of the still pending Data Protection Regulation), we will focus on both the ruling as well as the specific questions referred to the ECJ that have far-reaching ramifications for global companies such as the test for applicability of national data protection laws.
First, some background on the facts of the
Eight Key Takeaways from FTC’s Settlement with Snapchat
By Jennifer Archie, Kevin Boyle & Alex Stout
Yesterday, the Federal Trade Commission announced a settlement with Snapchat, the young mobile messaging company. The complaint alleges misrepresentations about functionality and related security as well as privacy violations, including misrepresenting the amount of data Snapchat collected from users and the use of location data for analytics purposes. Notably, some of Snapchat’s troubles flow from unauthorized third party applications that exploited issues in its non-public API.
First, a bit about Snapchat.
Complaint That Sale of Magazine Subscription Lists Violates Michigan’s Video Rental Privacy Law Sustained
By Kevin Boyle
In a case that is a good reminder of the potential reach of sometimes overlooked state legislation to national practices, the U.S. District Court for the Eastern District of Michigan has sustained the core of several complaints for violation of Michigan’s Video Rental Privacy Act. Among other arguments, defendants in the cases asserted that the plaintiffs’ lacked Article III standing for failure to allege actual injury.
The cases involve the defendants’ apparently conceded sale of magazine subscription
New COPPA Rules Effective July 1
By Kevin Boyle and Aryeh Richmond
Here is a reminder that the Federal Trade Commission’s revisions to its Children’s Online Privacy Protection Rule become effective on July 1. If you haven’t already, now is the time to make sure you have revisions to meet the rule in place as FTC and state attorney general inquiries and formal investigations are sure to follow the extensive public notices about the new rule as well as the need to comply on time.
First
Delta Privacy Case Update
The draft transcript of the May 9, 2013 oral argument and decision on the record are now available here.
Latham Secures Dismissal of California AG Privacy Suit against Delta Air Lines
By Jennifer Archie and Kevin Boyle
A California state judge has dismissed a state enforcement action against our client Delta Air Lines arising out of the alleged failure to timely post a privacy policy specific to its Fly Delta App in a manner that was reasonably accessible to smartphone users.
In what Law360 characterized as a “major blow to California’s attorney general in the first test of California’s Online Privacy Protection Act,” on May 9, 2013, Superior Court Judge
FTC Issues Staff Report on Mobile Privacy Disclosures
On Friday, Feb. 1, 2013, following the now expected series of public workshops and roundtables and well-timed enforcement actions, the Federal Trade Commission Staff issued a new 36-page staff report, Mobile Privacy Disclosures: Building Trust Through Transparency. The Report summarizes past actions and guidance, and makes new recommendations for clearly and transparently informing users about mobile data practices in the “rapidly expanding mobile marketplace.”
The report makes distinct recommendations for meeting fair information practices for mobile
HHS Publishes Omnibus HIPAA/HITECH Final Rule
HHS today published the long-awaited HIPAA/HITECH omnibus final rule. A pre-publication version of the Rule was released on January 17. The Rule is effective March 26, 2013, but covered entities and business associates have until September 23, 2013 to comply. While Latham & Watkins is still engaged in a comprehensive review of the entire final rule, some of the more notable changes and clarifications in the final rule, as compared to the interim final rule
California Limits Employer Access to Employee/Applicant Social Media
By Linda Inscoe and Joseph Farrell
On September 27, 2012, California became the third state to enact legislation protecting employees, job applicants, university students and prospective students against coerced disclosure of usernames, passwords and other information related to personal social media accounts, such as Facebook, MySpace and Twitter accounts, text messages, private email accounts, blogs and podcasts. Governor Edmund G. “Jerry” Brown signed Assembly Bill 1844 (AB 1844) and Senate Bill 1349 (SB 1349), increasing privacy