In advance of the June 8, 2022 board meeting, the California Privacy Protection Agency (CPPA) staff has posted draft rules implementing the California Privacy Rights Act (CPRA). The draft regulations keep much of the pre-existing California Consumer Privacy Act (CCPA) regulations intact, but modify certain provisions and propose new regulations.
Continue Reading California Privacy Protection Agency Staff Posts Draft Rules Implementing the CPRA
FTC Unanimously Adopts Policy Statement on Education Technology and COPPA
On May 19, the Federal Trade Commission (“FTC”) adopted, on a unanimous basis, a policy statement reminding educational technology vendors (“ed tech vendors”) of their duty to comply with the substantive privacy protections of the Children’s Online Privacy Protection Act (“COPPA”) and the Commission-issued COPPA Rule. The policy statement reiterates the requirements of the Rule and previous informal guidance from Commission staff, and makes clear that ed tech vendors may not submit children to commercial surveillance and data monetization practices when using technology in the classroom.Continue Reading FTC Unanimously Adopts Policy Statement on Education Technology and COPPA
Connecticut Legislature Passes Comprehensive Privacy Bill
The Connecticut legislature passed Connecticut SB 6 on April 28, 2022. If signed by the governor, the bill would take effect on July 1, 2023, though the task force created by the bill will be required to begin work sooner.
The bill closely resembles the Colorado Privacy Act, with a few notable additions. Like the Colorado Privacy Act, the bill adopts “controller” and “processor” terminology, provides consumers with rights to access, correct, delete, obtain a copy, and opt-out of certain types of processing of their personal data, and requires consent for certain activities.
Continue Reading Connecticut Legislature Passes Comprehensive Privacy Bill
Colorado Attorney General Remarks on CPA Rulemaking
On April 12, at the International Association of Privacy Professionals’ global privacy conference, Colorado Attorney General Phil Weiser gave remarks on his office’s approach to the rulemaking and enforcement of the Colorado Privacy Act.
Continue Reading Colorado Attorney General Remarks on CPA Rulemaking
Supreme Court Holds FISA Does Not Displace the State Secrets Privilege
In March, the Supreme Court issued its decision in Federal Bureau of Investigation v. Fazaga, No. 20-828, holding that the state secrets privilege—and its dismissal remedy—applies to cases that may also be subject to the judicial review procedures set forth in the Foreign Intelligence Surveillance Act (“FISA”). In so holding, the Court reversed the Ninth Circuit’s 2020 ruling that FISA displaces the state secrets privilege in cases involving electronic surveillance.
Continue Reading Supreme Court Holds FISA Does Not Displace the State Secrets Privilege
California Privacy Protection Agency Holds Informational Hearings
The California Privacy Protection Agency (“CPPA”) held two informational hearings on March 29, 2022 and March 30, 2022, in anticipation of its upcoming rulemaking later this year. While the CPPA Board was present throughout the hearings, its members did not present any views as part of the program. The speakers covered the following topics of note:
Continue Reading California Privacy Protection Agency Holds Informational Hearings
Utah Legislature Passes Comprehensive Privacy Bill
Utah appears poised to be the next state with a comprehensive privacy law on its books, following California, Virginia, and Colorado. On March 2nd, the Utah House of Representatives voted unanimously to approve an amended version of the legislative proposal, and the Senate concurred with the House amendment on the following day. Formalities are now being completed to send the bill to Governor Spencer Cox for signature.
The Utah Consumer Privacy Act (“UCPA”) provides for consumer rights and responsibilities for controllers and processors. Although the bill generally tracks the comprehensive privacy law passed in Virginia last year, the VCDPA, there are some notable differences. Key provisions in the bill include the following:
Continue Reading Utah Legislature Passes Comprehensive Privacy Bill
California Legislature Introduces Bills To Extend Employment and Business-To-Business Data Exemptions
As companies begin to prepare their CPRA compliance strategies, they are grappling with whether to include personal information processed in employment and business-to-business contexts. Currently, the CPRA’s partial exemptions for both of those types of data sunset on December 31, 2022. However, last week, the CA legislature introduced AB 2871
Continue Reading California Legislature Introduces Bills To Extend Employment and Business-To-Business Data Exemptions
U.S. Congress Introduces Kids Online Safety Act
Last week, Senators Richard Blumenthal (D-CT) and Marsha Blackburn (R-TN) introduced the bipartisan Kids Online Safety Act (“KOSA”), which would impose new safeguards, tools, and transparency requirements for minors online. The bill applies to entities that are a “commercial software application or electronic service that connects to the internet and
Continue Reading U.S. Congress Introduces Kids Online Safety Act
California Privacy Protection Agency Clarifies Timing of Forthcoming CPRA Regulations
Last week the California Privacy Protection Agency (“CPPA”) held its sixth Board meeting and first meeting of 2022. The meeting notably included a discussion of the expected timing for issuing final regulations implementing the California Privacy Rights Act.
Continue Reading California Privacy Protection Agency Clarifies Timing of Forthcoming CPRA Regulations