The Ninth Circuit recently held that the Children’s Online Privacy Protection Act, which gives the Federal Trade Commission authority to regulate the online collection of personal information from children under the age of 13, does not preempt consistent state law, potentially increasing the risk of class action litigation based on alleged COPPA violations. See Jones
Data Privacy
Colorado Attorney General Releases Revised Colorado Privacy Act Draft Rules
By Libbie Canter, Lindsey Tonsager & Jayne Ponder on
The Colorado Attorney General released updated draft rules interpreting the Colorado Privacy Act on December 21, 2022 (“Draft Rules”). These revisions follow a series of stakeholder sessions on November 10th, 15th, and 17th. The Attorney General will convene a formal rulemaking hearing on February 1, 2023. In advance of the formal rulemaking hearing, stakeholders may submit written comments for consideration. …
Continue Reading Colorado Attorney General Releases Revised Colorado Privacy Act Draft Rules
European Commission Releases Draft Adequacy Decision on the EU-U.S. Data Privacy Framework
By Dan Cooper, Lisa Peets, Diana Lee & Laura Somaini on
On December 13, 2022, the European Commission released its draft adequacy decision on the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), which, once formally adopted, would recognize that the United States ensures an adequate level of protection for personal data transferred from the EU to organizations certified under the EU-U.S. DPF. The draft decision follows the issuance of Executive Order 14086 on Enhancing Safeguards for U.S. Signals Intelligence Activities (“EO 14086”) by President Biden on October 7, 2022 (see our previous blog post here), and the political agreement reached between the EU and the U.S. in March 2022 (see our previous blog post here).
As many had expected, the draft adequacy decision assesses the limitations and safeguards relating to the collection and subsequent use of personal data transferred to controllers and processors in the United States by U.S. public authorities. In particular, the draft decision assesses whether the conditions under which the U.S. government may access data transferred to the United States fulfill the “essential equivalence” test pursuant to Article 45(1) of the GDPR, as interpreted by the Court of Justice of the European Union (“CJEU”) in Schrems II (see our previous blog post here). …
California Expands the Scope of the CMIA to Cover Certain Digital Mental Health Services and Information
In a new post on the Covington Digital Health blog, our colleagues discuss a recent amendment to California’s Confidentiality of Medical Information Act (“CMIA”) that expands the scope of the law to cover mental health services that are delivered through digital health solutions and the associated health information generated from these services. …
FTC Flexes ROSCA Muscle With $100 Million “Dark Patterns” Settlement with Vonage
By Yaron Dori, Laura Kim, Nikhil Singhvi & Sarah Parker on
On November 3, the FTC announced that it entered into a significant $100 million settlement with Vonage to resolve allegations relating to the internet phone service provider’s sales and autorenewal practices. The FTC alleged that Vonage violated both the FTC Act and the Restore Online Shoppers’ Confidence Act (ROSCA) by failing to provide a simple cancellation mechanism, failing to disclose material transaction terms prior to obtaining consumers’ billing information, and charging consumers without consent.…
Continue Reading FTC Flexes ROSCA Muscle With $100 Million “Dark Patterns” Settlement with Vonage
Colorado Attorney General Releases Draft CPA Rules
On October 10, 2022 the draft rules implementing the Colorado Privacy Act (“CPA”) were officially published in the Colorado Register. Written comments on the draft rules are due by November 7, 2022. The CPA draft rules share some similarities with the draft rules set forth by the California Privacy Protection Agency (“CPPA”) interpreting the California Privacy Rights Act (“CPRA”). Both sets of draft rules address requirements for privacy policy disclosures, consumer rights requests, and providing opt-out mechanisms. However, there are a number of key differences between the two drafts. We highlight some of these below.…
Continue Reading Colorado Attorney General Releases Draft CPA Rules
Brazil’s ANPD Launches Public Consultation on the Processing of Minors’ Personal Data
Posted in Children's Privacy, Data Privacy
On September 8, 2022, the Brazilian Data Protection Authority (“ANPD”) launched a public consultation on the processing of minors’ personal data (encompassing children under 12-years-old and adolescents between the ages of 12- and 18-years-old). The consultation will conclude on October 7, 2022. According to the ANPD, the purpose of the consultation is to resolve divergent interpretations among public authorities, academics, privacy professionals, and representatives of civil society regarding the Brazilian Data Protection Law’s (“LGPD”) provision on the processing of minors’ personal data (Article 14). The Authority will use the feedback it receives to draw up guidelines on the topic and, possibly, amend the LGPD.…
CNIL Tests Tools to Audit AI Systems
By Kristof Van Quathem & Alix Bertrand on
With the growing use of AI systems and the increasing complexity of the legal framework relating to such use, the need for appropriate methods and tools to audit AI systems is becoming more pressing both for professionals and for regulators. The French Supervisory Authority (“CNIL”) has recently tested tools that could potentially help its auditors…
Brussels Appeal Court Refers IAB Europe Case to CJEU
By Kristof Van Quathem on
On September 7, 2022, the Brussels Market Court adopted an interim decision in a case brought by IAB Europe, the sector organization for the digital marketing industry, against the Belgian Supervisory Authority. The authority had fined IAB Europe alleging that its Transparency and Consent Framework (“TCF”) violates the GDPR and that the organization is a (joint) data controller for processing operations performed by the users of the standard, i.e., publishers and adtech vendors. Under the decision, IAB Europe was also required to present a work plan to remediate the alleged violations.…
Continue Reading Brussels Appeal Court Refers IAB Europe Case to CJEU
China Releases Guidance on Cross-border Data Transfer Security Assessment Application
On August 31, 2022, one day before the Measures for Security Assessment of Cross-border Data Transfer (“Measures”) were scheduled to take effect, the Cyberspace Administration of China (“CAC”) released a first edition of its guidance on how organizations should complete the security assessment application (“CAC Guidance”). Covington’s previous posts on the Measures can be found here.…