California

Less than three months ago, California enacted the California Consumer Privacy Act of 2018 (“CCPA”). Industry and privacy watch groups alike have scrutinized the law. This summer saw fierce negotiations all in the name of improving the CCPA. Last Friday, on August 31, 2018, the California legislature passed SB 1121 to amend the CCPA.

The CCPA applies to for-profit entities that conduct business in California. It has an expansive definition of personal information, and grants California residents a number of new rights, including rights to request access to and deletion of certain data, and to opt-out of the sale of data. For a more detailed summary of the CCPA, please see our previous blog post.

SB 1121 largely preserves the substance of the CCPA, but it contains the following technical edits:
Continue Reading California Legislature Passes Amendments to Expansive Consumer Privacy Law

On June 28, 2018, California enacted the California Consumer Privacy Act of 2018 (“CCPA”), which is aimed at strengthening consumer privacy rights and data security protections.  The CCPA takes effect on January 1, 2020 and is considered the most stringent privacy law in the country.

The CCPA applies to for-profit
Continue Reading California Adopts Expansive Consumer Privacy Law

Companies that offer or are considering subscription-based plans should take note that new requirements for automatic renewal offers (“auto-renewals”) take effect in California on July 1, 2018.  California Senate Bill No. 313 (“SB 313”) amends existing law to extend additional protections to consumers where an auto-renewal offer includes a free gift or trial or where promotional pricing will change once the promotional period ends.  It also requires that certain consumers have the ability to opt-out exclusively online.
Continue Reading Updates to California Auto-Renewal Law Take Effect on July 1, 2018

Following the Equifax data breach in 2017, there has been heightened awareness surrounding how credit reporting agencies handle consumers’ personal information. At the same time, recent high-profile attacks, such as the “WannaCry” ransomware attacks, have focused media and regulatory attention on vulnerabilities associated with unpatched systems. In response to these
Continue Reading California Bill Would Mandate Expedient Software Updates for Credit Bureaus

On November 3, Judge Vince Chhabria of the U.S. District Court of the Northern District of California held that federal law does not bar the California Public Utilities Commission (CPUC) from requiring telecommunications companies to hand over, under an adequate protective order, confidential subscriber data to The Utility Reform Network (TURN) as part of an investigation into state market competitiveness.

However, Judge Chhabria also rejected a motion for summary judgment filed by CPUC and TURN because it has not yet been demonstrated that the proposed protective order would, in fact, adequately protect the companies from competitive harm.  Because such protection is a necessary predicate to avoiding a conflict with FCC regulations, Judge Chhabria reasoned, the adequacy of the protective order must be determined before CPUC can force companies to turn over such sensitive data.
Continue Reading California Judge Upholds CPUC Order to Share Confidential Subscriber Data, But Subject to Adequate Protective Order

On November 2, 2016, California Attorney General Kamala Harris released a report outlining best practices for the education technology industry (“Ed Tech”).  In Ready for School: Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data, Attorney General Harris noted the need to implement robust safeguards
Continue Reading California Attorney General Issues Recommendations for Privacy in Ed Tech

Last week, the Third Circuit revived a multi-district privacy lawsuit against Google, finding that the trial court erred in dismissing the plaintiffs’ privacy claims under California state law.  The case centers around the plaintiffs’ allegations that Google violated state and federal law by circumventing the Safari browser’s default “cookie blocker” settings to track users’ online activity while publicly professing to respect users’ Safari browser settings.  While the Third Circuit affirmed the trial court’s dismissal of federal claims under the Wiretap Act, the Stored Communications Act (SCA), and the Computer Fraud and Abuse Act (CFAA), the court vacated the district court’s dismissal of the plaintiffs’ claims under California tort law and the California constitution’s right to privacy.

The plaintiffs’ claims originated from a 2012 Wall Street Journal article describing a researcher’s findings that Google, despite the Safari browser’s default settings intended to blocking tracking cookies, had utilized methods to circumvent these settings and track Safari users’ Internet browsing habits via tracking cookies.  At the same time, the plaintiffs alleged, Google made a series of public statements, including statements within its privacy policy, indicating that it respected the Safari browser’s cookie-blocking settings.  Google subsequently entered into settlements with the Department of Justice and a consortium of state attorneys general over its practices.  Twenty-four plaintiffs also filed putative class action suits against Google and third-party advertisers, alleging violations of federal and state privacy law.  The suits were combined into the instant litigation in the District of Delaware, and in October 2013, the district court dismissed the complaint in its entirety, finding that the plaintiffs failed to state a claim.Continue Reading Third Circuit Resurrects State Law Claims Against Google in Safari Cookie Tracking Lawsuit

By Hannah Lepow

Yesterday California Attorney General Kamala D. Harris released guidance on how smartphone and tablet users can manage GPS and other location tracking functions on their mobile devices.

The brief information sheet, designed for consumers, details how Android and iOS users can control different types of location
Continue Reading California AG Issues Guidance for Consumers on Managing Mobile Location Privacy

By Brandon Johnson

On October 6, 2015, California Governor Jerry Brown signed into law a trio of bills that is intended to clarify key elements of the state’s data-breach notification statute and provide guidance to persons, businesses, and state and local agencies that deal with electronically stored personal information.  The
Continue Reading Three-Bill Package Makes Revisions to California’s Data-Breach Notification Statute

By Brandon Johnson

On October 6, 2015, California Governor Jerry Brown signed into law Assembly Bill 1116 (A.B. 1116), which regulates the manner in which smart TVs must notify users of voice-recognition technology and may use recorded voice commands.  The bill, which was passed unanimously by both houses of the
Continue Reading New California Law Regulates Voice Recognition Technology in Smart TVs