article thumbnail

Effective Access Controls, Timely Breach Notification, and Other Takeaways from the Latest NYDFS Cyber Resolution

Debevoise Data Blog

The charges against First American Title Insurance Company are pending with an August 16 hearing date , and last month, the DFS reached its first full cybersecurity resolution with Residential Mortgage Services. This likely resulted in unauthorized access to certain customers’ nonpublic information.

article thumbnail

Seven Tips for Reducing CCPA Litigation Risks – Lessons from the First 18 Months

Debevoise Data Blog

Since the implementation of the California Consumer Privacy Act (“CCPA”) 18 months ago, more than 75 lawsuits have been filed seeking damages using the Act’s private cause of action. The CCPA provides a cause of action to “[a]ny consumer whose nonencrypted and nonredacted personal information.

professionals

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Trending Sources

article thumbnail

Understanding the CCB’s First Two Final Determinations (Guest Blog Post–Part 3 of 3)

Eric Goldman

Step Two: The CCB does a compliance review of the filed claim to determine if the claim qualifies for the CCB. Others have dropped out because they did not pass the compliance review, the respondent opted out, or for other reasons). Mitrakos, 22-CCB-0035 , February 15, 2023, and Oppenheimer v. Prutton, 22-CCB-0045 , February 28, 2023.

article thumbnail

Comments on the Ruling Declaring California’s Age-Appropriate Design Code (AADC) Unconstitutional–NetChoice v. Bonta

Eric Goldman

The age estimation and privacy provisions thus appear likely to impede the “availability and use” of information and accordingly to regulate speech.” [Sorry it’s take me this long to get this blog post off my desk. I hope it was worth the wait.] their website).

Court 78
article thumbnail

First Resolution by the DFS Under Its Cyber Rules Highlights the Risks of Inadequate Cyber Investigations and the Importance of Satisfying State Breach Notification Obligations

Debevoise Data Blog

That hearing is scheduled for April 5. million penalty for several violations including: Failure to investigate whether an attacker, who compromised a single email mailbox, accessed private data of individuals. Failure to satisfy various state breach notification obligations. Failure to notify the DFS of the incident.

article thumbnail

Complying with New York’s AI Employment Law and Similar Regulations

Debevoise Data Blog

The Automated Employment Decision Tool Law (“AEDT”) places compliance obligations on employers in New York City that use AI tools, rather than software vendors who create the tools. For companies subject to the AEDT, compliance obligations include: Conducting an Independent, Annual Bias Audit. What Does the AEDT Require?

Law 40
article thumbnail

Two Separate Courts Reiterate That Online Age Authentication Mandates Are Unconstitutional

Eric Goldman

Many recent laws essentially mirror the “protect the kids online” initiatives of the 1990s and early 2000s, all of which failed as unconstitutional. In 1996, Congress passed the Communications Decency Act (CDA) to restrict minors’ access to indecent and patently offensive content online.

Court 124