by Maria T. Vullo

Data privacy is a hot topic.  The media seemingly reports on a data breach virtually every day.  Cybersecurity is often referenced as the most significant threat that our country faces.  Indeed, nation states target governments and businesses in order to obtain information and gain leverage in a war that involves a different type of weapon.  At the same time, consumers increasingly are becoming concerned about the use of their private data by businesses that have obtained their information through financial transactions and online purchases.  The big technology companies are facing investigations based on their use, and sale, of private information.  Although there have been a number of highly-publicized data breaches over the last few years, the Equifax data breach, reported in September 2017, attracted significant attention because of the company’s utter failure to employ cybersecurity safeguards and its lack of an incident response plan, which led to legislative hearings, governmental investigations, and private class actions.

With this backdrop, we have seen a proliferation of legislative actions to address data privacy concerns.  The European Union had acted early, with the passage of the General Data Protection Regulation (“GDPR”).[1]   In the U.S., although several proposed statutes have been introduced in Congress, the federal government continues to be plagued by political differences, and thus the states appropriately are responding with new laws to protect their residents.  Last year, California passed the California Consumer Privacy Act (“CCPA”), a particularly broad statute that imposes stringent standards and provides a private right of action for California consumers against companies that have experienced a data breach of their personal information.[2]  Other states followed, including New Jersey and Oregon.  Most recently, New York has joined these other states in enacting data privacy laws to protect the private information of New York residents.[3] Continue reading →