by Lori E.Lesser, Nicholas S. Goldin, Jessica N. Cohen, Melanie D. Jolson, Corina McIntyre, Alysha J. Sekhon, Bobbie Burrows, and Kate E. Mirino
On May 10, 2022, Connecticut’s Senate Bill 6 titled “An Act Concerning Personal Data Privacy and Online Monitoring” (CTDPA) was signed by Governor Ned Lamont, making Connecticut the fifth state to enact its own comprehensive consumer privacy law, after California, Colorado, Utah and Virginia.[1]
by Nicholas S. Goldin, Lori E. Lesser, Melanie D. Jolson, and Shanice D. Hinckson
Tucked into the recently enacted 2022 Consolidated Appropriations Act is the Cyber Incident Reporting for Critical Infrastructure Act (the “Act”), which will—once effective—significantly expand the obligation of[1] companies in the energy, communications, financial services and other critical infrastructure sectors to report a range of cyberattacks and ransomware payments. This broad-based federal cyber incident reporting requirement comes on the heels of cyber disclosure rules recently proposed by the Securities and Exchange Commission for public companies.[2]
by Brooke Cucinella, Stephen M. Cutler, Sarah L. Eichenberger, Nicholas S. Goldin, Joshua A. Levine, Michael J. Osnato, Jr., and Jonathan S. Kaplan
On January 11, 2021, based on the consent—and indeed, at the request of the Department of Justice (“DOJ”)—the Supreme Court vacated and remanded the Second Circuit’s decision in United States v. Blaszczak. Blaszczak was the controversial 2-1 decision that arguably heightened (some say unfairly) the risk of criminal insider trading prosecution by upholding the multi-count convictions of the defendants for, at bottom, illegally trading while in possession of information stolen from the government. The Supreme Court agreed, remanding to the Second Circuit to reconsider its decision in light of the Court’s intervening decision in Kelly v. United States. Kelly overturned the convictions that had stemmed from New Jersey’s infamous BridgeGate scandal by finding that, in that case, the government information at issue was not “property” as would have been required to sustain a conviction under the wire fraud theory, and that while “allocating lanes” on the bridge required “the time and labor of Port Authority employees,” those expenditures were “incidental” to “run-of-the-mine exercise of regulatory power,” rather than a misappropriation of government property.[1]
by Lori E. Lesser, Nicholas S. Goldin, Vanessa K. Burrows, and Andrew M. Kofsky
Most companies must collect and use information about their employees’ travel plans and health conditions to protect their workforce from the spread of coronavirus disease 2019 (“COVID-19”). This memorandum addresses strategies for U.S. companies to comply with various privacy laws in connection with these activities.[1] Continue reading