Privacy Law in Review

In December 2015, pursuant to SB 806, California’s Department of Motor Vehicles (DMV) started a pilot program to evaluate the use of alternatives to vehicle stickers, tabs, license plates, and registration cards under specific conditions. The program evaluated the use of electronic registration cards, license plate wraps, and digital license plates. Read more

In early October 2022, a jury found Uber’s former Chief Security Officer, Joseph Sullivan, guilty of obstruction of justice and deliberate concealment of felony related to a 2016 data breach incident at the company. Read more

On October 7, 2022, the U.S. took the next step in achieving an EU adequacy decision (i.e. a decision from the European Commission that a territory or country offers levels of data protection that are essentially equivalent to that within the EU, enabling transfers of personal data to such location): President Biden signed an Executive Order that laid out the steps the United States will take to implement the U.S. commitments under the European Union-U.S. Data Privacy Framework (EU-U.S. DPF), which was announced by President Biden and EU Commission President von der Leyen in March 2022. Read more

This month, the Privacy Law Section is proud to introduce a new feature: Privacy Talks: Interviews with California Privacy Leaders. Read more

On January 13th, 2022, the Austrian data protection authority ("DSB") published its decision concerning the use of Google Analytics by a health website called "netdoktor.at."  The DSB held that the website operator violated Article 44 of the GDPR by failing to ensure that personal data transferred to Google in the United States had been afforded an "adequate" level of protection that should be equivalent to the level of protection offered in the EU. Read more

In the wake of the Dobbs decision, there were a range of responses from government agencies and tech companies. Each party attempted to address public concerns about the potential data privacy repercussions of a post-Roe world and the stark reality women seeking abortions are facing across the country. Provided below is a round-up of responses. Read more

While the fate of the American Data Privacy Protection Act remains in legislative limbo, federal agencies, states, and Congress have signaled their commitment for greater children’s online privacy protections. On August 30, 2022, California officially passed the California Age-Appropriate Design Code Act (“CAADC”), being signed into law by Governor Gavin Newsome on September 15, 2022). The CA AADCA is modeled after the UK’s Age-Appropriate Design Code. Read more

It’s becoming standard for trade groups that oppose privacy legislation to claim that strict scrutiny applies to privacy statutes, and therefore, those laws presumptively violate corporations’ free speech rights. Lawyers have offered this argument in cases challenging the Illinois Biometric Information Privacy Act and in statements against California’s Age-Appropriate Design Code, among other examples. This argument has not been a winning one. A Maine court went so far as to call it a “shoot for the moon” claim. But is the argument legally sound? The evidence suggests not. Read more

It's been a while since our last adtech update, and the industry is still uncertain (and CPRA hasn’t even come into effect yet!). So let’s dive into the big privacy adtech news, starting with the most recent news. Read more

California privacy never sleeps.  On September 20, 2022 Governor Gavin Newsome signed into law AB-2273, “The California Age-Appropriate Design Code Act” (“the Act”). Modeled after the United Kingdom’s Age-Appropriate Design Code, the Act is intended to modernize online protections for children 17 and under by requiring a business, as defined under the California Consumer Privacy Act (CCPA), that provides an online service, product, or feature likely to be accessed by children to comply with numerous provisions.  Read more