Cross-Border Transfers under the GDPR

The GDPR generally prohibits data transfers to non-EU countries unless the data can expect an “adequate level of protection” abroad. The GDPR provides various mechanisms for permitting data transfers and establishes a clear hierarchy among those mechanisms. The first is whether there is an adequate level of protection in place. If there is no adequate… Continue reading Cross-Border Transfers under the GDPR

SEC Issues Interpretive Guidance on Cybersecurity Disclosures

Last week the U.S. Securities and Exchange Commission (SEC) published new cybersecurity guidance for public companies. The guidance reinforces and expands upon a 2011 SEC publication, and highlights two additional topics: (1) the importance of robust cybersecurity disclosure policies and procedures and (2) the application of insider trading prohibitions in the cybersecurity context. Disclosure Controls and… Continue reading SEC Issues Interpretive Guidance on Cybersecurity Disclosures

Oregon Legislation Alert

This week, Oregon lawmakers introduced a bill (HB4147) that would require companies to notify consumers within 45 days of discovering a data breach of their personal information. The so-called “Equifax Bill” also would prohibit companies from charging consumers or requesting their credit or debit card numbers to redeem offers for free credit card monitoring or a… Continue reading Oregon Legislation Alert

Oregon’s Data Breach Notification Law

If you do business in Oregon and own, maintain, or possess data about Oregon residents, you must comply with Oregon’s Consumer Identity Theft Protection Act (the “Act”). The Act requires the implementation of reasonable safeguards to protect the security, confidentiality, and integrity of personal information. Personal information is defined as: Social Security number, driver’s license… Continue reading Oregon’s Data Breach Notification Law