The GDPR and Special Category Data

The GDPR articulates certain principles governing the processing of personal data, which is broadly defined to include any information that can be used to directly or indirectly identify a particular person. Beyond these general provisions however, the GDPR, like its predecessor the Data Protection Directive, enumerates certain restrictions and requirements for the processing of certain… Continue reading The GDPR and Special Category Data

The GDPR’s Territorial Scope

The GDPR represents a complete overhaul to the EU’s current privacy framework. The GDPR is intended to have broader and more comprehensive rules regarding the processing, use, and storage of personal data than the EU’s prior Data Protection Directive 95/46/EC. More importantly, unlike the Data Protection Directive the GDPR will not require transposition into legislation… Continue reading The GDPR’s Territorial Scope

SEC Issues Interpretive Guidance on Cybersecurity Disclosures

Last week the U.S. Securities and Exchange Commission (SEC) published new cybersecurity guidance for public companies. The guidance reinforces and expands upon a 2011 SEC publication, and highlights two additional topics: (1) the importance of robust cybersecurity disclosure policies and procedures and (2) the application of insider trading prohibitions in the cybersecurity context. Disclosure Controls and… Continue reading SEC Issues Interpretive Guidance on Cybersecurity Disclosures

The DOJ Announces the Creation of a New Cybersecurity Task Force

On Tuesday, Attorney General Jeff Sessions announced that the Department of Justice would create a “Cyber-Digital Task Force” designed to investigate and identify ongoing global cybersecurity threats. According to a press release issued by the Justice Department, the proposed task force would prioritize its efforts on specific areas of cybersecurity risk, including efforts to interfere… Continue reading The DOJ Announces the Creation of a New Cybersecurity Task Force

Oregon Legislation Alert

This week, Oregon lawmakers introduced a bill (HB4147) that would require companies to notify consumers within 45 days of discovering a data breach of their personal information. The so-called “Equifax Bill” also would prohibit companies from charging consumers or requesting their credit or debit card numbers to redeem offers for free credit card monitoring or a… Continue reading Oregon Legislation Alert