Data Privacy and Protection Strategies

In addition to providing external guidance and support, the DOE has also continued efforts to enhance its own cybersecurity following recent cyberattacks. Additionally, companies handling personally identifiable information, financial data, healthcare records, and biometric data are therefore advised to review their cross-border data transfer agreements and conduct data risk assessments, ensure localization of critical datasets, and implement sufficient contractual protections when dealing with international data partners. Additionally, the effective date of the agency’s final rule issued in October 2024 under Section 1033 of the Consumer Financial Protection Act (CFPA) requiring certain financial institutions to make data such as account and transaction information available upon request to consumers and authorized third parties has been suspended. Although most states offer consumers the right to opt out of targeted advertising and the right to access and delete their data, https://real-apartment.com/what-is-business-insurance-and-how-to-choose-the-right-protection-options.html many states provide additional consumer protections.

These changes include an expansion of the definition of sensitive personal information, additional requirements for implementing consumer rights, and updates to the opt-out framework. Additionally, https://24thainews.com/the-cybersecurity-revolution-with-the-advent-of-pen-testing.html the CPPA announced changes to its leadership. While previous rules have made it clear that consumers have a right to revoke their consent to receive automated calls and messages, the new rules require that revocation requests be honored within a reasonable time, not to exceed 10 business days from receipt.

These requirements vary by jurisdiction and may include laws such as the General Data Protection Regulation (GDPR) in Europe or the California Consumer Privacy Act (CCPA) in the United States. Data minimization techniques include collecting only essential data, anonymizing or pseudonymizing data where possible, and implementing retention policies to delete data when it is no longer needed. This helps maintain customer trust and ensures compliance with global data protection regulations like the GDPR in Europe or the CCPA in the United States. Across various industries, companies must adhere to data protection regulations and internal data governance, emphasizing the importance of data privacy. An emerging field in this context is privacy engineering, which is fundamentally about incorporating privacy principles directly into the design and development of IT systems, networks, and business practices. Additionally, data security is an element of data privacy and involves the implementation of measures to ensure data are kept safe from corruption and unauthorized access while preserving confidentiality, integrity, and availability (CIA).1

International Privacy Laws

Additionally, CISA has been involved in investigations regarding allegations that the People’s Republic of China (PRC) targeted commercial telecommunications infrastructure. The court reasoned that the SEC’s position that its authority to regulate an issuer’s “system of internal accounting controls” includes the authority to regulate cybersecurity controls was “not tenable,” and unsupported by the statute, legislative intent, or precedent. In addition, numerous federal agencies—including the FTC, SEC, CFPB, DOJ, and HHS—promulgated privacy and data protection regulations and guidance on a range of issues, including children’s online privacy, biometric data, health data, location data, data brokers/national security, and cybersecurity incident disclosure, among other issues.

This includes the right to know what information a business has and how it is shared or used, the right to delete that information, the right to opt out of that data being sold to third parties. Access controls enable organizations to apply rules around who can access data and systems in their digital environments. Attackers use malware to infect computers and corporate networks by exploiting vulnerabilities in their software, such as web browsers or web applications.

• In addition to providing external guidance and support, the DOE has also continued efforts to enhance its own cybersecurity following recent cyberattacks.
• Additionally, the effective date of the agency’s final rule issued in October 2024 under Section 1033 of the Consumer Financial Protection Act (CFPA) requiring certain financial institutions to make data such as account and transaction information available upon request to consumers and authorized third parties has been suspended.
• Additionally, companies handling personally identifiable information, financial data, healthcare records, and biometric data are therefore advised to review their cross-border data transfer agreements and conduct data risk assessments, ensure localization of critical datasets, and implement sufficient contractual protections when dealing with international data partners.
• With people spending more than six hours per day on the internet, companies gather troves of personal information from consumers’ digital footprints.
• Although most states offer consumers the right to opt out of targeted advertising and the right to access and delete their data, many states provide additional consumer protections.

People building and updating systems can use privacy by design and privacy engineering strategies and techniques. A well-designed DLP system enables real-time monitoring of data movement across networks, endpoints, and cloud storage systems, allowing for immediate intervention in the event of potential data breaches. One of the victims of the vast system of disruption includes healthcare workers, who are targeted by compromised systems by infections and then having their data attacked. Hackers who use malware typically utilize many types of malware, which includes computer virus, computer worms, ransomware, spyware and Trojan horse to create a vast system of disruption and cause easy data theft. This includes using encryption, firewalls, and other technical solutions to keep malicious actors at bay.

Businesses that have invested in compliance with recent CFPB mandates must now reassess their strategies in light of shifting federal priorities and the possibility of increased state and private litigation risk. In the near term, regulated parties can expect new CFPB leadership to critically examine these initiatives—likely rescinding some rules and guidance, and continuing to drop certain enforcement actions while continuing to pursue others. Although not an enforcement action, the FTC additionally examined the data collection and use practices of nine big technology companies, which eventually led to a report upon which the FTC based recommendations to policymakers and companies. The FTC made this denial without prejudice to enable the ESRB to re-file the application in the future, when the FTC anticipates that additional information will assist in the understanding of age verification technologies. Consistent with the agency’s recent focus on consumer data retention, the settlement requires the corporate landlord to delete all financial data collected from consumers outside limited circumstances. The law also enables employers to require employees to disclose access information to a Personal Account on the employer’s internal information systems, or to an account used for business purposes.

Additionally, compliance with data residency and sovereignty regulations becomes crucial when managing personal data in cloud environments. With people spending more than six hours per day on the internet, companies gather troves of personal information from consumers’ digital footprints. After an international law firm discovered a significant cybersecurity breach of its systems, plaintiffs brought a putative class action lawsuit against the firm asserting multiple claims, including violations of the CCPA. Cyber Trust Mark” to help consumers differentiate trustworthy products and will also include a scannable QR code with additional product information.

Privacy and Data Protection Strategies

HHS made data privacy and cybersecurity a key focus in 2024, ramping up enforcement efforts for HIPAA violations, including actions involving “ransomware, phishing, health information left unsecured on the internet, impermissible access to electronic PHI, reproductive health information impermissibly disclosed, and untimely patient access to PHI.” The rule also requires covered entities to obtain signed attestations for specific requests related to reproductive health care and mandates that these entities update their Notice of Privacy Practices to reflect these new privacy protections. The rule strengthens patient protections by aligning enforcement with HIPAA, introducing civil penalties for violations, requiring specific consent for substance use disorder counseling notes, and creating a safe harbor for investigative agencies acting with reasonable diligence before requesting records. Additionally, on June 24, 2024, the SEC issued five new compliance and disclosure interpretations addressing hypothetical scenarios involving the public company disclosure requirement.

Information on developments outside the United States—which are relevant to domestic and international companies alike—will be covered in Gibson Dunn’s forthcoming International Cybersecurity and Data Privacy Review and Outlook, and additional developments relevant to AI will be covered in the Artificial Intelligence Review and Outlook. Additionally, balancing privacy with functionality can be tricky, as stronger privacy protections sometimes mean less convenience or personalized services. Additionally, even the best security measures can be undermined by human error, such as employees clicking malicious links, using weak passwords, or failing to follow security protocols.

Data Privacy vs. Data Security: Scope and Focus

Litigation likewise remained active in 2024, with a continued uptick in claims by private litigants and government entities related to data breaches, federal and state wiretapping laws, and state biometrics laws. In addition to satisfying customers, they need to comply with government-enforced regulations, including rules governing the storage of card payment and health information, along with the systems used to do so. For example, in season 2 of the HBO medical drama The Pitt, hospital leadership shuts down the hospital’s internal digital systems as a pre-emptive defense against a ransomware attack.

A California state court, meanwhile, denied class certification in a case asserting claims for invasion of privacy and for violations of the federal Wiretap Act, CIPA, and related common law claims arising from Meta’s offering of “Business Tools” to HBO and its alleged tracking of users’ video-viewing activities. Internet Tracking Litigation, 956 F.3d 589 (9th Cir. 2020), for support, reasoning that the Ninth Circuit had found the plaintiffs in that case “had sufficiently alleged their data carried financial value” under the CDAFA. As was the case last year, in 2024, several district courts considered CDAFA claims as part of the recent wave of litigation related to website tracking technologies.