Data Privacy & Security Primer (Recorded)

Until 2018, Americans enjoyed far less protection for the privacy of their personal information than our European counterparts for whom privacy is a human right. It took fifteen years for all the states to follow California’s first data breach reporting statute-and Congress still has not enacted a common standard despite many headline data security breaches-including by foreign actors.

As online commerce developed, American consumer advocates argued for the “opting in consent” of European Union (EU) personal data protection. Arguably, U.S. Internet companies prospered compared to their EU counterparts because of the differential regulation-American acceptance of “click-to-agree contracts” with “opt-out” terms, with limited remedies under the Federal Trade Commission’s jurisdiction over deceptive interstate practices. As the EU’s General Data Protection Regulation came into effect in 2018, implementing FIPs, with many privacy professionals advising multinational companies on compliance in dealing with EU consumers and consumer advocates seeking parity, some of the FIPs found their way into the California Consumer Privacy Act. More than a dozen states have followed with similar “comprehensive” privacy/security statutes. Massachusetts and Congress have considered but not yet enacted similar statutes.

Massachusetts and other states with which we trade have also enacted laws particularly to protect “sensitive” information, including biometric information, and have begun to legislate protections against misuse of “artificial intelligence” as deepfake (image and voice) impersonation and unfairly biased profiling by automated decision-making. Some of these laws have allowed for private enforcement resulting in sometimes coercive class actions. Here again, Congress has not yet acted, and ultimately the states may again follow the lead of the EU in regulating the “digital economy,” including automated decision systems such as “artificial intelligence.”

Join us for a review of the sources and application of current and expected data privacy and security law relevant to lawyers, compliance professionals, and their clients