Privacy Update John L. Wood – Egerton, McAfee, Armistead & Davis, P.C. jlw@emlaw.com TSCPA – August 20, 2019 Copyright 2019 John L. Wood

Overview European Legal Requirements – Comprehensive What are you protecting? United States Legal Requirements - Sectional HIPAA Graham, Leach, Bliley State notification laws FTC enforcement New State laws – California (Effective January 1, 2020) European Legal Requirements – Comprehensive GDPR (Effective May 25, 2018) Copyright 2019 John L. Wood

Facebook fined $5 billion for Cambridge Analytica leak FTC fines Facebook Facebook fined $5 billion for Cambridge Analytica leak Biggest fine in FTC history Copyright 2019 John L. Wood

All 50 States have notification laws California was first - September 25, 2002 Copyright 2019 John L. Wood

Uber’s Failed to Notify 148 Million September 2018 – Uber settled with all 50 states for failure to notify Uber paid 148 Million Tennessee received 1.7 million Copyright 2019 John L. Wood

Uber’s problem Uber stored personal information on Amazon Web Services A hacker downloaded the personal information of over 47 million individuals What did Uber do wrong? stored personal information in clear text Allowed users to reuse credentials Did not require multi-factor authentication. Copyright 2019 John L. Wood

Uber paid the hacker’s $100,000 Uber’s Fix Uber paid the hacker’s $100,000 Uber was assured the data was never leaked There is no indication that the data was ever leaked Uber failed to follow the notification laws Copyright 2019 John L. Wood

California Consumer Privacy Act (CCPA) Signed into law on June 28, 2018 Takes affect January 1, 2020 Key Principle – Users have control over their data Copyright 2019 John L. Wood

CCPA Private Information Names Addresses Email Address IP address Cookies Etc. Copyright 2019 John L. Wood

CCPA Applicaton Notice (1798.130) Right to Access(1798.100) Privacy Notice Right to Access(1798.100) Use of information must be disclosed (1798.110(c)(3)) Information must be provided in portable format Right to be forgotten (1798.105) Right to opt out (1798.120) Cannot discriminate if rights are exercised (1798.125) Provide a link titled “Do Not Sell My Personal Information” (1798.135) Allows the consumer to opt-out Copyright 2019 John L. Wood

CCPA Threshhold CCPA applies to businesses that have: Annual gross revenues in excess of $25,000,000; Buys, receives, sells or shares the personal information of 50,000 or more consumers; or Derives 50 percent or more of its annual revenues from selling consumers’ personal information. Copyright 2019 John L. Wood

Disclosures Statutory damages $100 - $750 per consumer per incident Private right of action Class actions are allowed 30 day right to cure in some situations Copyright 2019 John L. Wood

Violations Actions brought by the California Attorney General Up to $7,500 for each violation Copyright 2019 John L. Wood

CCPA Amendments California legislature is currently considering amendments to CCPA Bill 561 – Sought to expand private right of action beyond breaches Did not pass Bill 753 – Would exclude advertising cookies from definition of sale Bill 846 – Would exclude customer loyalty programs Copyright 2019 John L. Wood

What should a business do? Change Your Approach to Personal Information The Consumer owns their data Build in consumer rights Right to opt-out Right to be forgotten Right to Access/Portability Consider Do Not Sell My Information link Copyright 2019 John L. Wood

GDPR affects United States companies GDPR applies to any processor or controller that processes personal data of individuals who are in the European Union. May 25, 2018 Implementation Copyright 2019 John L. Wood

GDPR – Users control their data Right to rectification – right to correct personal data. Article 16 Right to be forgotten – right to delete personal data. Article 17 Right to restriction of processing. Article 18 Right to be informed. Article 19 Right to data portability. Article 20 Right to object. Article 21 Right not to be subject to automatic decision making. Article 22 Copyright 2019 John L. Wood

GDPR – Users Consent Must have a legal basis to use personal data Consent is a legal basis Consent has to be separately given for each type of processing Consent cannot be required Copyright 2019 John L. Wood

GDPR lawsuits January 21, 2019 – Google fined $57 million Consent was not sufficiently informed Google received consent for all actions But, consent must be specifically given Copyright 2019 John L. Wood

Questions? Copyright 2019 John L. Wood