Digital Media and Data Privacy Law Blog

We’ve discussed the importance of privacy assessments here in the past. It is a frustrating realization, indeed, when a company discovers a data breach involving data that it never needed or even knew it kept. 

A proactive company-wide privacy assessment allows your business to carefully evaluate on its own timeline (rather than in the panic of breach response) the company’s data collection, sharing, storage, and security practices.  Vulnerabilities can be identified and addressed, and “stale” privacy and security policies can be updated to reflect current practices.Read More 

Lawyers and compliance professionals constantly tout the importance of internal information security policies, particularly in light of data privacy problems that are reported almost daily in the media.  Admittedly, drafting such policies as a proactive measure can be a pain because there is always a tendency to worry that, unless you’ve suffered a data breach, you are the proverbial “solution in search of a problem.”

But it’s not.  In fact, in some cases, it’s actually required.  HIPAA (for protected health information), Gramm-Leach-Bliley (for financial ... Read More 

Over the last couple years, the SEC’s cybersecurity bark has been worse than its bite.  Its Office of Compliance, Inspections, and Examinations issued examination priorities in 2014.  Commissioner Aguilar warned public company boards that they had better get smart about the topic a few months later.  The results of OCIE’s cybersecurity exam sweep were released in March of this year.  And the Investment Management Division said words, not many words, about investment advisers’ responsibilities in this area in July.

Alleged Facts

What it hasn’t done recently is sue somebody ... Read More