Tech & Sourcing @ Morgan Lewis

The Federal Trade Commission (FTC) recently adopted a final rule amending its Standards for Safeguarding Customer Information (commonly referred to as the “Safeguards Rule”) to require financial institutions to report certain data breaches and other security events to the FTC.

In October, California enacted its newest privacy legislation, commonly referred to as the “Delete Act” (California Senate Bill No. 362). The Delete Act will allow consumers to request that any data broker that maintains any personal information related to that consumer delete such personal information.

The UK government has announced the UK extension to the EU-US Data Privacy Framework, known as the UK-US data bridge. The new framework will allow businesses to transfer personal data between the United Kingdom and the United States. This blog post  explores the significance of the UK-US Data Bridge and what it means for businesses on both sides of the Atlantic.

The United Kingdom’s Information Commissioner’s Office and data protection authorities from Canada, Australia, Hong Kong, Mexico, Switzerland, Norway, New Zealand, Colombia, Jersey, Morocco, and Argentina have released a joint statement on data scraping and its impact on data privacy.

In a recent LawFlash, George Cyriac and Dr. Axel Spies reviewed key features of India’s new privacy law—the Digital Personal Data Protection Act, 2023 (DPDP Act). They also discussed what to expect regarding and how to prepare for these new requirements, including that India’s central government may enact separate rules to give effect to certain provisions of the DPDP Act.

In recent years, the gambling industry has seen significant growth, with online betting and gaming platforms becoming increasingly popular. However, this rapid expansion has also raised concerns about the potential for money laundering, fraud, and problem gambling. To address these issues, the UK Information Commissioner's Office (ICO) issued an open letter to UK Finance (an industry body for banking and financial services) urging the association to support responsible data sharing for financial checks in the gambling industry.

In a major victory for privacy professionals, technology companies, and those intending to use healthcare data to feed artificial intelligence algorithms, the US Court of Appeals for the Seventh Circuit recently rejected a putative class action regarding the collection and exchange of anonymized healthcare data.

Morgan Lewis partner Greg Parks recently authored an Insight regarding developments in US data privacy law and increased attention on data privacy and security by the US Congress and certain federal agencies.

The EU-US Data Privacy Framework (DPF) became effective on July 10, and on the same day, the European Commission adopted an Adequacy Decision relating to the DPF, as a successor of the EU-US Privacy Shield. While only those companies subject to the jurisdiction of either the Federal Trade Commission or the US Department of Transportation are eligible to self-certify their compliance with the DPF, the scope of eligibility is likely to broaden in the future.

As part of our Spotlight series, we welcome Todd Liao, a partner in our Shanghai office who works with clients on a wide range of complex commercial and financial transactions and legal issues involving China. Todd is a thought leader on issues facing tech firms doing business in China, recently publishing articles on new measures for online advertising in China, data privacy, and key drivers of Asia’s tech scene. We caught up with Todd to discuss data privacy regulations in China and cross-border data transfers.