The European Court of Justice (CJEU) recently issued a significant final decision affecting the online advertising industry, particularly concerning the Transparency and Consent Framework (TCF) developed by the Interactive Advertising Bureau (IAB) Europe. This framework is widely used across the industry to manage users' consent preferences for data processing, known as the Transparency and Consent String (TC String). In essence, the TCF is designed to facilitate the buying and selling of online advertising space by these operators. Here's a breakdown of the court's ruling and its potential implications.
Tech & Sourcing @ Morgan Lewis
TECHNOLOGY TRANSACTIONS, OUTSOURCING, AND COMMERCIAL CONTRACTS NEWS FOR LAWYERS AND SOURCING PROFESSIONALS
In our January 2023 blog post, Study Finds Average Cost of Data Breaches Reaches All-Time High in 2022, we highlighted the key findings of the Ponemon Institute’s Cost of a Data Breach Report 2022. Each year, the report sets forth a vast dataset analyzing data breaches at hundreds of organizations to spot trends and developments in security risks and best practices. Recently, Ponemon Institute published its Cost of a Data Breach Report 2023, showing an increase in data breach costs in many areas of business.
Despite Delayed Adoption of Final Regulations, CPRA Is Enforceable As of Initial Enforceability Date
The Court of Appeal of the State of California (the Court of Appeals) recently ruled that Proposition 24, the California Privacy Rights Act of 2020 (CPRA), is enforceable without any further delay. The CPRA contains important changes to the California Consumer Privacy Act, including with respect to online advertising.
Join partners Don Shelkey, Kirstin Hadgis, and Ezra Church at 11:30 am–1:00 pm ET on Tuesday, February 27, 2024 as they discuss key considerations that may impact M&A transactions related to privacy and data security. The session will include a spotlight on the impact of artificial intelligence on such transactions.
The Federal Trade Commission (FTC) recently adopted a final rule amending its Standards for Safeguarding Customer Information (commonly referred to as the “Safeguards Rule”) to require financial institutions to report certain data breaches and other security events to the FTC.
In October, California enacted its newest privacy legislation, commonly referred to as the “Delete Act” (California Senate Bill No. 362). The Delete Act will allow consumers to request that any data broker that maintains any personal information related to that consumer delete such personal information.
The UK government has announced the UK extension to the EU-US Data Privacy Framework, known as the UK-US data bridge. The new framework will allow businesses to transfer personal data between the United Kingdom and the United States. This blog post explores the significance of the UK-US Data Bridge and what it means for businesses on both sides of the Atlantic.
Technology transactions, outsourcing, and commercial contracts (TOC) group member Don Shelkey, together with Morgan Lewis lawyers Stephanie Sweitzer, Levi McAllister, Jason Mills, and Samantha Ojo, will present a continuing legal education (CLE) webinar on planning for the 2026 Men’s World Cup on October 11, 2023 from 1:00–2:00 pm ET, as part of the Morgan Lewis World Cup Strategic Initiative.
The United Kingdom’s Information Commissioner’s Office and data protection authorities from Canada, Australia, Hong Kong, Mexico, Switzerland, Norway, New Zealand, Colombia, Jersey, Morocco, and Argentina have released a joint statement on data scraping and its impact on data privacy.
In a recent LawFlash, George Cyriac, Wai Ming Yap, and Dr. Axel Spies reviewed key features of India’s new privacy law—the Digital Personal Data Protection Act, 2023 (DPDP Act). They also discussed what to expect regarding and how to prepare for these new requirements, including that India’s central government may enact separate rules to give effect to certain provisions of the DPDP Act.