- Home
- >
- Our Thinking
- >
- Trending Topics
- >
- US Consumer Privacy Acts
US Consumer Privacy Acts
Influenced by California’s Consumer Privacy Act (CCPA) and Europe Union’s General Data Protection Regulation (GDPR), a wave of new data privacy legislation has been introduced across the United States, including updates in California. Visit this page for the latest developments during this critical juncture in US privacy regulation.
California
The far-reaching CCPA of 2018 is now in full effect for nonemployee information. The CCPA can be enforced by the California Attorney General with the possibility of statutory penalties for noncompliance. Private plaintiffs can sue in certain circumstances. In the future, the CCPA will be enforced by a new California privacy regulator, the California Privacy Protection Agency.
The CCPA created an array of new consumer privacy rights that require many companies doing business in California to reassess their collection and use of personal information and modify their business processes to accommodate the new rights of consumers. It allows California consumers to make requests of businesses to disclose what personal information the business has shared and also to delete or no longer share that information.
Virginia
Virginia is the second US state to pass a comprehensive data privacy law, the Virginia Consumer Data Protection Act (VCDPA). The VCDPA has a number of key similarities to the CCPA, CPRA, and GDPR, and it follows a similar framework with proposed data privacy bills pending in other statehouses. The VCDPA, which takes effect on January 1, 2023, will require companies doing business in Virginia to reassess their collection and use of consumer personal information and modify their business practices to account for Virginia’s new requirements. Among other requirements, the VCDPA gives Virginia consumers the right to request access, correct, or delete their personal information. It requires companies to offer consumers an opt-out and mandates express consent for certain uses of personal information. The VCPDA will be enforced by the Virginia Attorney General.
Colorado
Colorado, the third state to enact comprehensive privacy legislation, signed into law the Colorado Privacy Act (CPA) on July 8, 2021. The CPA is effective on July 1, 2023. Like the CCPA and other state laws, the CPA will require companies to respond to rights requests from Colorado consumers and take other steps to ensure privacy and reasonable security. It will also require companies to allow consumers to opt-out of targeted advertising, the sale of their personal information, and profiling decisions. Consumers will have the right to access, correct, delete, and obtain a copy of their personal information on a portable format. Like other state laws, Colorado will require companies to provide a privacy notice, minimize use of personal information, and process sensitive personal information only after obtaining consent. The CPA will be enforced by the Colorado Attorney General, with violations considered deceptive and unfair trade practices.
In addition to California, Virginia, and Colorado, many other state legislatures have introduced privacy bills inspired to varying degrees by the CCPA.
States Where Consumer Privacy Legislation Has Been Passed or Introduced
Morgan Lewis is prepared to guide companies and institutions of all sizes through the challenges they face in this new regulatory environment. We will closely follow developments in all 50 states as data privacy legislation is proposed, enacted, and amended. Our lawyers assist clients in virtually all the major industries around the globe in understanding how these important changes affect their businesses and how to navigate the changing data privacy landscape.
State Privacy 2023 Checklist for CPRA Plus Compliance
Companies that devoted significant effort over the past few years to ensuring compliance with the California Consumer Privacy Act (CCPA) face additional potential compliance burdens arising from the California Privacy Rights Act (CPRA); Virginia Consumer Data Protection Act (VCDPA); and Colorado Privacy Act (CPA). Given the myriad compliance pitfalls, we developed the below checklist to help guide companies that are already substantially compliant with CCPA in taking on the next compliance challenge.
- Determine which state privacy law(s) apply to your business
- Create a process for new right to correct consumers’ personal information
- Build in processes for new opt-out rights advertising and sharing
- Create a process to provide disclosed information to consumers
- Develop a process for processing sensitive personal information
- Create an appeal process for consumer requests
- Revise privacy policies
- Assess relationships with service providers and data processors
- Conduct risk assessments and implement data protection requirements
- Ensure data minimization and retention requirements are met
View the State Privacy 2023 Checklist for CPRA Plus Compliance checklist >>
CCPA Checklist
To help businesses prepare for the CCPA we created a CCPA checklist. The checklist covers the following points in detail to help you determine whether the CCPA applies to your business, and includes actionable steps your business can take to ensure compliance and many other useful tips:
- Determine whether the California Consumer Privacy Act (CCPA) applies to your business.
- Determine what data elements are collected from California consumers and for what purposes they are used.
- Consider how consumers’ personal information should be organized.
- Revise your website’s home page.
- Revise your privacy policy.
- Create a process for submitting requests to know and to delete and identify individuals responsible for responding to “verifiable consumer requests.”
- Create a process to timely confirm requests to know and requests to delete, and to verify requestors.
- Responding to requests to know: Create a process and identify individuals responsible for preserving copies of “specific pieces of personal information that the business has collected about [each] consumer” and promptly responding to consumers’ requests to access same.
- Responding to requests to delete: Create a process and identify individuals responsible for deleting consumer data in response to such a request.
- Create policies that reconcile the CCPA’s requirement to delete data upon request with the need to preserve evidence in litigation and avoid sanctions for spoliation of evidence.
- Create a process to timely comply with a request to opt-out of sale.
- Provide consumers under 16 years of age with a “right to opt in.”
- Provide training for employees on the CCPA’s prescribed consumer rights.
- Review existing agreements with third parties or service providers to ensure that contracts limit the service provider’s use of personal information as strictly as the CCPA prescribes, and revise as needed.
- Provide consumers the right to equal service and price.
- Create and maintain a robust incident response plan.
Insights
In October, California enacted its newest privacy legislation, commonly referred to as the “Delete Act” (California Senate Bill No. 362). The Delete Act will allow consumers to request that any data broker that maintains any personal information related to that consumer delete such personal information.
With the flurry of new consumer privacy laws enacted in states across the country, it is vital for companies operating in multiple states to remain informed of this changing landscape in order to plan and execute their compliance strategies.
The ever-evolving data privacy landscape continues to become more complex as new developments play out on the global stage. In the United States, a number of individual state laws have come into force, with more following in close step, and a new focus is emerging in health data protection. Across the pond, the EU-US Data Privacy Framework became effective and the UK government introduced a new draft of the UK Data Protection and Digital Information Bill. China and the Middle East’s approach to privacy continues to focus on cross-border data transfers and adaptations to new technologies, with the Gulf Cooperation Council region attaching significant penalties and enforcement actions in response to violations of the law.
Despite the business community’s interest in an all-encompassing federal data privacy law, such a development remains elusive. US legislators have periodically introduced bills that would establish a federal data privacy law, but none have been put into action. The American Data Privacy Protection Act, introduced in May 2022, is the latest attempt to establish a federal privacy law while providing for limited preemption of state privacy laws. The measure has enough bipartisan support to make it out of committee, but chances for passage are unclear, as it appears to lack key support to move further. Nonetheless, 2023 promises to continue the trend of increased attention on data privacy and security by the US Congress and federal agencies.
The EU-US Data Privacy Framework (DPF) became effective on July 10, and on the same day, the European Commission adopted an Adequacy Decision relating to the DPF. As a successor of the EU-US Privacy Shield, the EU-US DPF facilitates the transfer of EU personal data to participating organizations in the United States.
As technology continues to open doors for industry, adopters need to be mindful of pitfalls and opportunities. Here we discuss allegations against organizations implementing technology related to the processing of biometric data and information gathering on websites that may put them at risk and best practices for compliance.
The My Health My Data Act, signed by the governor of Washington State, is expected to have an impact on the privacy practices of a wide range of digital health businesses—potentially reaching beyond the state’s borders. While the Act takes effect on March 31, 2024 for regulated entities and on June 30, 2024 for small businesses, the Act's geofencing provision will become effective on July 23, 2023.
With the lack of comprehensive federal consumer privacy legislation, states are charting an evolving course for businesses to follow when handling data and information about their customers. Led by California, several other states have created laws to move regulations closer to the European Union’s General Data Protection Regulation. Virginia, Colorado, Utah, Connecticut, and Iowa have created their own consumer privacy protections, with Indiana, Montana, and Tennessee potentially following suit. Meanwhile, nearly a dozen other states are currently debating privacy laws.
The need for privacy and cybersecurity compliance measures has become a paramount consideration as businesses become more digitally driven, data breaches become more publicized, and regulation continues to increase. Morgan Lewis privacy and cybersecurity lawyers advise clients operating in the United States, Europe, South America, and Asia on compliance with privacy and cybersecurity regulations. This global privacy year in review takes an in depth look at privacy and cybersecurity updates around the globe.
In a nod to Data Privacy Day, California Attorney General Rob Bonta recently announced an “investigative sweep” directed primarily at ensuring that businesses can accept and timely process consumer opt-out requests. Although not limited in scope, the attorney general noted an emphasis on retail, travel, and food services businesses in this wave of enforcement.
The California Privacy Rights Act (CPRA) and Virginia Consumer Data Protection Act (VCDPA) took effect on January 1, 2023, establishing some of the most comprehensive consumer privacy rights within the United States. In this post we highlight these changes in law and provide a checklist to help companies comply with these new legal challenges.
The California Consumer Privacy Act (CCPA) exemptions for employee and business-to-business (B2B) personal information have not been extended, further complicating the privacy regulatory landscape for businesses in California. California employers must prepare to provide an array of new privacy rights to employees as of January 1, 2023, which is the effective date of the California Privacy Rights Act (CPRA) amending the CCPA.
Welcome to the second post in our Spotlight series, where we talk with a leader in a particular field or emerging area of interest to technology and sourcing lawyers and professionals.
Virginia has become the second state in the United States to pass a comprehensive data privacy law after the Virginia Consumer Data Protection Act (CDPA) passed both houses of Virginia’s state legislature in February with overwhelming bipartisan support and was promptly signed into law by Virginia Governor Ralph Northam. The CDPA has a number of key similarities to the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), which comes into effect in 2023, and the European Union’s General Data Protection Regulation (GDPR), and it follows a similar framework with proposed data privacy bills pending in other statehouses.
The California attorney general released a fourth set of proposed modifications to the California Consumer Privacy Act regulations; notable regulatory changes include a new opt-out button for websites and an offline notice of the right to opt out.
The California attorney general recently published proposed modifications to the operative final regulations to the California Consumer Privacy Act (CCPA), including notable regulatory changes requested by the attorney general for those businesses subject to the act.
A majority of California voters approved the California Privacy Rights Act of 2020 (CPRA) on November 3. The CPRA expands provisions of the California Consumer Privacy Act (CCPA), creates new consumer privacy rights, establishes the California Privacy Protection Agency as California’s privacy regulator, and removes the ability of businesses to fix violations before being penalized for violations. The CPRA becomes effective on January 1, 2023, with enforcement commencing on July 1, 2023. This article summarizes a few notable aspects of the CPRA and highlights practical steps that businesses should take to ensure compliance.
The California attorney general recently published proposed modifications to the operative final regulations to the California Consumer Privacy Act, including notable regulatory changes requested by the attorney general for those businesses subject to the act.
California Governor Gavin Newsom on September 29 signed into law Assembly Bill 1281, which ensures that the California Consumer Privacy Act (CCPA) limited exemptions for employment-related and business-to-business (B2B) data will be extended until at least January 1, 2022. The enactment of AB 1281 is a welcome development for businesses and employers that have been relying on these two important exemptions, which were set to sunset on January 1, 2021.
The landmark California Consumer Privacy Act (CCPA) requires certain companies doing business in California to implement new consumer privacy rights and provide new privacy policies to consumers. Even though the California attorney general’s right to enforce the law began July 1, 2020, the CCPA regulations did not become final and effective until August 14, 2020.
California recently approved the final regulations to the California Consumer Privacy Act (CCPA), which took effect August 14, 2020. This article highlights some of the most notable changes to the final regulations and identifies broadened areas of enforcement by the California attorney general.
Despite the coronavirus (COVID-19) pandemic, the California attorney general intends to enforce the California Consumer Privacy Act (CCPA) beginning July 1, 2020, pending the anticipated approval from the California Office of Administrative Law (OAL) on the final text of the proposed CCPA regulations. This article discusses the scope of the new regulations and identifies practical steps that companies can take to ensure compliance before July 1.
The July 1 enforcement of the California Consumer Privacy Act (CCPA) is one week away. Despite calls by the business community and trade associations to push back the enforcement date to January 2021 due to the coronavirus (COVID-19) pandemic and related disruptions to compliance efforts, the California state attorney general issued a press release on June 2 stating, “Businesses have had since January 1 to comply with the law, and we are committed to enforcing it starting July 1.”
With the July 1 enforcement of the California Consumer Privacy Act (CCPA) less than a month away, the state attorney general has finally submitted the final text of the proposed CCPA regulations to the California Office of Administrative Law. This article discusses the current landscape and provides practical steps that companies can take before enforcement begins.
This article summarizes what will or will not represent violation of the FIDIC golden principles and how certain potential deviations can be viewed from the employer’s perspective.
Morgan Lewis partner Reece Hirsch and associate Brian London authored a Law360 article about private investment funds and the California Consumer Privacy Act.
The California attorney general on March 12 released additional modified regulations (Second Set of Modifications) proposing further refinements to the California Consumer Privacy Act. This latest set are mostly minor adjustments, introducing fewer significant new concepts than the previous iterations on October 11, 2019 and February 7 and 10, 2020. Against this backdrop, businesses responding to the coronavirus (COVID-19) outbreak seek enforcement delays as the regulations approach final form.
While the final CCPA regulations remain pending, written comments on the recently released proposed modifications are due by February 25, 2020. This article highlights some of the most notable changes to the proposed regulations.
Washington may be the next state to enact its own data privacy law after a bill was introduced into the Washington State Senate earlier this month. Known as the Washington Privacy Act, the bill’s sponsor, Sen. Reuven Carlyle, stated at a press conference that lawmakers had reached “95 percent agreement in principle on the core elements of the bill.”
The landmark California Consumer Privacy Act (CCPA), which took effect on January 1, 2020, is the first privacy act of its kind in the United States and significantly alters the privacy and cybersecurity enforcement landscape. This article reviews one of the unique aspects of the CCPA: enforcement by the California attorney general (AG).
The landmark California Consumer Privacy Act (CCPA), which took effect on January 1, 2020, grants consumers a limited private right of action against the unauthorized access and exfiltration, theft, or disclosure of certain types of personal information, including the right to seek statutory damages. This new cause of action is among the many new statutory rights established by the CCPA, which represents a major turning point for privacy and cybersecurity standards and will significantly impact enforcement in California and beyond. This article highlights the key features of the private right of action and discusses how companies can prepare. Enforcement actions by the California attorney general are discussed in a subsequent article.
California is the fifth largest economy in the world. Its new laws and regulations have an impact far beyond its borders. Many Non-US companies do business in California. The California Consumer Privacy Act (CCPA), which becomes effective on January 1, 2020, applies broadly, and includes companies that are based outside of the state. This article discusses how the CCPA impacts non-US companies and what those companies need to do to prepare for CCPA compliance.
The California Consumer Privacy Act (CCPA) gives California residents various new rights regarding the collection, use, and disclosure of their personal information, and imposes a number of obligations on businesses covered by the CCPA, including some that apply to personal information collected from employees, owners, officers, directors, job applicants, and contractors, effective January 1, 2020. This article discusses issues for employers under the CCPA, as amended by AB 25, and under related regulations proposed by the California attorney general, including compliance with a notice provision by January 1.
The California Consumer Privacy Act (CCPA) gives consumers the right to request that a business (1) respond to the consumer with a list of the categories or specific pieces of personal information that the business has collected about that consumer (request to know); (2) delete any personal information that the business has collected from the consumer (request to delete); and (3) not sell the consumer’s personal information (request to opt out).
The recently proposed regulations implementing the California Consumer Privacy Act (CCPA) “establish procedures to facilitate consumers’ new rights under the CCPA and provide guidance to businesses for how to comply.” This article focuses on the consumer’s right to request deletion of the consumer’s personal information collected by the business, and outlines the best practices for responding to such requests to delete under the CCPA, including some information on the exceptions to deletion request.
The California Consumer Privacy Act (CCPA) gives consumers the right to request that a business (1) respond to a consumer with a list of the categories or specific pieces of personal information that the business has collected about that consumer (a request to know); (2) delete any personal information that the business has collected from the consumer (a request to delete); and (3) not sell the consumer’s personal information (a request to opt out).
All businesses subject to the California Consumer Privacy Act (CCPA) will need to have privacy policies that comply with the CCPA, regardless of whether they conduct business in person, online, or through mobile apps, and will need to update those policies at least every 12 months. The CCPA regulations proposed by the California attorney general on October 10, 2019, clarify and expand upon the requirements for privacy policies. This article explains those requirements and provides best practices for privacy policies.
The second article in our Guide to the CCPA series focuses on verifying consumer requests received pursuant to the California Consumer Privacy Act (CCPA). The California attorney general’s recently proposed regulations implementing the CCPA establish rules and procedures for verifying the identity of consumers making requests to know and requests to delete. This article explains those rules and provides best practices for verifying consumer requests made under the CCPA.
The California attorney general released the highly anticipated proposed regulations implementing the California Consumer Privacy Act (CCPA) on October 10, providing detailed guidance on CCPA compliance for affected businesses. This article, the first in our Practical Advice on Privacy: Guide to CCPA Requests series, focuses on best practices for receiving consumer requests made under the CCPA.
The upcoming California Consumer Privacy Act (CCPA) envisages harsher data protection regulations in California. Find out what German companies should pay attention to.
Morgan Lewis partner Mark Krotoski and associate Kevin Benedicto authored an article for Law360 about California AB 1130, which was recently enacted and amends the state’s data breach notification law.
While the California attorney general’s proposed regulations do not address all provisions of the California Consumer Privacy Act, they do include new procedures and deadlines and cover compliance issues for businesses not covered by the statute. For example, there are new obligations concerning service providers, training and recordkeeping, and standards for certain businesses maintaining the personal information of 4 million or more consumers for commercial purposes, like data brokers.
Morgan Lewis attorneys review amendments approved to the California Consumer Privacy Act (CCPA) and awaiting approval by California Governor Gavin Newsom. In the Bloomberg Law article, they say the amendments will create important exemptions for employee and business-to-business data.
Our prior post discussed three potential enhancements to cyber-related liability insurance policies designed to maximize their potential responsiveness to actions initiated by consumers or the state attorney general under the California Consumer Privacy Act (CCPA).
Will typical cyber-related liability insurance policies respond to actions initiated under the CCPA? In their current form, many likely will not. This post suggests enhancements to existing cyberliability policies to maximize their potential responsiveness to CCPA actions.
At the close of its legislative session on September 13, the California legislature passed five bills to amend and clarify the scope of the landmark California Consumer Privacy Act, which establishes new statutory privacy rights and business obligations for the collection and use of “personal information.”
The January 1, 2020, deadline to comply with the California Consumer Privacy Act (CCPA) is fast approaching. Signed into law in the summer of 2018, the CCPA creates a variety of new consumer privacy rights and will require many companies to implement policies and procedures to manage and comply with new consumer-facing responsibilities. Catch up on the details of the CCPA in our previous post, this LawFlash, and the Morgan Lewis CCPA resource center.
Nevada Senate Bill (SB) 220 will go into effect on October 1, 2019. SB 220 amends Nevada’s data privacy law to require that website operators honor a consumer’s request not to sell the consumer’s personal information. Exempt from the new law are certain financial and health institutions, and individuals involved in the manufacture and service of motor vehicles.
New York has increased its effort to enforce cybersecurity by creating a new unit designed to combat cybercrime and protect individuals’ sensitive data from attacks.
This article examines recent developments regarding the CCPA, and looks at some issues that will likely be a focus in the coming months now that the California Legislature is back in session.
By January 2020, manufacturers of Internet-enabled (IoT) devices that are sold or offered for sale in California (connected devices) must comply with the new legislation. For cyber security regulations in California. This includes the requirement to equip their devices with adequate security features to protect the device and the information contained therein.
As detailed in a prior blog post, California’s new privacy law, commonly referred to as the CCPA seeks to impose tougher privacy requirements on companies that collect and use consumer data.
The article analyzes the CCPA, which has been described as a landmark privacy bill that aims to give California consumers increased transparency and control over how companies use and share their personal information by January 2020. Companies with business in California should start with their compliance work as soon as possible.
At a time when many companies have only recently completed their efforts to comply with the European Union’s General Data Protection Regulation (“GDPR”), California has upped the ante by passing a comprehensive consumer privacy law that many are characterizing as “GDPR-like.”
In order to cause the withdrawal of a privacy measure slated to appear on the November ballot, the California Senate and Assembly approved the California Consumer Privacy Act (CCPA) on June 27, and it was signed into law by Governor Jerry Brown the same day. The CCPA, as enacted, modified some of the provisions in the ballot measure that were considered most onerous by business interests. But, like the ballot measure, the CCPA creates an array of new consumer privacy rights—similar in some respects to the European Union’s General Data Protection Regulation (GDPR)—that will cause many companies doing business in California to reassess their collection and use of personal information and modify their business processes to accommodate the new rights. Organizations subject to the CCPA must comply by January 1, 2020.
Colorado Governor John Hickenlooper recently signed into law House Bill 1128, which will take effect on September 1, 2018. The new law requires businesses owning, maintaining, or licensing personal information of Colorado residents to maintain a written policy for disposing documents containing personal identifying information; implement appropriate security procedures to protect personal information; and comply with breach notification requirements, including an accelerated 30-day timeframe for notification to Colorado residents impacted by a data breach.
The California Consumer Privacy Act will appear on the November ballot in California. It establishes new, groundbreaking consumer privacy rights similar to some of the new privacy (GDPR) rules in Europe. Among other things, it empowers consumers to find out what information businesses are collecting about them and gives them the choice to tell businesses to stop selling their personal information.
The California Consumer Privacy Act, which could be on the ballot in November, aims to introduce a groundbreaking approach to consumer privacy that not only is likely to resonate with the state’s voters, but is also expected to have national implications – thanks to California’s reputation as a trendsetter in consumer privacy. If passed, the act will come with significant compliance challenges and costs that companies should prepare for ahead of time.
The article summarizes the impact of The US COULD Act on businesses in Germany, in particular new risks for storing personal data in the Cloud. Some of the provisions in the US CLOUD Act my collide with the provisions of the General Data Protection Regulation (GDPR) for international data transfers.
Events & Recordings
Join us for the July edition of Fast Break, where partner Amy Magnano will answer these questions through the lens of Washington state’s new My Health My Data (MHMD) legislation. Passed this April, the law is intended to protect the privacy of consumer data not covered by HIPAA.
Please join us as we discuss the latest developments in state consumer privacy legislation. We will also consider how businesses can meet the challenges of a US privacy regulatory landscape that is growing increasingly complex.
Please join us as we discuss the latest developments in state consumer privacy legislation, including the California Privacy Rights Act, Virginia Consumer Data Protection Act, Colorado Privacy Act, and Utah Consumer Privacy Act. We will consider how businesses can meet the challenges of a US privacy regulatory landscape that is growing increasingly complex.
Please join us for a review of the increasingly complex privacy regulatory framework applicable to digital health products. We will examine when a mobile health app may be subject to regulation by optical character recognition, the Federal Trade Commission, or a state attorney general, and cover the latest regulatory developments and enforcement actions.
Join Mark Krotoski and Taylor Day for our next installment on cybersecurity issues for global public companies.
Please join a team of Morgan Lewis privacy lawyers as they discuss the global legal privacy issues that made 2021 important and what is to come in 2022.
Please join us as we discuss the latest developments in state consumer privacy legislation, including the upcoming California Privacy Rights Act and the Virginia Consumer Data Protection Act.
This session will explore practical CCPA implementation issues, including online advertising, service provider agreements, the definition of a sale of personal information, and the new private right of action for security breaches.
Morgan Lewis lawyers Nancy Yamaguchi and Akiko Araki are presenting "The New GDPR in California – Are You Ready for CCPA Compliance?" at this event sponsored by Pasona.
The regulations and implementation of the California Consumer Privacy Act (CCPA) were awash in uncertainty even before the COVID-19 crisis made everything more uncertain. Now, business realities that were unthinkable just a few months ago are unavoidable.
Our next installment of the Global Public Company Academy will focus on cybersecurity issues for global public companies. Topics will include a review of the cyberthreat environment including under the coronavirus (COVID-19) pandemic; the significant costs and consequences of cyberattacks and incidents; a recent case study; operating in a heightened regulatory enforcement, including under the California Consumer Privacy Act; and how you can be prepared.
The landmark California Consumer Privacy Act becomes effective on January 1, with enforcement set to begin on July 1. Even though the proposed regulations are still a work in progress, there are steps that businesses can, and should, take now to prepare. This presentation will provide practical guidance.
Morgan Lewis presents a course that will provide a global update regarding key amendments and regulations of the California Consumer Privacy Act (CCPA) of 2018 and the GDPR.
This webinar brings a diverse panel of leading security and legal professionals to examine potential exemption pitfalls, the extent of GLBA and HIPAA coverage compared to the CCPA and share real-life examples of steps organizations have taken to demonstrate reasonable security.
The January 1 effective date of the landmark California Consumer Privacy Act (CCPA) is fast approaching, but the law’s requirements remain a moving target. In this webinar we will provide an overview of the latest amendments to the CCPA, the state of the law and related regulations, and practical perspectives on CCPA compliance.
We will discuss compliance with the new California law and what might be on the horizon in California and other states.
California has long been a laboratory for innovative privacy legislation, and there were many new experiments in 2018 and 2019.
When the California Consumer Privacy Act was signed into law on June 28, it was recognized as a landmark privacy measure – and as a work in progress. Now the California Legislature has passed the first set of amendments to the CCPA, but many more issues remain to be debated and clarified.
On June 27, California enacted the nation’s most comprehensive consumer privacy law, the California Consumer Privacy Act of 2018 (CCPA). This webinar will provide an overview of the landmark privacy measure.
In the Media
Partner Reece Hirsch was quoted in a Law360 round-up of key privacy policy developments in the first half of 2022.
Partner Reece Hirsch was quoted in a Law360 article on the California Privacy Protection Agency’s first draft of regulations for the California Privacy Rights Act (CPRA).
In this article for ZD Akutell, Axel Spies addressed the Utah Consumer Privacy Act (UCPA) which became the fourth comprehensive US state privacy law with some provisions that depart from comprehensive privacy laws in California, Colorado, and Virginia.
Partner Reece Hirsch spoke to Bloomberg Law about the Utah Consumer Privacy Act, which would give residents the right to know what personal data is being collected about them and ask that it be deleted.
Partner Reece Hirsch spoke to Law360 about customer loyalty programs and California’s Consumer Privacy Act (CCPA), which mandates that businesses explain how the financial incentive or price or service difference is reasonably related to the value of the consumer's data, including a good faith estimate of the value of the consumer's data and a description of the method the business used to calculate that value.
Partner W. Reece Hirsch joined State Net Capitol Journal’s Legislative Deep Dive podcast to discuss how the California Consumer Privacy Act (CCPA) has impacted US data privacy measures, the possible use of antitrust laws to regulate big tech companies, and more.
Partner Ezra Church spoke with Law360 about cybersecurity and privacy trends to watch out for in 2022, including how some companies will be preparing to handle recently enacted privacy legislation in states like Virginia and Colorado—which will give consumers more access and control of their personal data—when they take effect in 2023.
Partner Reece Hirsch spoke with MedCity News about the US Department of Health and Human Services’ information-blocking rules. In the article, Reece discussed ambiguities around the definition of information blocking.
Morgan Lewis partners Greg Parks and Kristin Hadgis and associates Drew Jordan and Taylor Day authored an article for Law360 about the Virginia Consumer Data Protection Act, a comprehensive privacy law expected to be signed into law soon.
Morgan Lewis partner Reece Hirsch spoke to Law360 about the major cybersecurity and privacy policy issues he will be tracking in 2021. In the piece, he discussed the California Consumer Privacy Act (CCPA).
Partner Reece Hirsch spoke with Law360 about California’s Proposition 24, a ballot measure that, if adopted, would build on the California Consumer Privacy Act (CCPA).
Morgan Lewis partner Reece Hirsch authored an article for Bloomberg Law about a California bill that Governor Gavin Newsom recently signed into law, which ensures that the California Consumer Privacy Act (CCPA) limited exemptions for employment-related and business-to-business (B2B) data will be extended until at least January 1, 2022.
Partner Reece Hirsch spoke with Bloomberg Law about a recent bill in California which extends exemptions related to the California Consumer Privacy Act to 2022.
Morgan Lewis partner Reece Hirsch was quoted in a Daily Journal article about the enforcement of the California Consumer Privacy Act (CCPA), which began on July 1.
Morgan Lewis partner Reece Hirsch was featured in a Reuters Q&A about the California Consumer Privacy Act, which went into effect on July 1.
Morgan Lewis partner Reece Hirsch spoke with Law360 about final regulations regarding the California Consumer Privacy Act (CCPA).
Morgan Lewis partner Reece Hirsch spoke with Bloomberg Law about the effect of the pandemic on enforcing the California Consumer Privacy Act.
Morgan Lewis partner Reece Hirsch was quoted in a Daily Journal article about final proposed regulations under the California Consumer Privacy Act that were submitted by the state’s attorney general on Tuesday. In the article, Reece discussed the ambiguities that remain.
Morgan Lewis partner Reece Hirsch spoke with the Recorder about final proposed regulations regarding the enforcement of the California Consumer Privacy Act (CCPA). In the article, he discussed ambiguities related to the lack of an opt-out button.
Morgan Lewis partner Reece Hirsch spoke with The Epoch Times for an article about the impact of the California Consumer Privacy Act.
Morgan Lewis partner and co-head of the firm’s privacy and cybersecurity practice Reece Hirsch was interviewed by Law360 for an article about significant legislative and regulatory developments expected in the cybersecurity and privacy space in 2020, including the California Consumer Privacy Act (CCPA).
Morgan Lewis partner and co-head of the firm’s privacy and cybersecurity practice Reece Hirsch spoke with The Verge about preparing for compliance with the California Consumer Privacy Act (CCPA).
Morgan Lewis partner Gregory Parks, co-leader of the firm’s privacy and cybersecurity practice, was interviewed for a Law360 article about a new law in Nevada that allows residents to opt out of the sale of their data.
Bloomberg Law Quoted: Reece Hirsch
Law360 Quoted: Reece Hirsch
PMNTS mentioned Reece Hirsch