Privacy & Information Security Law Blog

On May 3, 2016, the Federal Aviation Administration (“FAA”) announced the establishment of a Drone Advisory Committee (“DAC”) intended to increase transparency and collaboration between the FAA and key stakeholders in the ongoing effort to develop and implement an overall integration strategy for Unmanned Aircraft Systems (“UAS”).

On May 4, 2016, the Federal Trade Commission issued a press release announcing its recent settlement with the hand-held vaporizers manufacturer, Very Incognito Technologies, Inc. (“Vipvape”). The FTC had charged Vipvape with falsely claiming that it was a certified company under the Asia-Pacific Economic Cooperation (“APEC”) Cross-Border Privacy Rules (“CBPR”) framework. The settlement prohibits Vipvape from misleading consumers about its participation in any privacy and security certification program, including the APEC CBPR framework. This is the first CBPR-related case taken up by the FTC.

On May 4, 2016, the EU General Data Protection Regulation (“GDPR”) was published in the Official Journal of the European Union.

Following the European Parliament’s vote to adopt the GDPR on April 14, 2016, and the signing of the final draft on April 27, 2016, the GDPR will enter into force 20 days following its publication in the Official Journal of the European Union. Its provisions will be directly applicable in all EU Member States two years after this date, on May 25, 2018.

After four years of drafting and negotiations, the GDPR finally replaces and harmonizes the existing EU ...

On April 26, 2016, Korean law firm Bae, Kim & Lee LLC released a Privacy News Alert outlining amendments to Korea’s Personal Information Protection Act (“PIPA”) and the Act on the Promotion of IT Network Use and Information Protection (“IT Network Act”). According to Tae Uk Kang, partner at Bae, Kim & Lee and author of the alert, these amendments to PIPA and the IT Network Act “reflect the general trend concerning the Korean data privacy policy, which is intended to achieve more stringent regulation (and sanctions) of processing personal information.”

Recently, the Council of Institutional Investors (“CII”) issued a guide to shareholder engagement on cyber risk. The guide is intended to enable shareholders to ask appropriate questions of boards to gauge whether companies are taking proper steps to mitigate cyber risk. The guide poses the following five questions:

• How are the company’s cyber risks communicated to the board, by whom and with what frequency?
• Has the board evaluated and approved the company’s cybersecurity strategy?
• How does the board ensure that the company is organized appropriately to address cybersecurity risks? Does management have the skill sets it needs?
• How does the board evaluate the effectiveness of the company’s cybersecurity efforts?
• When did the board last discuss whether the company’s disclosure of cyber risk and cyber incident is consistent with SEC guidance?

On April 27, 2016, the UK House of Commons Culture, Media and Sport Select Committee (the “Committee”) confirmed Elizabeth Denham’s appointment as Information Commissioner. Denham, currently the Privacy and Information Commissioner for British Columbia, Canada, was announced as the UK Government’s preferred choice on March 22, 2016.

The U.S. Department of Health and Human Services’ Office for Civil Rights (“OCR”) recently announced resolution agreements with Raleigh Orthopaedic Clinic, P.A., (“Raleigh Orthopaedic”) and New York-Presbyterian Hospital (“NYP”) for HIPAA Privacy Rule violations.

On April 13, 2016, Nebraska Governor Pete Ricketts signed into law LB 835 (the “Bill”), which among other things, adds a regulator notification requirement and broadens the definition of “personal information” in the state’s data breach notification statute, Neb. Rev. Stat. §§ 87-802 to 87-804. The amendments take effect on July 20, 2016.

In its third simulated test of the security of the power grid, the North American Reliability Corporation (“NERC”) reported general progress across the electric utility industry in defending against physical and cyber threats, while also identifying several areas for further improvement.

The NERC exercise, dubbed GridEx III, took place over two days in November 2015 and involved more than 4,400 individuals from 364 industry, law enforcement and government organizations across the United States, Canada and Mexico. The main objectives of the exercise were to test crisis response and recovery, improve communication, identify problem areas and engage senior-level leadership in the organizations involved.

The Federal Trade Commission recently released an interactive tool for mobile health apps. The tool was developed in conjunction with several other federal agencies, including the Department of Health and Human Services’ Office for Civil Rights, the Office of the National Coordinator for Health Information Technology, and the Food and Drug Administration.