Andreas Kaltsounis

Subscribe to all posts by Andreas Kaltsounis

Updated EU Standard Contractual Clauses Are Finally Here

By Nichole Sterling, Andreas Kaltsounis and Melinda L. McLellan on June 8, 2021 Posted in EU, GDPR

On June 4, 2021, the European Union’s (EU) executive branch, the European Commission (EC), released their new Standard Contractual Clauses (SCCs) for compliant cross-border data transfers under the EU’s General Data Protection Regulation (GDPR), ending a long wait for revised SCCs. The new SCCs resolve certain practical issues companies faced when using the older versions but … Continue Reading

Responding to Supply-Chain Risk—It’s Not Just About Vendor Management

By Andreas Kaltsounis on April 14, 2021 Posted in Supply Chain

Organizations around the globe began 2021 grappling with two significant supply-chain attacks. First, the SVR, Russia’s foreign intelligence service, planted malicious code in Orion, SolarWinds’ flagship network management suite. When 18,000 Orion customers updated their software, they also unwittingly installed the SVR’s malicious code, giving the Russian intelligence agency direct access to the customers’ networks. … Continue Reading

Private Right of Action May Again Poison Washington Privacy Act

By Andreas Kaltsounis on March 30, 2021 Posted in Privacy

On March 26, with less than a month left in the Washington Legislature’s 2021 session, the House Civil Rights and Judiciary Committee (CRJC) passed the Washington privacy act (2SSB 5062), with amendments, on a straight party-line vote of 11-6 (with all six Republican committee members voting no). As the act gets closer to passing, we’ll … Continue Reading

A Risk-Based Approach to the SolarWinds Vulnerability Disclosures

By Andreas Kaltsounis and Adam Cohen on January 6, 2021 Posted in Cybersecurity

On December 13, 2020, SolarWinds disclosed that an unknown attacker compromised its network and inserted malicious code (referred to as the Sunburst vulnerability) into software updates for the Orion platform. In what will likely become known as one of the most widespread and damaging cyber attacks in history, approximately 18,000 private and government organizations installed … Continue Reading

California AG Begins CCPA Enforcement

By Jeewon Serrato, Andreas Kaltsounis and Stanton Burke on July 16, 2020 Posted in CCPA

Last week, the International Association of Privacy Professionals hosted a keynote session with Stacey Schesser, supervising deputy attorney general (AG) of the California Department of Justice, to discuss the July 1 start of the AG’s enforcement authority under the California Consumer Privacy Act (CCPA). The deputy AG discussed the current scope of the AG’s enforcement authority and confirmed that on July 1, … Continue Reading

Belgian Authority Raises Red Flag for DPOs with Multiple Roles

By Nichole Sterling, Andreas Kaltsounis and Melinda L. McLellan on May 29, 2020 Posted in Enforcement

Following its investigation of a personal data breach, the Belgian Data Protection Authority (DPA) issued a ruling on April 28, 2020, imposing a €50,000 fine on an organization for negligence in having appointed the company’s head of compliance, risk and audit as its data protection officer (DPO). This decision should cause entities to reconsider appointing … Continue Reading

COVID-19 Cybersecurity Exposure

By Andreas Kaltsounis on March 18, 2020 Posted in Cybersecurity

Risk scenarios and recommendations History tells us that unscrupulous actors will exploit any crisis, and COVID-19 is no exception. Attackers wasted no time building coronavirus-themed phishing emails and malware-laden websites purporting to track the coronavirus’s spread across the globe. These opportunistic attacks were an expected variation on well-known themes that use fear to engineer an … Continue Reading

The Washington Privacy Act Is Back

By Shea M. Leitch and Andreas Kaltsounis on March 2, 2020 Posted in Consumer Data, State Legislation

After the Washington Privacy Act (“WPA”) failed to pass in 2019, state legislators promised to renew their efforts in the 2020 legislative session. Lawmakers kept this promise last month, introducing three bills targeted at an array of consumer privacy issues. The first bill, SB 6281, or the Washington Privacy Act, introduced in the Senate on … Continue Reading

Standing Guard – Digital Risk Advisory and Cybersecurity Team

By Craig A. Hoffman and Andreas Kaltsounis on January 27, 2020 Posted in Cybersecurity

The Digital Assets and Data Management (DADM) Practice Group offers holistic, enterprise-wide risk solutions to clients around “everything data.” The multidisciplinary new addition – chaired by Theodore J. Kobus III – is a strategic outgrowth of the firm’s world-class Privacy and Data Protection and Advertising, Marketing and Digital Media teams, combined with the innovative legal … Continue Reading

New Year Brings Trio of U.S. Breach Notification Amendments

By Andreas Kaltsounis on January 7, 2020 Posted in Breach Notification

Along with the California Consumer Privacy Act, the new year brought us a trio of updated breach notification laws, in Oregon, Texas and Illinois. The Oregon law is of the most interest because it is the first to require that vendors notify the state’s attorney general of breaches in some cases. It also requires a … Continue Reading

Insurance Data Security Model Law Picks Up Steam

By Andreas Kaltsounis and Shea M. Leitch on February 6, 2019 Posted in Cybersecurity, State Legislation

Three states recently enacted variations of the National Association of Insurance Commissioner’s (NAIC) Insurance Data Security Model Law (MDL-668), based on the landmark cybersecurity requirements issued by the New York Department of Financial Services (NYDFS) in March 2017. The NYDFS requirements apply to certain banking, insurance and financial service entities licensed in the state of … Continue Reading

SEC Investigation Highlights BEC Risk and Need for Comprehensive Risk Assessments by Public Companies

By Andreas Kaltsounis on October 17, 2018 Posted in Cybersecurity, Data Breaches

The Securities and Exchange Commission issued a press release and an investigative report on Oct. 16 cautioning public companies to consider cyber threats when implementing internal accounting controls. The report stems from the SEC’s investigation of nine companies that lost between $1 million and $100 million each in so-called business email compromise (BEC) frauds, in … Continue Reading

Last but not least: Alabama enacts a data breach notification law with strong notification and security requirements

By Andreas Kaltsounis and Sara Goldstein on May 1, 2018 Posted in Data Breach Notification Laws

Several weeks ago, South Dakota and Alabama became the final two states to enact data breach notification laws. The Alabama Data Breach Notification Act of 2018 takes effect on May 1, 2018, and imposes information security, breach notification and data disposal requirements on organizations handling Alabama residents’ personal information. Alabama requires organizations to implement and … Continue Reading

When Obscurity Is Not a Defense

By Andreas Kaltsounis on February 22, 2018 Posted in Cybersecurity

Many organizations facing a data-security incident struggle to understand how or why their organization was targeted in an attack. Most simply believe they are too small or too obscure to be targeted by malicious cyber actors. Even larger, well-known businesses are lulled into complacency, mistaking years without a major security incident as evidence that their … Continue Reading

Recent Trends, Future Predictions, and Effective Risk Assessments

By Andreas Kaltsounis on January 8, 2018 Posted in Risk Assessments

Risk assessments are a fundamental part of any organization’s risk management process. But many organizations still do not incorporate true risk assessments into their information-security planning, even though doing so makes good business sense and is required by many standards and regulatory frameworks (the HIPAA Security Rule, PCI-DSS, and the NY Department of Financial Services … Continue Reading