Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="size-medium wp-image-5216 alignright" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2018/03/Rewind-Button-iStock-826155410_031618-300x300.jpg" alt="" width="300" height="300" />

Data Breaches

Comcast’s Xfinity Service Potentially Exposes Addresses and Partial SSNs of More Than 26.5 Million Customers
• According to security researcher Ryan Stevenson, alleged vulnerabilities in the system Comcast Xfinity uses to verify users’ identities could have allowed an attacker to learn those users’ home addresses and partial Social Security numbers.
• After being informed of the issues, Comcast patched the alleged vulnerabilities.
• According to a Comcast spokesperson, Comcast “quickly investigated these issues and within hours … blocked both vulnerabilities, eliminating the ability to conduct the actions described by these researchers. [Comcast has] no reason to believe these vulnerabilities were ever used against Comcast customers.”


States

Business Groups Working to Amend CaCPA
<ul>
 	<li>A variety of business groups, including the California Chamber of Commerce, the Motion Picture Association of America and the Alliance of Automobile Manufacturers, have urged the California Senate to make amendments to the California Consumer Privacy Act (CaCPA), which was signed into law on June 28.</li>
 	<li>The <a href="https://www.dataprivacymonitor.com/state-legislation/not-too-early-to-start-to-prepare-for-new-california-privacy-law/">CaCPA</a>, which goes into effect on Jan. 1, 2020, grants California residents a broad range of European-style rights when it comes to their personal information.</li>
 	<li>In their <a href="https://dlbjbjzgnk95t.cloudfront.net/1072000/1072336/sb%201121%20final%20author%20coalition%20letter%20(2).8.7.2018.pdf">letter</a> to state Sen. Bill Dodd, the business groups sought a variety of changes to the CaCPA, including delaying its implementation until after the completion of the rulemaking process and clarifying the pre-emption language to ensure that local regulations do not require more protective privacy measures before CaCPA goes into effect.</li>
</ul>
NY Department of Financial Services Rules in Place on Sept. 1
<ul>
 	<li>Entities subject to the New York Department of Financial Services have new <a href="https://www.dfs.ny.gov/legal/regulations/adoptions/dfsrf500txt.pdf">cybersecurity and privacy obligations</a> that go into effect on Sept. 1, 2018.</li>
 	<li>Those obligations include instituting audit trails to create records of transactions; taking steps to ensure security of apps, including those that are commercially available and those that are developed in-house; limits on data retention; and encryption of nonpublic information.</li>
</ul>
EU/GDPR/Foreign Jurisdictions

‘Mr. GDPR’ Already Looking Ahead to New Regulations
<ul>
 	<li>Less than three months after General Data Protection Regulation (GDPR) went into effect, Giovanni Buttarelli, the European data protection supervisor referred to as “Mr. GDPR,” is already looking ahead to a “post-GDPR future.”</li>
 	<li>In an <a href="https://www.washingtonpost.com/news/theworldpost/wp/2018/08/14/gdpr/?utm_term=.4cdadeddada3&amp;noredirect=on">op-ed</a> for The Washington Post, Buttarelli calls for a manifesto to “de-bureacratiz[e] and safeguard[]” individuals’ “digital selves.”</li>
 	<li>According to Buttarelli, such a manifesto would include a “consensus among developers, companies and governments on the ethics of the underlying decisions in the application of digital technology.” It also would call for devices and programs to be designed to safeguard privacy and digital freedom by default.</li>
</ul>
Brazil Approves Data Protection Law
<ul>
 	<li>Brazil has adopted a national data protection law, which has been dubbed “<a href="https://www.dataprivacymonitor.com/weekly-privacy-rewind/the-weekly-privacy-rewind-13/">Brazilian GDPR</a>.”</li>
 	<li>The <a href="http://dataprivacy.com.br/protecao_de_dados_pessoais.docx">law</a>, which goes into effect in early 2020, replaces the majority of Brazil’s current sector-specific privacy laws and regulations and, like GDPR, broadly deals with the processing of personal information. It also establishes a mandatory data breach notification obligation, requiring notification within a reasonable time frame to the Data Protection Authority (DPA), which may require notification to affected individuals.</li>
 	<li>Interestingly, the portions of the law that establish Brazil’s DPA were vetoed, but the DPA will be established through a separate law.</li>
</ul>

The Weekly Privacy Rewind