Privacy & Information Security Law Blog

Last month, Colorado Governor Jared Polis signed into law a bill that amends the Colorado Privacy Act and introduces new obligations for processors of biometric data. The law goes into effect on July 1, 2025.

The Texas Attorney General’s Office joined the recent swell of regulatory and judicial scrutiny into privacy issues related to connected cars, driving data and telematics, launching an investigation on the data practices of several car manufacturers. 

On June 18, 2024, the US Securities and Exchange Commission announced a settlement with R.R. Donnelley & Sons Co. for violating the internal controls and disclosure controls provisions of the federal securities laws in relation to RRD’s response to a 2021 ransomware attack.

On May 24, 2024, Governor Tim Walz signed H.F. 4757 into law, enacting the Minnesota Consumer Data Privacy Act. The MNCDPA will take effect on July 31, 2025. 

In April 2024, the National Institute of Standards and Technology released an initial draft of its AI Risk Management Framework Generative AI Profile. This blog entry provides a summary of the Generative AI Profile.

On June 7, 2024, following a public consultation, the French Data Protection Authority published the final version of the guidelines addressing the development of AI systems from a data protection perspective.

On May 23, the U.S. House Committee on Energy and Commerce Subcommittee on Data, Innovation, and Commerce approved a revised draft of the American Privacy Rights Act (“APRA”), which includes significant changes from the initial discussion draft.

The Centre for Information Policy Leadership at Hunton Andrews Kurth, in partnership with WeProtect Global Alliance, held a series of interactive workshops on digital age assurance as part of its Children’s Privacy Project. They are seeking interested professionals to join their working groups as part of several workshops.

On May 16, 2024, the Illinois House of Representatives passed S.B. 2979, following the bill’s passage in the Illinois Senate in April.   S.B. 2979 would amend the Illinois Biometric Information Privacy Act definitions and limit liability for businesses with multiple duplicative BIPA violations that relate to the same individual.

On June 7, 2024, the New York legislature passed a bill (S.B. S7694A), the Stop Addictive Feeds Exploitation (SAFE) for Kids Act, addressing children’s use of social media platforms. The bill is pending Governor Kathy Hochul’s signature.

On May 1, 2024, Utah’s Artificial Intelligence Policy Act entered into effect.

On May 10, 2024, the Vermont legislature passed HB 121, which was delivered to Governor Phil Scott for signature. HB 121 will enact the Vermont Data Privacy Act, the Vermont Data Broker Security Breach Notice Act and the Vermont Age-Appropriate Design Code.