Privacy & Information Security Law Blog

On June 2, 2015, the National Institute of Standards and Technology (“NIST”) issued a press release on its recently published draft report, entitled Privacy Risk Management Framework for Federal Information Systems (the “Report”). The Report describes a privacy risk management framework (“PRMF”) for federal information systems designed to promote “a greater understanding of privacy impacts and the capability to address them in federal information systems through risk management.” The draft PRMF includes a Privacy Risk Assessment Methodology (“PRAM”) consisting of several worksheets for assessing the privacy impact of data actions.

On June 1, 2015, the Group of the European People’s Party in the European Parliament released an updated timetable for agreeing on the proposed EU General Data Protection Regulation (the “Regulation”). The European Commission, European Parliament and the Council of the European Union will soon enter multilateral negotiations, known as the “trilogue,” to agree on the final text of the proposed Regulation.

On May 28, 2015, the German government adopted a draft law that would require telecommunications and Internet service providers to retain Internet and telephone usage data. The initiative comes more than a year after the European Court of Justice declared the EU Data Retention Directive invalid, which had been implemented previously by German law. The German law implementing the EU Data Protection Directive had been declared unconstitutional by the German Federal Constitutional Court five years ago.

Hunton & Williams LLP announces the firm’s Global Privacy and Cybersecurity practice was again ranked in Tier 1 by Chambers & Partners in their 2015 Global and USA guides. Over the last eight years, the firm has been recognized by Chambers Global, Chambers UK and Chambers USA as a Tier 1 firm for privacy and data protection. As noted by Chambers USA, the practice lawyers “have established themselves as real leaders in this area.”

On May 26, 2015, the Upper House of the Dutch Parliament passed a bill that introduces a general obligation for data controllers to notify the Dutch Data Protection Authority (“DPA”) of data security breaches and provides increased sanctions for violations of the Dutch Data Protection Act. A Dutch Royal Decree still needs to be adopted to set the new law’s date of entry into force. According to the Dutch DPA, the new law is likely to come into force on January 1, 2016.

On May 25, 2015, the French Data Protection Authority (“CNIL”) released its long-awaited annual inspection program for 2015. Under French data protection law, the CNIL may conduct four types of inspections: (1) on-site inspections (i.e., the CNIL may visit a company’s facilities and access anything that stores personal data); (2) document reviews (i.e., the CNIL may require an entity to send documents or files upon written request); (3) hearings (i.e., the CNIL may summon representatives of organizations to appear for questioning and provide other necessary information); and (4) since March 2014, online inspections.

After a number of high-profile data breaches, corporate cybersecurity is facing increased scrutiny and attention from consumers, the government and the public. In a webinar, entitled Cyber Insurance: Addressing Your Risks and Liabilities, hosted by Hunton & Williams LLP and CT, Hunton & Williams partners Lon A. Berk and Lisa J. Sotto provide a background into the current cyber threats and educate companies and their counsel on how to take full advantage of their existing insurance programs and specialized cyber insurance products to effectively and proactively address cyber ...

On May 20, 2015, the Federal Communications Commission (“FCC”) released an Enforcement Advisory announcing that its previously-released Open Internet Order “applies the core customer privacy protections of Section 222 of the Communications Act to providers of broadband Internet access service” and that the statutory provisions of Section 222, which historically have been used to protect Consumer Proprietary Network Information on telephone networks, will apply to broadband providers when the Open Internet Order goes into effect on June 12, 2015. This approach will expand broadband providers’ requirements to protect consumer privacy and limit their use of consumer data.

On May 13, 2015, the Belgian Data Protection Authority (the “DPA”) published a recommendation addressing the use of social plug-ins associated with Facebook and its services (the “Recommendation”). The Recommendation stems from the recent discussions between the DPA and Facebook regarding Facebook’s privacy policy and the tracking of individuals’ Internet activities.

On May 7, 2015, the Digital Advertising Alliance (“DAA”) announced that, as of September 1, 2015, the Council of Better Business Bureaus and the Direct Marketing Association will begin to enforce the DAA Self-Regulatory Principles for Online Behavioral Advertising and the Multi-Site Data Principles (collectively, the “Self-Regulatory Principles”) in the mobile environment.