Privacy & Information Security Law Blog

On August 23, 2022, the Federal Trade Commission announced it is seeking additional public comment on “how children are affected by digital advertising and marketing messages that may blur the line between ads and entertainment” in conjunction with its “Protecting Kids from Stealth Advertising in Digital Media” event on October 19, 2022. The event will focus on manipulative marketing practices targeted towards children, particularly those related to influencer marketing and online games.

On August 5, 2022, French AdTech company Criteo announced that it had received a report from the French Data Protection Authority (“CNIL”) on August 3, 2022, claiming various infringements of the EU General Data Protection Regulation (“GDPR”) and proposing to impose a €60,000,000 fine against Criteo. The proposed fine follows complaints filed by privacy NGO ‘Privacy International’ against Criteo.

On August 8, 2022, Commissioner Noah Joshua Phillips announced that he plans to resign from the Federal Trade Commission in the fall after serving four years with the agency. Phillips was appointed by former President Donald Trump in May 2018 and is one of the two Republican commissioners on the FTC alongside Commissioner Christine S. Wilson. Commissioner Phillips had served as chief counsel to Sen. John Cornyn (R-Texas) before joining the FTC.

On June 10, 2022, New York became the first state to require attorneys to complete at least one credit of cybersecurity, privacy and data protection training as part of their continuing legal education (“CLE”) requirements. The new requirement will take effect July 1, 2023.

On July 29, 2022, the New York Department of Financial Services (“NYDFS”) posted proposed amendments (“Proposed Amendments”) to its Cybersecurity Requirements for Financial Services Companies (“Cybersecurity Regulations”). The Proposed Amendments would expand upon the set of prescriptive cybersecurity requirements applicable to all covered financial institutions, as well as impose more stringent requirements for “Class A Companies” (as defined below). There will be a brief pre-proposal comment period, followed by the official publication of the Proposed Amendments, which will trigger a new 60-day comment period. Below are the key changes introduced by the Proposed Amendments.

On August 11, 2022, the Federal Trade Commission announced it is seeking public comment regarding its advance notice of proposed rulemaking (“ANPR”) on commercial surveillance and data security, on which we previously reported. The FTC defines “commercial surveillance” as the business of collecting, analyzing and profiting from consumer data.

On July 21, 2022, the National Institute of Standards and Technology (“NIST”) released an updated draft of its HIPAA Security Rule guidance. The draft guidance, titled “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide” (NIST Special Publication 800-66, Revision 2), is designed to assist HIPAA regulated entities “maintain the confidentiality, integrity and availability of electronic protected health information (ePHI).” NIST issued the updated draft guidance to align it with other NIST cybersecurity guidance documents that have been published since the original HIPAA Security Rule guidance was issued in 2008.

On July 27, 2022, Google announced that it is delaying its plans to phase out third-party cookies in the Chrome web browser. Google’s Vice President of Privacy Sandbox, Anthony Chavez, announced the company is extending the full deprecation of third-party cookies to “the second half of 2024,” to continue the testing window for the Privacy Sandbox.

On July 28, 2022, a federal judge approved TikTok’s $92 million class action settlement of various privacy claims made under state and federal law. The agreement will resolve litigation that began in 2019 and involved claims that TikTok, owned by the Chinese company ByteDance, violated the Illinois Biometric Information Privacy Act (“BIPA”) and the federal Video Privacy Protection Act (“VPPA”) by improperly harvesting users’ personal data. U.S. District Court Judge John Lee of the Northern District of Illinois also awarded approximately $29 million in fees to class counsel.

In July 2022, Maria Ostashenko from ALRUD Law Firm reports that the Russian Parliament passed, and the President of the Russian Federation signed into law, major reforms in data protection and information governance. The reforms include:

• Significant changes to Federal Law No. 152-FZ on Personal Data, including the scope of its application, new rules for cross-border transfer of personal data, data breach notifications, and additional protections for data subjects;
• New amendments to the Unified Biometric System regulations;
• Establishment of a countersanction-information ...