Privacy

New California Privacy Law is Now Effective

January 10, 2023 | Stephen S. Wu

Now that we’ve reached 2023, it’s time to reexamine privacy policies to comply with California’s new California Privacy Rights Act.

To recap, in 2018, California enacted the California Consumer Privacy Act (CCPA). The CCPA became effective in 2020. Many of our clients changed their privacy policies and programs to comply with the CCPA, which established new disclosure and process requirements. In the November 2020 election, however, California’s voters enacted a new privacy law by ballot initiative – the California Privacy Rights Act (CPRA). As of January 1, 2023, the CPRA became effective. It supplements and amends the CPRA.

If you established a privacy policy to comply with the CCPA, the CPRA requires additional changes to your policy. More generally, any business doing business in California is covered by CCPA/CPRA if

350 Million Reasons to Upgrade Your Privacy and Data Security Practices Before a Corporate Transaction

August 17, 2021 | Stephen S. Wu

Is your company considering a transaction to become acquired or to take in additional financing? If so, the time is now to upgrade your privacy and information security practices before you are in serious discussions or receive a term sheet for the transaction. One obvious question is: why now? Aren’t data protection issues something for the lawyers to handle later in negotiating the agreement and during due diligence? In answer to the question why now, I have 350 million reasons why now is the best time to tackle data protection challenges.

The 350 million refers to the transaction in which Verizon purchased the web business of Yahoo. After Verizon found out that Yahoo was in the midst of a data breach at the time of the purchase transaction, Verizon went back to Yahoo and shaved off $350 million from the purchase price. Simply put, the ongoing weakness in Yahoo’s data protection program reduced the valuation of the business and Verizon wanted to slash the transaction value to reflect that reduction in value.

Executives of a target company that want to avoid taking a haircut later in the value of their M&A transaction or valuation during a financing transaction can prepare now to avoid problems later. Taking care of data protection concerns now not only preserves valuation for the target company but also:

California Consumer Privacy Act is Here—What Now?

February 7, 2020 | Stephen S. Wu

You may have heard that California has a new privacy law. The California Consumer Privacy Act (CCPA) came into effect on January 1, 2020. It covers large(r) businesses in California. Covered businesses have to give “consumers” four key rights:

The right to know their privacy practices regarding how they collect, use, share, and sell consumers’ personal information.
The right to demand that businesses delete personal information. There are some exceptions in the law.

Podcast on Brexit, GDPR, and the American AI Initiative

February 11, 2019 | Silicon Valley Law Group

Today, shareholder Stephen Wu hosted DMH Stallard partner Anthony Lee and talked about fast-breaking news about personal data exports from the United Kingdom to the United States in light of Brexit and the status of the General Data Protection Regulation in the United Kingdom. Steve Wu spoke about the American Artificial Intelligence Initiative executive order that President Donald Trump was expected to sign today.

To listen to the podcast or download a copy, please click here.

Stephen Wu’s practice includes compliance, transactions, liability, investigation, and governance in advanced information technologies such as artificial intelligence He collaborates with lawyers in other member firms of the International Network of Boutique and Independent Law Firms’ in a global GDPR working group. For assistance on GDPR, GDPR compliance program, or artificial intelligence matters, please contact Stephen Wu by completing the web form here.

GDPR: Long Arm of EU Law in the U.S.

February 11, 2018 | Stephen S. Wu

In my first blog post on GDPR, I talked about why some U.S. businesses have an obligation to comply with the European Union’s General Data Protection Regulation (GDPR). This post expands on the territorial scope of GDPR. Which U.S. businesses have to comply with GDPR and which don’t?

Starting first with GDPR’s direct coverage, GDPR talks about businesses established in the EU. If a business has a division or office in the EU, then it has activities covered by GDPR. Also, if a business offers goods or services in the EU (even if free), the business must comply with GDPR. In addition, if a business is monitoring the behavior of EU residents, GDPR applies. Finally, if EU law applies because of public international law, then GDPR applies there as well. This last basis will not affect most U.S. businesses. These bases for GDPR’s coverage all appear in GDPR Article 3.

In addition to direct coverage, a U.S. business may have compliance obligations indirectly because it is processing data on behalf of a company that is covered by GDPR. The customer may be a controller collecting personal data from EU residents or may itself be a data processor receiving data from a controller covered by GDPR. In either case, a controller and any downstream processor have an obligation to protect personal data collected from EU residents. They will need to make sure any U.S. businesses providing data processing services meet the standards of the kind imposed by GDPR through an agreement or other mechanism. The two most common mechanisms are “standard contractual clauses” – essentially an addendum to a service agreement that impose data protection requirements – or a U.S. business’s self-certification under the EU-U.S. Privacy Shield program of the U.S. Department of Commerce. A U.S. business providing services for a European controller or processor can import EU personal data to the U.S. if it provides assurances of an adequate level of protection under either of these two mechanisms. These U.S. businesses, then, have an indirect obligation to comply with GDPR standards.

Six Steps Towards GDPR (and Other Data Protection) Compliance

February 2, 2018 | Stephen S. Wu

This is my third blog post on the European Union’s General Data Protection Regulation (GDPR). For basic information about GDPR and why U.S. businesses need to watch out for GDPR, see my first blog post in the series. Or to see what GDPR says about information security requirements, see my second post.

What is the first thing your business should do in taking steps towards GDPR compliance? The short answer is you should assess your current privacy and security program.

More specifically, you will need to understand your organization, its business context, its culture, and the types of personal data it processes. You will need to understand in a detailed way what kinds of personal data the business is collecting and receiving, how it uses personal data, its practices in sharing and transmitting personal data, its retention of personal data, and its disposal of personal data. Your business should understand its entire personal data lifecycle and where personal data flow through your business’s systems. You need to assess the strengths and weaknesses of your current data protection program. Once you have made this assessment, you can plan future steps to enhance the data protection function within your business. You can then assess its effectiveness and make improvements.

Countdown to GDPR Compliance Deadline: May 25, 2018

January 17, 2018 | Stephen S. Wu

The hottest data protection issue for major U.S. businesses this year is compliance with the European Union’s General Data Protection Regulation (GDPR). Even small and medium sized businesses may also need to comply with GDPR. This post covers frequently asked questions about GDPR.

What is GDPR? GDPR[1] is the European Union’s comprehensive data protection law that takes the place of 1995’s Data Protection Directive 95/46/EC.[2] By “data protection,” I am referring to both privacy and security. GDPR collects, clarifies, harmonizes, and expands data protection requirements throughout the European Economic Area (EEA). The European Economic Area consists of the 28 countries of the European Union plus Norway, Iceland, and Liechtenstein.

Why is GDPR such a concern for U.S. businesses? First, the fines for violating GDPR are potentially heavy. EU data protection authorities can fine businesses up to 20 million euros ($23.5 million) or 4 percent of their global revenues for violations, whichever is greater. Fines, moreover, will likely be based on the revenue of the global parent and any subsidiaries involved with the violations. Second, U.S. businesses find GDPR to be complex and unfamiliar. Questions arise concerning jurisdictional scope, defining the kinds of personal data covered, obtaining consents from individuals, maintaining an audit trail of consents, managing cross-border data flows, and handling new forms of individual rights given to EEA residents.

Is Your Company a HIPAA Business Associate?

October 7, 2017 | Stephen S. Wu

If your business provides services to healthcare providers or health insurance companies, your business may have data privacy and security requirements under a federal law called “HIPAA” (the Health Insurance Portability and Accountability Act). If your business offers an online service or application, the first time you may have heard of HIPAA is when your potential customer asks you to sign a “business associate agreement.” Even if you don’t sign a business associate agreement, you may have compliance obligations under HIPAA. And if you fail to comply with HIPAA, you may face penalties and liabilities for violations.

Health records are among the most sensitive sets of information about us. The results of an unauthorized disclosure of health records could be devastating. Leakage of health records could lead to victims’ embarrassment, stigma, job loss, and even identity theft. Following concerns about the privacy and security of health records in the 1990s, the public began to demand protection to ensure that the healthcare industry would implement controls over what information was gathered from patients, how the information could be shared, and the secure management of that information. When Congress overhauled the healthcare laws and called for greater use of electronic transactions, Congress was aware of the need for protections over the privacy and security of health information.

The need for simplifying the administration of healthcare, coupled with a public concern over privacy and security, prompted Congress to include requirements for privacy and security in landmark healthcare legislation enacted in 1996. The 1996 legislation, called the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”),[1] has had a broad impact on the healthcare industry since its enactment, transforming practices for creating, storing, managing, transmitting, and disclosing health information in the United States. Later, Congress passed the Health Information Technology for Economic and Clinical Health Act, also called the “HITECH Act.”[2]