Data Dive

On July 30, 2024, the Senate passed the Kids Online Safety and Privacy Act (S. 2073) via an overwhelmingly bipartisan vote of 91-3 shortly before departing for the August recess.

At the end of 2023, the Federal Communications Commission (“FCC” or “the Commission”) adopted updates to its existing 16-year-old data breach notification rules (“prior rules”) designed to ensure that sensitive customer information is adequately protected by providers of telecommunications, interconnected Voice over Internet Protocol (“VoIP”), and telecommunications relay services (“TRS”) (such providers, collectively, “carriers”).[1] The FCC released the final order on December 21, 2023. The updates to the rules add to the increasing regulation of data protection and security by federal agencies.

On 7 November 2023, in the King’s Speech, the UK government announced three draft laws aimed at supporting tech companies’ growth and competitiveness: the Automated Vehicles Bill (AV Bill), the Digital Markets, Competition and Consumers Bill (DMCC Bill), and the Data Protection and Digital Information Bill (DP Bill). Expected to be passed in the next 12 months, these laws, as the government says, are focused on modernising regulation so that innovative firms can thrive in the United Kingdom, while at the same time protecting consumers and enhancing users’ trust in new technologies. The proposed comprehensive legal frameworks aspire to position the UK as one of the global leaders on the tech regulation scene, ostensibly more business friendly than the European Union. As anticipated, and in contrast to the EU, there is no immediate plan to adopt a new wide-ranging Artificial Intelligence law, with existing laws continuing to operate as applicable. Firms that want to invest in, deal with or deploy new technologies across the globe should be aware of the UK legal landscape in order to assess and explore opportunities. We highlight a few pertinent points of the three laws in this alert.

On June 18, 2023, Texas enacted the Texas Data Privacy and Security Act (TDPSA), joining the rapidly growing list of U.S. states with comprehensive data privacy laws.¹ The statute will take effect on July 1, 2024, except for the right of consumer-designated agents to submit requests, which takes effect on January 1, 2025. The TDPSA is one of the more unique state privacy laws, but still borrows elements from Virginia’s Consumer Data Protection Act (VCDPA) and California’s Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Meta’s launch of ‘Threads,’ a text-based social media platform linked to Instagram accounts, closely followed the EC’s announcement that Meta and six other Big Tech companies have identified themselves as meeting the thresholds to qualify as potential gatekeepers under the Digital Markets Act.

Read More

As state-level data protection legislation steadily expands, one of the country’s early comprehensive privacy laws to be enacted, the Connecticut Data Privacy Act (CTDPA), will take effect on July 1, 2023. The CTDPA imposes requirements on how companies collect, use and share consumer data, and extends new data privacy rights to Connecticut consumers (read more about the details of the CTDPA here).

A new “Privacy and Data Protection” Task Force has been launched by the FCC. The group will coordinate rulemaking and enforcement across the agency, and handle data breach investigations, equipment authorization, reporting and issues related to undersea cables.

A recent opinion by the Southern District of New York arrives at a time when several large fund managers are facing SEC Enforcement investigations associated with so-called “off-channel” communications. The ruling highlights the intersection of SEC obligations and privacy law.

Read More