Digital Media and Data Privacy Law Blog

The past 20 months have created a lot of transitions in how people work. Some companies still have the majority of their employees working remotely and intend to keep it that way permanently. Other businesses have tried to come back fully in-person only to send workers home again as new variants emerge and COVID cases begin to rise again.

We have seen an increase in cybersecurity incidents with such a dispersed workforce. Changes in working conditions, home systems that are less secure, and the general stress we are all under as the pandemic drags on have all likely contributed.

A survey ... Read More 

When news of a major data breach, like the recent one at Capital One, makes headlines, the first response of many business owners may be to breathe a big sigh of relief that it wasn’t them. However, it’s critical that companies use these publicized breaches as a reminder to review their own systems and to see what lessons, if any, they can learn to improve their own data security.

In late July, Capital One announced that approximately 100 million people in the United States and approximately 6 million in Canada had been impacted when an individual gained unauthorized access to its ... Read More 

We don’t usually talk about four-year-old court decisions in the first instance here.  But the Ninth Circuit has issued a pair of noteworthy opinions interpreting the Computer Fraud and Abuse Act in the last few weeks.  And to understand those it will help to understand United States v. Nosal, 676 F.3d 854 (9th Cir. 2012), an en banc opinion authored by Judge Kozinski.

Facts

The facts are mercifully short.  David Nosal used to work for Korn/Ferry, an executive search firm.  Shortly after he left the company, he convinced some of his former colleagues who were still working for ... Read More 

The FCC has been flexing its muscles in 2015 when it comes to enforcing data security requirements.  In April, it reached a $25 million settlement with AT&T Services, Inc. for failing to safeguard customers’ personal information.  In July, it reached a $3.5 million settlement with TerraCom, Inc. and YourTel America, Inc. to resolve similar claims.  Earlier this month, the FCC announced it had reached a $595,000 settlement with Cox Communications, Inc. (“Cox”) to resolve the Enforcement Bureau’s investigation into whether Cox failed to properly protect its customers’ ... Read More 

Ed. Note: This entry is cross posted from Cady Bar the Door, David Smyth's blog offering Insight & Commentary on SEC Enforcement Actions and White Collar Crime.

Lots of agencies and organizations want to boss you around about cybersecurity.  In April, the SEC and the Justice Department published more directions on the issue.  We’ll cover the very brief guidance issued by the SEC’s Division of Investment Management first, and then turn to DOJ in a later post.

First, as with everyone else, the IM Division thinks cybersecurity is very, very important for investment companies and ... Read More 

Suffering a data breach is bad enough. As often as it appears to happen, companies that are affected by a breach still shoulder a considerable burden. Management must stop the trains to identify the cause and scope of the breach—and then prepare for the aftermath. Lawyers are involved. The company’s brand is at risk. And the costs—employee time, legal fees, security consultants—quickly escalate.

But what if you determine that your company didn’t really need the information that was exposed? Suppose you find out that the breach involved a file that contained ... Read More 

Ed. Note: This entry is cross posted from Cady Bar the Door, David Smyth's blog offering Insight & Commentary on SEC Enforcement Actions and White Collar Crime.

We’re behind on this, but better (a little bit) late than never. Last month the SEC’s Office of Compliance, Inspections and Examinations released the first results of its Cybersecurity Examination Initiative, announced in April 2014. As part of the initiative, OCIE staff examined 57 broker-dealers and 49 investment advisers to better understand how these entities “address the legal, regulatory, and compliance ... Read More 

You have probably heard about the recent data breach at Sony; after all, it’s not often that Kim Jong Un and Angelina Jolie are mentioned as part of the same story. Unlike other recent high profile hacks, the recent Sony hack appears to be somewhat different in character: the hackers appear to care most about using the information stolen from Sony to bring shame and scorn to the company, rather than for their own pecuniary gain.

And the story appears to continue down the proverbial rabbit hole, with reports of a tongue-and-cheek offer of investigative cooperation from the North Koreans ... Read More 

by David Smyth, Securities Enforcement Attorney

On October 31^st, the Federal Trade Commission sued St. Petersburg, Florida-based debt broker Bayview Solutions and two of its principals for posting the debt portfolios of 28,000 consumers online, including their bank account numbers and other identifying information. The “facts” that follow come from the FTC’s complaint. They may not be true!

Bayview’s Business

Bayview buys and sells portfolios of charged-off consumer debt for eventual collection by third-party debt collectors. One means of its business is ... Read More