Digital Media and Data Privacy Law Blog

The past 20 months have created a lot of transitions in how people work. Some companies still have the majority of their employees working remotely and intend to keep it that way permanently. Other businesses have tried to come back fully in-person only to send workers home again as new variants emerge and COVID cases begin to rise again.

We have seen an increase in cybersecurity incidents with such a dispersed workforce. Changes in working conditions, home systems that are less secure, and the general stress we are all under as the pandemic drags on have all likely contributed.

A survey ... Read More 

As COVID-19 has spread throughout the world and within the United States, companies of all sizes have had to make quick decisions about how to implement work-from-home procedures. While many businesses are accustomed to having some of their employees work remotely at any given time, the sudden shift to a majority of the work force being away from controlled office networks and environments presents a unique and heightened set of technical and cybersecurity challenges.

To access the full article, click here.Read More 

A ruling by the highest court in the European Union regarding the common practice of putting a Facebook “Like” button on a website could have repercussions for American companies doing business overseas.

In late July, the Court of Justice of the European Union ruled that the owner of a website is jointly responsible, with Facebook, for any data that is shared with the social media giant by embedding a social media plugin, such as Facebook’s “Like” button. This means that websites must now get explicit permission to share information with social media sites and show they have a ... Read More 

When news of a major data breach, like the recent one at Capital One, makes headlines, the first response of many business owners may be to breathe a big sigh of relief that it wasn’t them. However, it’s critical that companies use these publicized breaches as a reminder to review their own systems and to see what lessons, if any, they can learn to improve their own data security.

In late July, Capital One announced that approximately 100 million people in the United States and approximately 6 million in Canada had been impacted when an individual gained unauthorized access to its ... Read More 

Brooks Pierce attorney Will Quick recently spoke to Raleigh television station WRAL about the intersection of privacy law and home surveillance technology, particularly doorbell cameras, used by private citizens.

While most people use these types of cameras legitimately to help protect their property, with any new technology there is a risk of misuse, whether intentional or not. Quick explained the use of home surveillance cameras is generally covered by well-established privacy law that holds that people have a reasonable expectation of privacy in certain places.

The full ... Read More 

On Friday, Sept. 28, 2018, California Governor Jerry Brown signed into law first-in-the-nation legislation requiring that manufacturers include “reasonable security features” on any device that is “capable of connecting to the Internet”—commonly known as an “Internet of Things” (IoT) device.  California Assembly Bill 1906 and Senate Bill 327, which contain identical text, won’t go into effect until Jan. 1, 2020, but most manufacturers of IoT devices are going to need that lead time (if not more) to ensure the devices they put out into the market are compliant ... Read More 

When we last left David Nosal, he had escaped liability under the Computer Fraud and Abuse Act after convincing some of his former colleagues at executive search firm Korn/Ferry to use their log-in credentials to download source lists, names and contact information from a confidential database and transfer that information to Nosal.  The U.S. Court of Appeals for the Ninth Circuit held that violating Korn/Ferry’s policy against disclosing confidential information did not amount to violations of the CFAA, and overturned his convictions under that law. 

But the government ... Read More 

I’ve long thought that sending faxes was a pretty silly means of communication.  Don’t send me a fax.  I don’t want it.  At some point I’m hoping that even my kids’ doctor’s office will get dragged into the 20^th century and drop their insistence on faxing.  In the meantime a pdf will be fine, thanks.  In addition to the many reasons faxes are antiquated and annoying, the SEC has just provided us another reason to avoid them: they encourage violations of Reg. S-P!

The Rule

Reg. S-P’s Safeguards Rule requires that every broker-dealer registered with the SEC adopt policies and ... Read More 

You may be too young for this to have been a big thing to you, but almost 30 years ago, D.C. Circuit Judge Robert Bork was nominated to the Supreme Court, and Washington, D.C. went into a tizzy.  Coming as it did just a year after Antonin Scalia joined the Court in 1986, Judge Bork’s nomination had many people very excited and very motivated: some to have him on the Court, and some to keep him off.  In the midst of this hooha, a writer at the Washington City Paper thought it would be cool if Bork’s local video store would share a list of the judge’s rentals.  It did.  And at the time it was completely ... Read More 

If you’ve ever attended the SEC Speaks conference, you know that the official program is an intensely uninteresting collection of short speeches by SEC officials who don’t have a lot of incentives to say groundbreaking things.  But occasionally there are exceptions.  I think Deputy Director Stephanie Avakian’s discussion of cybersecurity cases on Friday was one of those.

Avakian broke those cases down into three categories.

1. Failures of registered entities to safeguard information.  She cited the R.T. Jones Capital Equities Management case from September of last year as an ...

Lawyers and compliance professionals constantly tout the importance of internal information security policies, particularly in light of data privacy problems that are reported almost daily in the media.  Admittedly, drafting such policies as a proactive measure can be a pain because there is always a tendency to worry that, unless you’ve suffered a data breach, you are the proverbial “solution in search of a problem.”

But it’s not.  In fact, in some cases, it’s actually required.  HIPAA (for protected health information), Gramm-Leach-Bliley (for financial ... Read More 

I haven’t yet turned to a life of crime, so far be it from me to criticize actual criminals’ profit-maximizing strategies. It’s easy for me to nitpick, but I’m not the one strapping on my mask and trying to earn a (dis)honest dollar every day. But have a look at this Reuters story from Tuesday. 

In it, we learn that the SEC and the Secret Service are investigating a sophisticated computer hacking group known as “FIN4” that allegedly “has tried to hack into email accounts at more than 100 companies, looking for confidential information on mergers and other market-moving ... Read More 

Ed. Note: This entry is cross posted from Cady Bar the Door, David Smyth's blog offering Insight & Commentary on SEC Enforcement Actions and White Collar Crime.

We’re behind on this, but better (a little bit) late than never. Last month the SEC’s Office of Compliance, Inspections and Examinations released the first results of its Cybersecurity Examination Initiative, announced in April 2014. As part of the initiative, OCIE staff examined 57 broker-dealers and 49 investment advisers to better understand how these entities “address the legal, regulatory, and compliance ... Read More 

Ed. Note: This entry is cross posted from Cady Bar the Door, David Smyth's blog offering Insight & Commentary on SEC Enforcement Actions and White Collar Crime.

When I was at the SEC and online broker-dealers’ customers were the victims of hacking incidents, I used to wonder, why don’t the broker-dealers require multi-factor authentication to gain access to accounts? It was a silly question. I knew the answer. Multi-factor authentication is a pain and nobody likes it.

Do you know what it is? Here’s what Wikipedia says, so it must be true:

Multi-factor authentication ... Read More