Momentum is building in Congress for federal privacy legislation and several states have their own privacy laws in the works.  But, as concerns grow that companies are collecting and sharing personal information about U.S. residents without their knowledge and not adequately protecting that data, regulators and plaintiffs aren’t waiting for new laws.  Instead, they are refitting existing laws to meet their data privacy and security objectives. The SEC We have previously written on the SEC’s …

In our first Cyber Blog post, we predicted that the rules-based approach adopted by the NYDFS would become the model for cybersecurity regulation.  Two years later, we’re feeling pretty good about that prediction, as the FTC recently proposed incorporating a number of aspects of the NYDFS cybersecurity rules into its Standards for Safeguarding Customer Information rule (the “Safeguards Rule”).  The proposal would also expand the Safeguards Rule’s definition of “financial institution” to include “finders,”…

The Mulvaney Memo on the CFPB and the rule of law is one of the most remarkable documents to be published by an agency head in many years.  It signals a deep commitment to the rule of law as a philosophical concept and as an important brake on agency discretion in the administrative state.   The full memo is well worth a read.  A shorter version appeared in the Wall Street Journal. Acting Director Mulvaney…

The CFPB’s announcement of a call for evidence is a welcome sign that the new leadership of the agency is thinking seriously about how it implements its mission. In the coming weeks the CFPB will publish a series of Requests for Information (RFIs) seeking public comment on the CFPB’s enforcement, supervision, rulemaking, market monitoring and education activities.  The CFPB’s first RFI will focus on Civil Investigative Demands (CIDs), which are a mechanism to gather information…