Jeffrey L. Poston

Blogs: Data Law Insights, Retail & Consumer Products Law Observer

Latest Articles

No Summer Vacation for Government as New Cybersecurity Legislation Passes

By Jeffrey L. Poston, Kate M. Growley, CIPP/G, CIPP/US & Michael G. Gruden, CIPP/G on September 6, 2018

The federal government has kept busy this summer by issuing multiple regulations impacting government contractors’ cybersecurity. First, the Department of Defense released the 2019 National Defense Authorization Act (NDAA), which included notable cybersecurity provisions involving foreign ownership and Controlled Unclassified Information (CUI), among others. Second, Congress passed the NIST Small Business Cybersecurity Act requiring the National Institute of Standards and Technology (NIST) to develop guidance and resources for small-and-medium-sized businesses to minimize cybersecurity risks. This…

Data Law Insights

Political Data Firm Improperly Accessed Facebook Users’ Data

By Jeffrey L. Poston, Peter B. Miller, CIPP/G/US, CIPP/E, CIPM, CIPT & Brandon C. Ge on March 27, 2018

Facebook faces government investigations on both sides of the Atlantic after recent revelations that Cambridge Analytica, a British political data firm with ties to President Trump’s 2016 campaign, collected and used the personal information of more than 50 million Facebook users in a manner that violates Facebook’s stated policy regarding access, disclosure, and use of personal information. Legislators in the U.S. and the UK have called for hearings. The Federal Trade Commission (“FTC”) has confirmed …

Data Law Insights

Ninth Circuit Revives Data Breach Class Action, Finds Risk of Identity Theft Without Actual Harm Sufficient to Establish Standing

By Brandon C. Ge, Nathanial J. Wood & Jeffrey L. Poston on March 13, 2018

Last week, the U.S. Court of Appeals for the Ninth Circuit revived a class action lawsuit related to a 2012 data breach, determining that the future risk of identity theft suffices to establish Article III standing, even where there has been no actual harm. At issue in the case, In re Zappos.com, was whether the plaintiffs had standing to bring claims based on a January 2012 data breach where hackers allegedly stole the personal information…

Data Law Insights

D.C. Circuit: Alleged theft of healthcare subscriber information satisfies Article III harm standard under Spokeo

By Jeffrey L. Poston, Peter B. Miller, CIPP/G/US, CIPP/E, CIPM, CIPT & Charles Austin on August 11, 2017

The U.S. Court of Appeals for the D.C. Circuit has now weighed in on whether plaintiffs can bring a putative class action arising from an alleged data breach in lieu of allegations of actual misuse of compromised data. Emphasizing the “low bar to establish [] standing at the pleading stage,” the D.C. Circuit reversed a ruling that the alleged theft of personally identifying policyholder information alone without any specific allegations of harm did not satisfy…

Data Law Insights

FTC Submits Public Comment to Working Group Tasked with Developing Guidance on IoT Security, Upgradability, and Patching

By Jeffrey L. Poston & Stephanie Reiter on July 7, 2017

On June 19, 2017, the Federal Trade Commission (FTC) issued a public comment regarding the National Telecommunications & Information Administration’s (NTIA) draft guidance titled Communicating IoT Device Security Update Capability to Improve Transparency for Customers. In commenting on the guidance, the FTC acknowledged the benefits of and challenges to IoT device security, and encouraged manufacturers to take reasonable measures to secure devices and inform consumers about its security features. The FTC also recommended three…

Data Law Insights

New Texas Law Explicitly Allows Driverless Cars

By Jeffrey L. Poston & Brandon C. Ge on June 28, 2017

On June 15, Texas Gov. Greg Abbott signed a bill that explicitly allows self-driving cars on the state’s roads and highways, regardless of whether a human is physically present. While there was no ban on driverless cars, Texas law did not explicitly permit them either. This created a grey area of the law that fueled apprehension among manufacturers about testing self-driving cars in Texas. Senate Bill 2205 allows driverless vehicles to operate in the state…

Data Law Insights

Judge Approves Neiman Marcus Data Breach Settlement

By Jeffrey L. Poston & Brandon C. Ge on June 27, 2017

Last week, an Illinois judge preliminarily approved a $1.6 million settlement between Neiman Marcus and a class of customers affected by a 2013 data breach. The settlement, which the parties agreed to in March, covers U.S. residents whose credit card or debit card was used between July 16, 2013 and January 10, 2014 at any Neiman Marcus store. Any such customers who file a claim will receive up to $100, with the four class representatives…

Data Law Insights

Nevada Enacts Internet Privacy Regulation

By Jeffrey L. Poston & Leigh Colihan on June 20, 2017

On June 12, Nevada Gov. Brian Sandoval (R) signed into law a bill requiring the operator of an Internet website to disclose the type of information it collects on Nevada residents. Under the law, any company or person who (1) owns or operates an Internet website or online service for commercial purposes, (2) collects information about individuals residing within Nevada, and (3) maintains minimum contacts with Nevada must make available a notice listing the personally…

Data Law Insights

Data Breach Class Action Dismissed for Not Establishing Economic Injury

By Jeffrey L. Poston & Brandon C. Ge on June 20, 2017

Earlier this week, a federal Illinois court dismissed a class action against book retailer Barnes & Noble that alleged breach of contract, invasion of privacy, and violations of state consumer fraud and breach reporting laws. The case, dismissed for failing to establish economic harm, marks another data point in demarcating actionable data breaches and highlights perhaps the most challenging issue for plaintiffs in data breach class actions. The complaint stemmed from a data breach that…

Data Law Insights

Supreme Court to Hear Major Cellphone Privacy Case

By Jeffrey L. Poston & Brandon C. Ge on June 6, 2017

Yesterday, the Supreme Court announced that it will hear a case with significant ramifications for privacy in the digital age. The case involves a man convicted of armed robbery based in part on cellphone location data obtained without a probable cause warrant. The conviction was appealed at the Sixth Circuit Court of Appeals, which held that the Fourth Amendment does not require a warrant under such circumstances. While the Supreme Court has recently restricted the…

Jeffrey L. Poston

No Summer Vacation for Government as New Cybersecurity Legislation Passes

Political Data Firm Improperly Accessed Facebook Users’ Data

Ninth Circuit Revives Data Breach Class Action, Finds Risk of Identity Theft Without Actual Harm Sufficient to Establish Standing

D.C. Circuit: Alleged theft of healthcare subscriber information satisfies Article III harm standard under Spokeo

FTC Submits Public Comment to Working Group Tasked with Developing Guidance on IoT Security, Upgradability, and Patching

New Texas Law Explicitly Allows Driverless Cars

Judge Approves Neiman Marcus Data Breach Settlement

Nevada Enacts Internet Privacy Regulation

Data Breach Class Action Dismissed for Not Establishing Economic Injury

Supreme Court to Hear Major Cellphone Privacy Case

Company

Support

New to the Network