Gregory P. Szewczyk

Latest Articles

Analysis: Verifying Consumer Requests Under the CCPA

By Philip N. Yannella & Gregory P. Szewczyk

October 21, 2019

For businesses, one of the more worrisome scenarios under the CCPA occurs when they mistakenly provide personal information of a consumer to the wrong party in response to a consumer request, whether because of fraud or simple mistake. Because the definition of data breach under the CCPA is very broad, the unauthorized sharing of personal information with the wrong party could theoretically give rise to a civil cause of action with statutory penalties of $100-$750,…

CyberAdviser

Analysis: Notice Provisions of CCPA Proposed Regulations

By Philip N. Yannella & Gregory P. Szewczyk

October 17, 2019

To the surprise of some, the proposed CCPA Regulations issued last Thursday don’t address many of the well-discussed ambiguities under the law (such as what “valuable consideration” means in the context of a sale of personal information). Rather, the proposed Regulations address a number of technical, nut-and-bolt type compliance issues concerning how businesses must make required privacy disclosures, provide opt-outs notices, verify and respond to consumer requests. We’ll discuss the issues the proposed Regulations don’t…

CyberAdviser

California AG Releases Proposed CCPA Regulations

By Philip N. Yannella, Kim Phan, Gregory P. Szewczyk & Katie Morehead

October 10, 2019

The California Attorney General’s Office released its long-awaited proposed CCPA Regulations this afternoon. The proposed Regulations are 24 pages long, and address a number of important technical compliance issues including how businesses should: provide just in time notice to consumers of personal information collected; provide notice to consumers of the right to opt out of the sale of personal information; provide notice to consumers of financial incentives; provide a CCPA compliant privacy policy; provide methods for consumers to submit requests to…

CyberAdviser

California Legislature Adopts Five Amendments to CCPA, But Largely Rejects Industry Efforts

By Gregory P. Szewczyk & Philip N. Yannella

September 16, 2019

marketing-segmentation-picture-id469202236

On September 13, 2019—the last day of the legislative session—California lawmakers approved five amendments intended to clarify the scope of the California Consumer Privacy Act (the “CCPA”), but rejected several industry-backed proposals that would have exempted personal information used for targeted advertising and loyalty programs. Five amendments passed: AB 25, 874, 1146, 1355, and 1564. As we have noted in prior posts, the version of AB 25 that ultimately made it through the legislature…

CyberAdviser

Delaware and New Hampshire Join Growing List of States With New Insurance Data Security Laws

By Malia K. Rogers, Gregory P. Szewczyk & Philip N. Yannella

August 9, 2019

Delaware (July 31, 2019) and New Hampshire (August 2, 2019) have become the latest states to add to the insurance cybersecurity landscape by enacting information security laws. These laws come on the heels of Connecticut’s law enacted a few days earlier. Notably, while Connecticut followed the New York Department of Financial Services’ 2017 Cybersecurity Regulations model, Delaware and New Hampshire followed South Carolina, Ohio, Michigan, and Mississippi in adopting a version of the model…

CyberAdviser

Connecticut Becomes Latest State to Enact Insurance Data Security Law

By Gregory P. Szewczyk & Philip N. Yannella

August 2, 2019

On July 26, 2019, Connecticut Governor Ned Lamont signed into the law the state’s new Insurance Data Security Law, which imposes new information security, risk management, and reporting requirements for carriers, producers, and other businesses licensed by the Connecticut Insurance Department (“CID”). In doing so, Connecticut joins New York, South Carolina, Ohio, Michigan, and Mississippi as states that have enacted information security laws for insurance companies. However, whereas the recent trend has been to follow…

CyberAdviser

California Senate Judiciary Committee Advances Amendments to the CCPA

By Gregory P. Szewczyk & Alexia C. Chapman

July 10, 2019

At what has been described as a marathon hearing that lasted late into the night of July 9, the California Senate Judiciary Committee advanced several amendments to the California Consumer Privacy Act (the “CCPA”), but major changes that opponents claimed would have eroded privacy protections for consumers largely failed. The bills advanced from the Senate Judiciary Committee will now go to the Appropriations Committee, and if they pass, to a full Senate vote. Among the…

CyberAdviser

Utah Privacy Law Would Be First to Require Search Warrant for Government to Access Stored Data

By Philip N. Yannella, Gregory P. Szewczyk, Anthony C. Kaye & Marjorie J. Peerce

March 28, 2019

Utah Governor Gary Herbert is expected to sign a new privacy law in the coming weeks that will make his state the first to protect private electronic data stored with third-party providers from government access without a warrant. Under the legislation passed unanimously by the Utah Legislature earlier this month, law enforcement agencies need a warrant to obtain information about an individual from wireless communications providers, email platforms, search engine providers, or social media companies.…

CyberAdviser

Supreme Court Orders Standing Analysis in Google Settlement

By Gregory P. Szewczyk & Philip N. Yannella

March 20, 2019

On March 20, 2019, the Supreme Court refused to address the adequacy of a $8.5 million Google privacy class action settlement and instead remanded to a lower court to determine whether the class action plaintiffs had standing to assert a claim under the Stored Communications Act (“SCA”). The Court’s holding serves as a reminder that despite the recent trend in finding standing for privacy violations, it can still be an open issue. Frank v. Gaos…

CyberAdviser

Illinois Supreme Court: No ‘Actual Harm’ Required for Biometric Information Privacy Act Claims

By Philip N. Yannella, Gregory P. Szewczyk & J. Matthew Thornton

January 29, 2019

The Illinois Supreme Court held on January 25, 2019, that plaintiffs filing suit under the Biometric Information Privacy Act—which regulates how private entities disclose and discard biometric identifiers—do not need actual damages for standing. The decision has serious implications for companies collecting biometric data from Illinois residents. The Act provides a private right of action to individuals “aggrieved” by any violation, allowing them to seek, among other remedies, liquidated or actual damages, attorneys’ fees, and…

Gregory P. Szewczyk

Analysis: Verifying Consumer Requests Under the CCPA

Analysis: Notice Provisions of CCPA Proposed Regulations

California AG Releases Proposed CCPA Regulations

California Legislature Adopts Five Amendments to CCPA, But Largely Rejects Industry Efforts

Delaware and New Hampshire Join Growing List of States With New Insurance Data Security Laws

Connecticut Becomes Latest State to Enact Insurance Data Security Law

California Senate Judiciary Committee Advances Amendments to the CCPA

Utah Privacy Law Would Be First to Require Search Warrant for Government to Access Stored Data

Supreme Court Orders Standing Analysis in Google Settlement

Illinois Supreme Court: No ‘Actual Harm’ Required for Biometric Information Privacy Act Claims

Stay Connected

Company

Support

New to the Network