Cleary Cybersecurity and Privacy Watch

Global Legal Developments related to Cybersecurity Incidents, Cyber Corporate Governance and Regulation Issues, and Privacy and Data Protection Laws

Latest from Cleary Cybersecurity and Privacy Watch - Page 2

Recommendations of the EDPB Further to the CJEU’s Schrems II Judgment: One Step Forward, Two Steps Back?

By Emmanuel Ronco, Natascha Gerlach & Natalie Farmer

December 10, 2020

Main Takeaways Recommendations 01/2020 of the European Data Protection Board (the “EDPB”) on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (the “Recommendations”)[1] attempt to provide a step-by-step roadmap to help EU data exporters transfer personal data outside the EU to third countries in a manner consistent with the judgment of the Court of Justice of the European Union (the “CJEU”) handed down on July…

Cleary Cybersecurity and Privacy Watch

FTC Announces Settlement with Zoom Regarding Data Security Practices

By Alexis Collins & Elizabeth Carlson

November 12, 2020

On Monday, November 9, 2020, the U.S. Federal Trade Commission announced a proposed settlement with Zoom Video Communications, Inc. (“Zoom”), a video conferencing provider, regarding allegations that Zoom misrepresented its data security practices to users and designed its product to circumvent certain embedded security features of third-party software. The proposed settlement requires Zoom to undertake a range of specific remedial measures related to its data security practices. It also imposes multiple layers of reporting and…

Cleary Cybersecurity and Privacy Watch

OFAC and FinCEN Issue Advisories on Cyber Ransom Payments

By Alexis Collins, Chase D. Kaniecki & Samuel H. Chang

October 6, 2020

In the wake of one of the largest reported medical ransomware attacks in U.S. history,[1] the U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) and Financial Crimes Enforcement Network (FinCEN) issued last week a pair of advisories to assist in efforts to combat the increasing threat of ransomware attacks and related sanctions and anti-money laundering (AML) compliance issues.[2] Like our blog post last month on the same topic, the…

Cleary Cybersecurity and Privacy Watch

Schrems II: A Global Update

By Emmanuel Ronco

October 5, 2020

A two-minute global status update two and a half months after the Schrems II judgment of the CJEU: we are still in the dark, but there is hope for light at the end of the 2020 tunnel. Here are the main events since the judgment: Desperately Seeking Guidance: We are still waiting for definitive guidance from the EDPB, which issued FAQs setting out a clear summary of the judgment but did not offer much in…

Cleary Cybersecurity and Privacy Watch

SEC Issues Enforcement Action Against Unikrn, Inc. for its ICO, Prompting Rare Public Dissent from Commissioner Hester Peirce

By Alexis Collins, Colin D. Lloyd, Matthew C. Solomon, Zachary Baum & Jim Wintering

September 24, 2020

On September 15, 2020, the Securities and Exchange Commission issued a cease‑and‑desist order against Unikrn, Inc. concerning its 2017 initial coin offering of UnikoinGold . The SEC found that the Unikrn ICO violated the prohibition in Section 5 of the Securities Act of 1933 against the unregistered public offer or sale of securities. The SEC imposed several remedies, including requiring Unikrn to permanently disable the UnikoinGold token and a civil money penalty of $6.1 million.…

Cleary Cybersecurity and Privacy Watch

Ransomware and Sanctions Compliance: Considerations for Responses to Attacks

By Alexis Collins, Chase D. Kaniecki & Samuel H. Chang

September 14, 2020

Last month, reports surfaced that fitness technology company Garmin may have made a multimillion dollar payment in response to a ransomware attack with reported links to Evil Corp, a Russian hacking group subject to U.S. sanctions. This incident and other recent reports of ransomware attacks against large companies highlights that companies should consider potential civil and criminal liability under U.S. sanctions laws when responding to ransomware attacks.…

Cleary Cybersecurity and Privacy Watch

DOJ Charges Former Uber Executive for Alleged Role in Attempted Cover-Up of 2016 Data Breach

By Rahul Mukhi, Joon H. Kim, Jonathan S. Kolodner & Michael J. Phelan

September 2, 2020

Background On August 20, 2020, the Department of Justice (“DOJ”) announced that it had charged Joseph Sullivan, the former Chief Security Officer (“CSO”) of Uber Technologies Inc. (“Uber”), with obstruction of justice and misprision of a felony for allegedly attempting to cover up Uber’s 2016 data incident during the course of an investigation by the Federal Trade Commission (“FTC”). While the DOJ and federal law enforcement have generally treated corporate hacking targets as victims in…

Cleary Cybersecurity and Privacy Watch

OCC Imposes $80 Million Penalty in Connection with Bank Data Breach

By Katherine Mooney Carroll, Alexis Collins, Rahul Mukhi, Jonathan S. Kolodner & Hyatt Mustefa

August 18, 2020

In a landmark enforcement action related to a bank data breach, the Office of the Comptroller of the Currency (“OCC”) assessed an $80 million civil monetary penalty and entered into a cease and desist order with the bank subsidiaries of Capital One on August 6, 2020. The actions follow a 2019 cyber-attack against Capital One. The Federal Reserve Board also entered into a cease and desist order with the banks’ parent holding company. The OCC…

Cleary Cybersecurity and Privacy Watch

Schrems II: The CJEU Declares EU-U.S. Privacy Shield Invalid, Upholds the SCCs And Calls On 27 Supervisory Authorities to Ensure Their Compliance

By Emmanuel Ronco, Natascha Gerlach, Natalie Farmer & Mark Gwilt

July 17, 2020

In a highly-anticipated landmark judgment handed down on July 16, 2020, the Court of Justice of the European Union (the “CJEU”) in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (“Schrems II”, summarised in part 3. below and the full text of which can be accessed here) has: invalidated the European Commission Decision 2016/1250 on the adequacy of the protection provided by the EU-U.S. Data Protection Shield (the “EU-US Privacy Shield”) for transfer…

Cleary Cybersecurity and Privacy Watch

Federal Court Compels Production of Data Breach Forensic Investigation Report

By Katherine Mooney Carroll, Alexis Collins, Rahul Mukhi, Jonathan S. Kolodner & Hyatt Mustefa

July 8, 2020

On June 25, 2020, a federal district court in the Eastern District of Virginia held that a bank must produce in discovery a report generated by its cybersecurity forensic investigator following a 2019 data breach involving unauthorized access to personal information of customers and individuals who had applied for accounts.[1] Even though the report was produced at the direction of outside counsel, the court rejected arguments that the forensic report is protected from disclosure…

Cleary Cybersecurity and Privacy Watch

Global Legal Developments related to Cybersecurity Incidents, Cyber Corporate Governance and Regulation Issues, and Privacy and Data Protection Laws

Recommendations of the EDPB Further to the CJEU’s Schrems II Judgment: One Step Forward, Two Steps Back?

FTC Announces Settlement with Zoom Regarding Data Security Practices

OFAC and FinCEN Issue Advisories on Cyber Ransom Payments

Schrems II: A Global Update

SEC Issues Enforcement Action Against Unikrn, Inc. for its ICO, Prompting Rare Public Dissent from Commissioner Hester Peirce

Ransomware and Sanctions Compliance: Considerations for Responses to Attacks

DOJ Charges Former Uber Executive for Alleged Role in Attempted Cover-Up of 2016 Data Breach

OCC Imposes $80 Million Penalty in Connection with Bank Data Breach

Schrems II: The CJEU Declares EU-U.S. Privacy Shield Invalid, Upholds the SCCs And Calls On 27 Supervisory Authorities to Ensure Their Compliance

Federal Court Compels Production of Data Breach Forensic Investigation Report

Stay Connected

Company

Products

Support

New to the Network