The Illinois Supreme Court held on January 25, 2019, that plaintiffs filing suit under the Biometric Information Privacy Act—which regulates how private entities disclose and discard biometric identifiers—do not need actual damages for standing. The decision has serious implications for companies collecting biometric data from Illinois residents. The Act provides a private right of action to individuals “aggrieved” by any violation, allowing them to seek, among other remedies, liquidated or actual damages, attorneys’ fees, and…

The prevailing wisdom after last year’s enactment of the California Consumer Privacy Act (CCPA) was that it would result in other states enacting consumer privacy legislation. The perceived inevitability of a “50-state solution to privacy” motivated businesses previously opposed to federal privacy legislation to push for its enactment. With state legislatures now convening, we have identified what could be the first such proposed legislation in New York Senate Bill 224. The proposed legislation is…

Just in case you needed a reminder that the California Consumer Privacy Act of 2018 (CCPA) will go into effect on January 1, 2020, the California Department of Justice announced that it will hold six statewide forums to collect feedback from stakeholders as part of its duty to promulgate regulations “that will establish procedures to facilitate consumers’ rights.” The meetings will be held between January 8, 2019 and February 15, 2019. Further information is available…

A relatively quiet year for HIPAA enforcement is ending with a small flourish.  The Office of Civil Rights of the Department of Health and Human Services (HHS) has announced two settlements with covered entities within the span of eight days. The first settlement involved Advanced Care Hospitalists (ACH), a company that provides internal medicine physicians to hospitals and nursing homes in Florida.  In 2014, ACH received notice from a local hospital that individually identifiable patient…

Hold the date: Phil Yannella, Ballard Spahr partner and co-chair of the firm’s Privacy & Data Security Group, will participate in an ACC webcast on Tuesday, December 4, 2018 titled “The State of US State Privacy Laws.” The webcast will focus on the recent proliferation of US state privacy and data security laws, some of which provide for a private right of action, and discuss how companies can provide “reasonable” security to customer and employee data.…

Since the General Data Protection Regulation (“GDPR”) took effect on May 25, 2018, US companies without facilities or employees in Europe have struggled to understand the extraterritorial scope of the GDPR. Under Article 3(2), US companies without an “establishment” in the EU are required to comply with the GDPR where their processing activities relate to the “offering of goods or services” to EU data subjects or where they “monitor” the behavior of EU data subjects.…