Topic
data retention
208 published works
Information Bytes
Less Data #4: Illinois court rules that lack of data retention schedule violates BIPA
By Peter Sloan
Illinois court rules that failure to establish a biometric data retention schedule is an actionable BIPA violation. What may this mean for other states' privacy laws that require data minimization…
Information Bytes
Less Data #3: New FTC enforcement actions require retention schedules and data disposal
By Peter Sloan
We've already seen how new FTC regulations for GLBA-regulated financial institutions require retention schedules and disposal of unnecessary data as essential data security controls. The FTC is now also taking…
Information Bytes
Less Data #1: State-level data security regulators are enforcing data disposal
By Peter Sloan
Data security laws increasingly require disposal of unnecessary data, But will regulators take this seriously?
Information Bytes
Less Data is (even) More Than Ever
By Peter Sloan
Two years ago I made a prediction: "For the 2020s, the dots already connect clearly – the new impetus for managing information retention and disposal will be data privacy and security…
Data Protection Report
FTC proposed consent order prohibits perpetual retention of personal information
By David Kessler (US), Susan Ross (US), Susana Medeiros (US)
We had previously written about an FTC proposed consent order that would prohibit a company from perpetual retention of personal health information. On March 2, 2023, the FTC announced a…
Global Investigations & Compliance Review
DOJ Updates Ephemeral Messaging Guidance
On Friday, March 3, 2023, the DOJ released its updated Evaluation of Corporate Compliance Programs, which included new guidance on ephemeral messaging platforms and other issues. This new guidance was…
Data Protection Report
“Forever and forever, farewell”: FTC prohibits indefinite retention of PHI in consent order
By David Kessler (US), Susan Ross (US), Susana Medeiros (US)
On February 1, 2023, the Federal Trade Commission announced a complaint and stipulated order with GoodRx, with the FTC using for the first time its interpretation of the Health Breach…
Bright Law Blog
Record keeping and destruction obligations
One of the issues arising out of the Optus and Medibank Private cyber attacks was the surprise at the amount of historical information relating to former customers that the companies…
Privacy & Information Security Law Blog
Illinois Appellate Court Holds Data Retention Policies Required When Collecting Biometric Data
On November 30, 2022, the Second District Appellate Court of Illinois reversed and remanded a grant of summary judgement in favor of defendant, J&M Plating, Inc., for alleged violation of…
Privacy Compliance & Data Security
Make Sure You Have a Good Data Retention Plan. You Need It.
By Odia Kagan
You need a data retention plan. No really. And not just in the European Union. In California too. Commission Nationale de l'Informatique et des Libertés (CNIL) has fined messaging platform…