400,000 EUR fine by the Italian DPA for a credit agency Cerved Group S.p.A’s failure to provide sufficient responses to a data access requests (DSARs) provides some insight into a
Continue Reading Italy’s €400,000 Credit Scoring Fine: What U.S. Companies Should Know About the Next Phase of DSAR EnforcementEmployee Privacy Rights Under CCPA: CalPrivacy Calls for Comments
Among US states, California is the only one that treats employees as full “consumers,” providing them the right to an employee notice and an applicant notice and employee rights. While
Continue Reading Employee Privacy Rights Under CCPA: CalPrivacy Calls for CommentsWhat is Online Privacy Worth?
How much is that privacy in the window? Researchers behind experiments on people’s willingness to pay for privacy, including Angela Winegar, Cass Sunstein and Alessandro Acquisti argue that consumers’ behavior
Continue Reading What is Online Privacy Worth?
Illinois Supreme Court Rules That Actual Damages Are Not Necessary Under the Illinois Biometric Information Privacy Act
The Illinois Supreme Court’s Ruling
On January 25, 2019, the Illinois Supreme Court issued its long awaited opinion in Rosenbach v. Six Flags Entertainment Corp, ruling that the Illinois Biometric
Continue Reading Illinois Supreme Court Rules That Actual Damages Are Not Necessary Under the Illinois Biometric Information Privacy Act
The Anatomy of a Cyber Attack: Prevention, Response and Postmortem (Part 6 of 6)
This blog post is the sixth and final entry of a six-part series discussing the best practices relating to cyber security. The previous post discussed the individuals and organizations that should be notified once a cyberattack occurs. This post will focus on what a business should not do after a cyberattack. Key points include (1) not using the network, (2) not sharing information with unconfirmed parties, and (3) not attempting to retaliate against a different network.
Continue Reading The Anatomy of a Cyber Attack: Prevention, Response and Postmortem (Part 6 of 6)
The Anatomy of a Cyber Attack: Prevention, Response and Postmortem (Part 5 of 6)
This blog post is the fifth entry of a six series discussing the best practices relating to cyber security. The previous post discussed the important steps that a business should take to preserve evidence and information once a cyberattack has been identified. This post will discuss the individuals and organizations that should be notified once a cyberattack occurs. The four most important groups to contact are (1) individuals within the business, (2) law enforcement officials, (3) The Department of Homeland Security, and (4) other possible victims.
Continue Reading The Anatomy of a Cyber Attack: Prevention, Response and Postmortem (Part 5 of 6)
The Anatomy of a Cyber Attack: Prevention, Response and Postmortem (Part 4 of 6)
This blog post is the fourth entry of a seven-part series discussing the best practices relating to cyber security. The previous post discussed the initial steps that a business should take once a cyberattack has been identified. This post will discuss further steps that a business should take after an attack.
Continue Reading The Anatomy of a Cyber Attack: Prevention, Response and Postmortem (Part 4 of 6)
The Seventh Circuit Sides with Plaintiffs in Data Breach Litigation
On July 20, 2015, in Remijas v. Neiman Marcus Group, LLC, No. 14-3122 (7th Cir. 2015), the Seventh Circuit held that the United States District Court for the Northern
Continue Reading The Seventh Circuit Sides with Plaintiffs in Data Breach Litigation
The Anatomy of a Cyber Attack: Prevention, Response and Postmortem (Part 2 of 6)
This is the second installment in a seven-part discussion on the best practices to prevent a cyberattack. The first part discussed four critical steps to prepare a business in the case of a cyberattack. These included: (1) identifying the crucial assets and functions a business, (2) creating an Response Plan, (3) installing the appropriate technology, and (4) obtaining authority for network monitoring. This article builds on those steps by suggesting further best practices in order to prevent a cyberattack.
Continue Reading The Anatomy of a Cyber Attack: Prevention, Response and Postmortem (Part 2 of 6)
Pennsylvania State Court Rejects Data Breach Claims
In response to a data breach in 2014, employees of University of Pittsburgh Medical Center filed a two-count class action complaint against UPMC for (1) negligence and (2) breach of
Continue Reading Pennsylvania State Court Rejects Data Breach Claims