KMK Law Cybersecurity & Privacy Blog

As businesses continue to operate remotely, data security is more important than ever.  Given this new environment of millions of employees working remotely, it is not surprising that there has been a significant uptick in ransomware attacks over the last two months.

Every month, we see a new set of privacy best practices or a new set of regulations proposed or adopted by a state, Congress, the White House, or countries around the globe. The versions of best practices continue to multiply and the layers of regulation continue to expand. Every new group or political entity wants to out-perform the last – but has this one-upmanship gone too far?

On November 2, 2018 Ohio’s new Data Protection Act went into effect.  The Ohio DPA creates a new statutory affirmative defense against data breach tort claims and identifies specific cybersecurity frameworks that are now presumptively reasonable.  KMK Law  and Gratia, Inc. partnered together to discuss the impact of Ohio DPA on businesses, the steps companies need to take as a result, and what this “safe harbor” really means. 

Ohio recently enacted the Ohio Data Protection Act[1] which was part of Attorney General DeWine’s CyberOhio Initiative. The Act will go into effect on November 2, 2018. Every Ohio business should be familiar with the Ohio DPA and determine whether they can or want to qualify for the benefits. The Ohio DPA also provides another reminder of the importance of examining and evaluating your data protection and written information governance policies.

September 2018 was a busy month for data privacy. We expect the next several months to be extremely active as well, especially with the number of new complaints and data breach notices filed in Europe since May. We will continue to monitor and update developments as the data privacy framework continues to evolve.

G-Day is May 25, 2018, the day when the European Union’s General Data Protection Regulation (“GDPR) is set to go into effect.  Even though the Regulation has been approved and available for review for more than a year, most companies are still working to determine whether GDPR applies and, if so, how to become GDPR compliant.  The litigators from KMK’s Cybersecurity and Privacy Team have prepared a Legal Alert which helps companies answer both questions. 

Two decisions last week further widened the divide among the Courts of Appeals in applying Spokeo in cybersecurity litigation.

Two Courts of Appeals have issued decisions during the past week related to cybersecurity and data retention which anyone who maintains electronic data and personal information should read.

Last week the Seventh Circuit reinstated the Neiman Marcus data breach class action, holding that plaintiffs had satisfied Article III’s standing requirements based on at least some of the injuries they alleged. In doing so, the Seventh Circuit became the first federal court of appeals to rule on a challenge to the standing of purported data breach victims in light of the Supreme Court’s decision in Clapper v. Amnesty International, 133 S. Ct. 1138 (2013), and diverged from the growing majority of federal district courts that have held similar allegations are insufficient to confer standing.