4/14/25
By: James G. Bozza and Kevin R. Stone
A Connecticut court recently found a law firm liable for failing to protect its email system following a breach, which led to a fraudster obtaining funds …
Category: Cyber, Privacy, & Security
Key updates to CCPA fines and penalties for 2025
1/8/25
By: David A. Cole and Danielle A. Ocampo
The California Privacy Protection Agency (CPPA) has announced significant updates to the fines and penalties under the California Consumer Privacy Act (CCPA), effective January 1, 2025. …
The price of consumer data: Marriott, Starwood, and the Federal Trade Commission
11/20/24
By: Zohar Peleg
On October 9, 2024, Marriott International, Inc. and its subsidiary, Starwood Hotels & Resorts Worldwide, LLC (collectively “Marriott”) agreed to a proposed settlement1 with the Federal Trade Commission (“FTC”) and a coalition of …
CrowdStrike-Delta lessons for third-party risk management
11/12/24
The world cannot unsee images of the “blue screen of death” across millions of Windows devices on July 19, 2024.1 CrowdStrike, an American Cybersecurity SaaS provider of its Falcon endpoint detection product, …
FMG’s Top 5 Cybersecurity Awareness Month tips to avoid “spooks and spoofs”
10/22/24
October is Cybersecurity Awareness Month, which means this month (like every month!) is a great opportunity for organizations to focus on their data security and privacy practices. Through our representation of businesses of …
DOJ delivers new guidance on AI in compliance programs
10/8/24
On Monday, September 23, 2024, the Department of Justice (“DOJ”) released updated guidelines for prosecutors evaluating corporate compliance programs, including those employing AI systems. This update follows the public statements made by Deputy …
9/16/24
By: Donald Patrick Eckler and Charlotte Meltzer
When an individual tries on non-prescription glasses using virtual software that captures some biometric information, are they a “patient in a health care setting” such that the …
Summer cyber & privacy round-up
9/9/24
By: Nicholas Jajko
2024 has been another busy year for data privacy regulation, bringing the passage of privacy laws in seven new states (New Jersey, Kentucky, Maryland, Nebraska, New Hampshire, and Rhode Island). Other developments are also …
7/23/24
Plaintiffs are using a company’s website arbitration clauses in the Terms of Service to launch mass arbitration attacks. As a result, even where companies want to waive arbitration to litigate and dismiss the …
Eleventh Circuit rejects $35 million robocall class action settlement
7/10/24
By: Matthew N. Foree
The U.S. Court of Appeals for the Eleventh Circuit recently rejected a class action settlement based on a number of errors in approving the settlement in the District Court below. See Drazen v. …
Tennessee raises the bar on data breach class actions
7/10/24
By: Matthew P. Delfino, Curt M. Graham, and Justin J. Boron
In response to a growing number of data breach class action lawsuits, Tennessee has enacted Public Chapter 991, which redefines …
The private right of action in privacy laws: Comparing Vermont to California
6/25/24
By: Justin J. Boron, Matt P. Delfino, and Danielle A. Ocampo
In recent years, a number of states have passed privacy laws, including Montana, Maryland, Tennessee, Kentucky, and many others. The …