Key takeaways

• Unintentional material misrepresentations are now within the reach of DC’s consumer protection law.
• Senior corporate officers who play a central role in challenged business practices and personally direct consumer-facing communications to District residents may face individual jurisdiction in the District.
• Public statements accepting personal responsibility for a company’s conduct may later be used to support personal liability.

On May 12, 2026, the Superior Court of the District of Columbia denied Mark Zuckerberg’s motion to dismiss the District’s personal-liability claims under the District of Columbia Consumer Protection Procedures Act (CPPA), D.C. Code §§ 28-3901, et seq. Judge Darlene M. Soltys rejected each of the four grounds Zuckerberg raised, clearing the way for the District to pursue discovery and, potentially, trial against the Facebook founder in his personal capacity. Coupled with a 2025 District of Columbia Court of Appeals decision that broadened the reach of the CPPA, the ruling underscores the growing personal exposure that senior corporate officers may face for consumer-facing representations directed at District residents.

Background

In March 2018, public reporting revealed that a third-party application available on the Facebook platform—developed in 2013 by researcher Aleksandr Kogan—had collected personal information from an estimated 87 million Facebook users. Because of Facebook’s poor privacy protections, the application was able to access not only the data of users who installed it, but also data belonging to those users’ Facebook friends, regardless of whether those individuals had used the application or adjusted their privacy settings. The information was subsequently used by Cambridge Analytica for voter profiling and targeted political advertising in connection with the 2016 U.S. presidential election. More than 340,000 District residents were allegedly affected.

Two proceedings, two defendants

The Office of the Attorney General for the District of Columbia first sued Facebook in December 2018. In May 2022, the Attorney General filed a separate complaint against Zuckerberg individually, alleging violations of the CPPA. After stays and appeals, both cases are proceeding in parallel.

The District’s allegations against Zuckerberg

The complaint centers on the 2010 decision to open the Facebook platform to third-party developers. The District alleges a “decade-long campaign designed to convince users that Facebook cared about and tried to protect users and their data,” and quotes Zuckerberg’s instruction that the company’s policies be “as simple as we can get away with.” The complaint characterizes enforcement as “lax,” application-violation review as “inconsistent or subjective,” and the governing policies as “unclear and confusing” until 2018.

DC alleges that Zuckerberg is personally liable because he “(i) was aware or should have been aware of Facebook’s data-sharing policy terms; (ii) possessed and/or exercised the authority to control the policies and practices… ; (iii) was responsible for creating and implementing the deceptive policies… ; (iv) participated in the deceptive trade practices… ; (v) directed, managed, or supervised… employees… who participated… ; and (vi) knew or should have known of the deceptive trade practices… and had the power to stop them, but did not.”

The Court of Appeals decision expanding CPPA liability

The individual action against Zuckerberg was stayed pending review by the District of Columbia Court of Appeals (DCCA) of the Attorney General’s appeal in the Facebook case. Judge Ross had granted summary judgment to Facebook, concluding that the company had not intentionally misled consumers, excluding the District’s privacy expert, and finding that the District could not satisfy the “clear and convincing” evidentiary standard.

The DCCA reversed. In a decision with significant implications for CPPA enforcement, the court held that unintentional misrepresentations of material fact are actionable under the statute. The court further held that, while intentional misrepresentations must be proven by clear and convincing evidence, unintentional misrepresentations need only be established by a preponderance of the evidence. In practical terms, a negligent misrepresentation may now support a CPPA claim—a meaningful expansion of potential liability for businesses operating in the District.

The court’s ruling on the motion to dismiss

Zuckerberg moved to dismiss on four grounds: (1) lack of personal jurisdiction; (2) impermissible claim-splitting; (3) collateral estoppel; and (4) failure to state a claim. The court rejected each.

Personal jurisdiction. Zuckerberg, a California resident, argued that the District’s courts lacked jurisdiction over him personally. The court disagreed. Under the District’s long-arm statute, D.C. Code § 13-423(a), a court may exercise jurisdiction over a person who causes tortious injury in the District by an act or omission outside the District if that person regularly does or solicits business, or derives substantial revenue from services rendered, in the District. The court noted that Zuckerberg is not merely an employee; he controls approximately 60% of the company’s voting shares and has directed its operations since its founding.

The court also pointed to Zuckerberg’s 2010 op-ed in The Washington Post, in which he told users directly—including District residents—that “you have control over how your information is shared” and that “we do not share your personal information with people or services you don’t want.” Relying on Shoppers Food Warehouse v. Moreno, the court reasoned that a defendant who deliberately directs communications to District residents through a District publication may be subject to suit in the District. Internal 2012 communications in which Zuckerberg acknowledged that the company “leak[ed] info to developers” further supported the conclusion that his contacts with the forum were sufficient.

Claim-splitting. The court rejected this argument, explaining that the rule against claim-splitting applies to successive suits against the same defendant on the same claim. Zuckerberg and Facebook are distinct defendants. The court’s previous ruling denying the District’s request to add Zuckerberg to the Facebook case was only procedural.

Collateral estoppel. Zuckerberg contended that Judge Ross’s denial of the motion to add him to the Facebook case, and a later denial of a motion to add him as a document custodian, amounted to a merits determination that he did not meaningfully participate in the alleged CPPA violations. Judge Soltys disagreed. She noted that Facebook’s own attorneys rejected the notion that Zuckerberg would be held liable if Facebook was found guilty.  Absent a final judgment on the merits that pertains to both defendants, collateral estoppel did not apply.

Failure to state a claim. The court found the District’s allegations sufficient because Zuckerberg served as the company’s “prime decisionmaker,” made personal public assurances regarding data privacy while pursuing an open-platform strategy that made user data available to third parties, and allegedly was aware of the associated risks but proceeded nonetheless. The court concluded that these allegations, together with Zuckerberg’s congressional testimony that “I started Facebook, I run it, and I’m responsible for what happens here,” were sufficient to survive dismissal under Rule 12(b)(6).

Potential damages

The CPPA authorizes recovery of the greater of $1,500 per violation or treble damages, together with attorneys’ fees. The District alleges that more than 340,000 District residents were affected. At $1,500 per affected resident, statutory damages alone could exceed $510 million. The Attorney General may also advance an alternative damages theory.

What comes next

Having filed its individual complaint in 2022 and awaited resolution of the Facebook appeal, the District is now positioned to pursue discovery against Zuckerberg with a substantial evidentiary record gleaned from public disclosures—internal communications, the 2010 op-ed, and congressional testimony—already reflected in its allegations. The central question going forward will be whether the District can establish that Zuckerberg personally made or directed misrepresentations to District consumers, and not merely that Facebook did.

The “meaningful participation” standard is likely to be the focus of any subsequent summary judgment briefing–and appeal. 

Porter Wright attorneys continue to monitor these proceedings. Businesses and executives with questions about CPPA exposure or consumer-protection compliance should consult experienced counsel. Please contact Adrian Snead or any member of Porter Wright’s Litigation Department or Government & Regulatory Affairs Practice Group if you have any questions.

District of Columbia v. Zuckerberg, No. 2022-CA-002273-B (D.C. Super. Ct. May 12, 2026); see also District of Columbia v. Facebook, Inc., 340 A.3d 1 (D.C. 2025); District of Columbia v. Facebook, Inc., No. 2018 CA 008715 B (D.C. Super. Ct.).

The United States Patent and Trademark Office (USPTO) will increase trademark fees starting Jan. 18, 2025, and patent fees starting Jan. 19, 2025. Highlights of the fee increases are provided below. The entire listings of updated filing fees can be found at:

• Trademark USPTO Fee Update
• Patent USPTO Fee Update

Trademark fee increase highlights

Initial trademark applications and post-registration maintenance filings will increase by $100-$200 per class. The current filing fee structure, based on whether the application is a TEAS Plus or TEAS Standard application, will be eliminated and the USPTO will instead charge a single base application fee, per class. If the identification of goods or services is not in the Trademark ID Manual, an additional $200 surcharge fee will be charged per class. The USPTO is also implementing a surcharge fee for descriptions of goods and services that exceeds 1,000 characters. Once the description of goods or services reaches 1,000 characters, every additional 1,000 characters will incur an additional $200 surcharge fee, per class.

To save on filing fees, we can assist in drafting the identification of goods and services to conform with the descriptions in the Trademark ID Manual. If this is not a possibility due to the limitations of the Trademark ID Manual, we will inform you so you are aware of the possible surcharge fee.

Other significant trademark fee increases are associated with post-registration maintenance filings, which will see an increase of $125-$150 per class. For instance, the filing fees for a combined Sections 8 and 9 renewal is $525, per class, but will increase to $650. The filing fees for a combined Sections 8 and 15 renewal is $425 but will increase to $575, per class.

Patent fee increase highlights

Patent filing fees will increase by roughly 7.5%, although initial application filing fees will increase by about 10%. A significant addition to the USPTO patent filing fees is a new continuing application fee based on the number of years the continuing application is filed after the earliest benefit date, ranging from $2700 (undiscounted) for a filing more than six years after the earliest benefit date to $4000 (undiscounted) for a filing more than nine years after the earliest benefit date. Additionally, the fees for a Request for Continued Examination (RCE) will also increase significantly, with the first RCE fee increasing by 10% and subsequent requests increasing by 48%. The USPTO has also implemented new fees for filing Information Disclosure Statements that cumulatively contain more than 50 references ($200), more than 100 references ($500) and more than 200 references ($800).

In light of the USPTO’s upcoming fee increases, we would strongly suggest moving forward with any upcoming filings before Jan. 18, 2025, to take advantage of the lower filing fees. 

On Oct. 30, 2023, the Biden administration issued an executive order focused on the growing field of artificial intelligence. The administration is advancing a comprehensive and coordinated approach to the safe and responsible development and use of AI and setting a marker for the world. The EO is practical and aspirational with varying degrees of immediate impact for businesses and their leadership teams.  

Our team is pleased to offer this summary of the EO and related guidance, and to share key provisions and initial takeaways. In the coming weeks, we will dive deeper into critical topics covered by the new EO.

Executive order on AI: Background and policy

The Biden administration issued its Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence on Oct. 30, 2023. Concerns about the potential risks associated with AI have reverberated around the country and throughout Washington. The White House aims to establish comprehensive regulatory principles over the AI industry. The order builds upon an array of prior governmental and industrial guidance and actions, including the following materials published on ai.gov:

• The Blueprint for an AI Bill of Rights
• The NIST AI Risk Management Framework
• Voluntary commitments from several companies heavily involved in the AI industry
• The National AI R&D Strategic Plan
• The National AI Research Resource Roadmap

In parallel, the Office of Management and Budget issued draft policy guidance on the federal government’s use of AI. OMB is accepting public comments on this draft document until Dec. 5, 2023.

The EO is a clear sign from the White House that the U.S. intends to be the leader in global AI policy and to ensure AI is imbued with Western values as it develops. The EO comes as major industry leaders including Open AI, Google and Microsoft have called for federal or globally-coordinated AI regulation, and Senate Majority Leader Chuck Schumer (D-NY) has launched a major effort to write legislation regulating AI. The European Union and China have already started to regulate AI.

Scope of the EO

The EO seeks to address AI’s broad applications and promote accountability and safety in AI development and deployment across various sectors of the economy. The EO emphasizes eight principles and priorities for AI governance, including:

• Ensure AI safety through robust, standardized evaluations, institutions and risk mitigation before deployment.
• Promote responsible innovation, competition and education while addressing IP concerns and preventing monopoly.
• Support American workers through education, job training and labor impact understanding.
• Advance equity and civil rights.
• Protect the interests of Americans using AI products in their daily lives.
• Safeguard privacy and civil liberties with lawful, secure data handling.
• Manage risks in federal AI use and enhance regulatory capacity for better results.
• Lead global progress, collaborate with international partners and develop an AI risk management framework.

Proposed reporting and rulemaking requirements

Of important note, the EO establishes a number of industry reporting requirements and regulatory promulgation deadlines for federal agencies, ranging from 45 to 365 days, to implement various directives, with stakeholder engagement playing a crucial role. The EO uses the Defense Production Act to mandate certain reporting requirements.

Governmental stakeholders

The implementation and oversight of the EO and associated AI policies will be conducted by the White House AI Council, comprised of representatives from executive branch agencies and departments. The White House AI Council will be chaired by the assistant to the president and deputy chief of staff for policy (currently Bruce Reed) and will include the secretaries or their designees for most of the cabinet agencies, as well as the directors of National Intelligence, National Science Foundation, OMB and Office of Science and Technology Policy, among others.

Following the pattern established with the CHIPS Act, the Department of Commerce and the National Institute of Standards and Technology will take the lead in coordinating and implementing the EO, emphasizing the “all-of-government” approach.

Key takeaways

Potential legislative actions

While congress continues its development of AI legislation, the EO primarily focuses on federal agency programs, AI procurement requirements, national security and potential rulemaking. 

Current focus on federal government use of AI and critical AI risks

It is important to note that while the fanfare and publicity of this EO has been significant, the order cannot independently create new laws or regulations. The EO provides guidance to federal agencies who will issue related regulations. The EO also includes directives pertaining to federal agency programs, criteria for AI systems acquired by the federal government, obligations related to national security and vital infrastructure, and initiating potential regulatory processes for supervised entities.

This alert provides a comprehensive overview of the recent Executive Order on AI and its broad implications. This is the first installment in a short series to delve deeper into key takeaways and deliver essential industry-specific insights for businesses and their leadership, shedding light on the extensive impact of the EO. 

For more information on the EO, please contact Adrian Snead, Matt Lapin, Maxwell Herath or any member of Porter Wright’s Government & Regulatory Affairs Practice Group.

A federal court in California ruled in favor of sanctions against Google last week for failing to preserve records. Google’s document retention policy required individual employees to identify internal chat conversations responsive to a litigation hold. The court found this policy to be in violation of Google’s duty to preserve electronically-stored information under the Federal Rule of Civil Procedure 37(e). The consolidated case arose out of antitrust litigation regarding Google’s “Play Store” Application on Android cell-phones. In re Google Play Store Antitrust Litigation, 21-MD-02981, NDCa.

Google’s data preservation policy

One year after telling the court that it was preserving all evidence for the case at hand, Google came forward to say “that it had not suspended the 24-hour retention policy for history ‘off’ chats.” Google’s standard policy was to delete one-on-one chats after 24 hours unless the chat history was toggled to “on.” In that case, they were retained for 30 days. The court took issue not with the policy, but rather Google’s failure to implement an evidence preservation strategy once the company was notified of the case and it’s delinquency in transparency regarding the chat deletion.

The court was unsympathetic to Google, explaining that the company is a sophisticated litigant with knowledgeable legal counsel and frequent experience in the judicial system. Google trains its employees on document retention. However, chat histories reviewed by the court showed employees requesting to be off-the-record—with chat history off—even when discussing potentially relevant topics. In other instances, employees did not realize that chats should be preserved in situations that legal counsel would have immediately recognized as relevant. Google’s poor practice with respect to its chat history also stood in sharp contrast to its email retention policy that automatically preserved all emails from relevant custodians without requiring any individual action. The issue of the missing chats was expensive, requiring “countless hours reviewing voluminous briefs” and several hearings that included a two-day evidentiary proceeding.

Finding in favor of sanctions, the court withheld determining the sanctions until discovery is completed. Stating that the “case will not be decided on the basis of lost Chat communications,” the court intends to determine later “what might have been lost in the Chat communications,” so that it may craft a remedy proportional and appropriate to that which was lost. In the meantime, the court required Google to cover plaintiffs’ attorneys’ fees and other costs in bringing the motion.

Preserving corporate data

When thinking through a corporate data preservation strategy, there are a few things to keep in mind:

• When a company is notified of litigation and distributes hold-notices, consider ways to take decisions out of the hands of individual employees and institute an approach that automatically preserves relevant documentation.
• Companies should take a wide-lens view of where information may be present, including chats, text messages, voice mails and meeting notes. Policies can be drafted with legal counsel in advance so that when litigation hits, the company is prepared to institute holds on relevant information.
• Companies should be transparent with courts when document retention falls short. In this case, the company assured the court that evidence was preserved and only admitted a year later that chats were lost. Being forthright can help a company avoid looking like it intentionally destroyed evidence and the costly ramifications that follow.

For questions regarding document retention, please contact Molly Crabtree, Chad Mowery or Katja Garvey, or any member of Porter Wright’s E-Discovery or Privacy & Data Security practice groups.

Employers beware: A recent holding out of Illinois has determined that employees may sue employers who collect and/or disclose employees’ biometric data. On Feb. 3, 2022, the Illinois Supreme Court issued a significant decision in McDonald v. Symphony Bronzeville Park, LLC, et al., impacting current and  future claims against employers involving the Illinois Biometric Information Privacy Act (BIPA). The McDonald decision effectively held that the exclusive remedy provisions of the Illinois Workers’ Compensation Act (IWCA) do not apply to BIPA claims, and thus employers cannot use the IWCA to preempt these BIPA claims.

BIPA case detail

In McDonald, the plaintiff alleged that her former employer, Symphony Bronzeville Park, LLC (Bronzeville), had violated BIPA by requiring employees to clock-in using a fingerprint scanner.  McDonald and the putative class alleged that Bronzeville utilized this fingerprint-scanning system without obtaining their written consent or disclosing the purpose or length of time for which their biometric information was being stored. Plaintiff sued in circuit court, and Bronzeville sought to dismiss the suit, stating that the IWCA provided the exclusive remedy for an employee’s claims against their employer and that the case should therefore proceed before the Illinois Workers’ Compensation Commission.

The Illinois Supreme Court acknowledged that the IWCA typically provides the exclusive remedy for employees’ claims against their employers. It then held that McDonald and her class could nonetheless pursue their BIPA claims “in the circuit court, rather than through a claim before the Workers’ Compensation Commission, because McDonald’s and the putative class’s alleged injury is not one that ‘categorically fits within the purview of the [Compensation] Act.’”

In reaching its decision, the Supreme Court noted that the Illinois legislature enacted the IWCA to function as a remedial statute, which should be “liberally construed to effectuate its main purpose — to provide financial protection for injured workers until they can return to the workforce.” As such, most workplace injuries would fall under the exclusive remedy provisions of Sections 5(a) and 11 of the IWCA. Nevertheless, the Supreme Court noted that the plain language of BIPA indicated that the legislature did not intend for BIPA to be preempted by the IWCA, in part because the “written release” required to collect data under BIPA included “a release executed by an employee as a condition of employment.”

Here, the employees’ injuries did not affect their capacity to perform employment-related duties — “the type of injury for which the workers’ compensation scheme was created.” Instead, the plaintiff and the class sought compensation for “personal and societal injuries” caused by violating BIPA, which differed in nature and scope from the physical and psychological work injuries compensable under the IWCA.  The alleged injuries involved the violation of McDonald’s and the class’s rights to maintain their biometric privacy, injuries which were not compensable under the IWCA.

Potential implications for employers

The McDonald decision serves as a warning to all employers who collect, store or otherwise obtain employee data subject to BIPA. Using and storing this information without the prior written consent of employees can open employers up to further liability outside of the IWCA.

Potential impact outside of Illinois

Companies with a presence in Illinois utilizing biometric technology may be directly impacted by BIPA.  In addition, companies located outside of Illinois have been sued in Illinois courts alleging violations of BIPA. Although BIPA generally does not apply to conduct outside of Illinois, courts have been asked to determine whether the alleged violations occurred “primarily and substantially within Illinois.” Similarly, an employer may have employees who touch Illinois in other ways and are therefore covered by the statute.

There is similar pending and proposed legislation in other states and proposed national legislation. As the use of biometric technology continues to increase and more legislation follows, employers will need to keep up with any new laws and regulations.

Porter Wright is proud to announce that international business and privacy & data security attorney Katja Garvey has been elevated to serve as chair of the firm’s International Business & Trade Practice Group. As chair, she will work alongside the 40 attorneys on the team to uphold client service, develop business strategy, expand global connections and distribute critical legal updates.

International business, and privacy and data security experience

A German native, Katja thrives on helping international businesses to bridge complex legal and cultural divides. From complex international transactions to global privacy compliance, she routinely advises clients on matters related to cross-border transactions, contract negotiation and entity formation. For clients domestically and abroad, Katja integrates robust privacy and data security experience to create and manage policies and procedures to ensure compliance with the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). She is a Certified Information Privacy Professional/Europe (CIPP/E) and has experience serving clients as an external data protection officer (DPO)

Katja transitions into her leadership role with support from longtime leader and Counsel-to-the-Firm, Dixon Miller, who has held the position of chair since inception of the international group. “It has been an honor to lead, serve and grow our team over the past few decades,” shared Dixon. “Katja will do a tremendous job as she steps into the chair role. Her passion for mentorship and building connections, dedication to client service, bilingual ability in English and German, and training in two different legal systems will serve her very well in this new position.”

In her recent Women in Law Q&A for Porter Wright, Katja credits much of her success to establishing a strong network of mentors throughout her professional career. “Having active and involved mentors, or better yet, a Board of Mentors, has been crucial to my professional success right from the beginning of law school in Germany,” she shares. “Consulting with my mentors has been invaluable in making professional decisions or dealing with challenging situations at work, with clients, colleagues or substantive legal issues.”

Katja is deeply embedded in her professional community, serving as an active member of the International Association of Young Lawyers (AIJA). Through AIJA, she regularly connects with other lawyers across the globe through tailored programs and conferences to learn, grow and develop a strong referral network. Katja is a mentor with the Supreme Court of Ohio Lawyer-to-Lawyer Mentoring Program, co-chair of the International & Graduate Affairs Advisory Council for The Ohio State University Moritz College of Law and former co-chair of KnowledgeNet for the Ohio Chapter of International Association of Privacy Professionals (IAPP). She also serves on the Ohio State Bar Association’s Advisory Council on Diversity Initiatives (ACDI) Committee.

Best Lawyers named Katja to its Ones to Watch list for 2021-2022. She also is an affiliate member of the German Bar Association. Although not admitted to practice law in Germany, her knowledge of its language and law qualify her as a special member who can work with German lawyers representing clients in her practice area.

Katja received her law training and original degree from the Law School of the Universität Passau in Germany and her LL.M. in business law from The Ohio State University Michael E. Moritz College of Law.

BIS has issued an interim final rule, and entities dealing with cybersecurity exports are being asked to submit comments by early December. In this latest edition of our Privacy and Security Roundup, we share the details of the final rule’s two key measures including export restrictions and a new License Exception, provide an update on cyber incident reporting legislation, discuss modifications to the GLBA Safeguards Rule and much more.

RECENT DEVELOPMENTS

White-hat activities and potential impact of new cybersecurity export controls

The Commerce Department’s Bureau of Industry and Security (BIS) issued a long-awaited interim final rule on Oct. 21, 2021, imposing export controls on certain cybersecurity software, equipment and technology. Citing concern that these items could be misused to “abuse human rights or conduct other malicious cyber activities,” BIS stated its aim is to ensure “U.S. companies are not fueling authoritarian practices.” Broadly, the rule has two key components:

• restrictions on export, re-export or in-country transfers of certain cybersecurity-related items and tools that can be used for malicious activities; and
• a new License Exception, Authorized Cybersecurity Exports (ACE), allowing for exports of cybersecurity items to many destinations, under certain conditions, without a BIS export license.

It should be noted that the ACE License Exception is unavailable for exports to certain government and non-government end-users, with some exports to even allied countries like Cypress, Israel and Taiwan being restricted. That said, ACE does include carve-outs that permit exports of “software specifically designed and limited to providing basic updates and upgrades, vulnerability disclosure or cyber incident response” to governments of these and other allied governments.

BIS asserts these new export controls are narrow in scope and will have minimal impact. However, cybersecurity service and software providers, forensics firms, IT infrastructure manufacturers and those engaged in vulnerability testing, research, bug-bounty programs and other white-hat activities may take a different view. In practice, entities engaged in these activities could face significant implications if those activities potentially involve the export, re-export or transfer of cybersecurity items. BIS also recently signaled its intent to enforce cybersecurity export controls, evidenced by its addition of four cyber-surveillance firms to the U.S. Entity List (barring exports of U.S. origin items to such parties), alleging their involvement in developing, trafficking and using technologies for malicious activities threatening the cybersecurity of civil society, dissidents, government officials and organizations.

While the new rule does not take effect until Jan. 19, 2022, BIS is seeking comments and public input “to ensure full consideration of the potential impact,” including on the potential cost of compliance and the impact on legitimate cybersecurity activities. U.S. and non-U.S. entities dealing with cybersecurity items and investors in U.S. entities who are active with such technologies should assess the rule’s potential impact and consider submitting comments by Dec. 6.

Update: Federal mandatory breach notification legislation

As covered previously, Congress is eyeing several pieces of legislation that involve potentially mandatory cyber incident reporting, a requirement that could have broad implications for entities targeted for ransomware attacks and certain sectors like critical infrastructure. To date, each bill varies in scope and remains in the early stages of the legislative process. However, on Oct. 25, the Congressional Research Service released its “Comparison of selected cyber incident reporting bills.” The report provides a detailed side-by-side comparison of the bills summarized below.

• The Cyber Incident Reporting for Critical Infrastructure Act (H.R. 5440) would require reporting of qualifying incidents to the Cybersecurity and Infrastructure Security Agency (CISA) no more than 72 hours after discovery. At minimum, this would apply to cloud service providers, Managed Service Providers and critical infrastructure operators. Reporting entities would receive the liability and disclosure protections found in the Cybersecurity Act of 2015.
• The Cyber Incident Notification Act of 2021 (S. 2407) would involve providing CISA an initial report within 24 hours after confirmation of a security incident with updates within 72 hours of any new information. At minimum, reporting entities would include federal agencies, contractors, critical infrastructure operators and cybersecurity companies, but liability protection is somewhat unclear compared to H.R. 5400.
• The Cyber Incident Reporting Act of 2021 (S. 2875) would involve reporting to CISA within 72 hours of the discovery of an incident and mandatory reporting of ransomware payments within 24 hours of such payment. S. 2875 would apply to critical infrastructure owners and operators. Other mandatory reporting requirements could apply based on the consequences of an attack and the likelihood of targeting by malicious actors. Reporting entities would receive the liability and disclosure protections found in the Cybersecurity Act of 2015.
• Of the four leading mandatory reporting bills, The Ransom Disclosure Act (S. 2943) could have the furthest reach but is more limited in scope. The bill would require reporting to the Department of Homeland Security (DHS) no later than 48 hours after payment of a ransom by any public or private entity engaged in interstate commerce or that receives federal funds (including local governments). Unlike the three bills above, S. 2943 does not define liability protection.

Entities that may fall within the potential scope of mandatory reporting bills should carefully track their progress and applicability. While several specifics still need to be addressed, given recent headline-grabbing security incidents, there appears to be general bipartisan agreement on the need for federal action.

Changes to the GLBA Safeguards Rule

Citing recent widespread data breaches, cyberattacks and harm to consumers, on Oct. 27, 2021, the Federal Trade Commission (FTC) issued several updates to strengthen the Safeguards Rule. Mandated under the Gramm-Leach-Bliley Act (GLBA), the Safeguards Rule requires covered financial institutions to have measures in place to keep customer information secure and imposes an obligation to ensure affiliates and service providers safeguard customer information in their care. The updated rule contains five modifications that:

• provide covered entities with more guidance on the development and implementation of specific aspects of an overall information security program (e.g., in-transit and at-rest encryption, monitoring/periodic pen-testing and assessments, multi-factor authentication, development of a written incident response plan and requirements for vendor safeguards).
• improve the accountability of financial institution information security programs through a requirement to provide periodic reports to boards and governing bodies. Among other items, such reports must address the status of any recommend changes to an institution’s information security program and compliance with the rule. The update also requires the appointment of a single Qualified Individual that has ultimate responsibility for overseeing and managing a covered entity’s information security program.
• except financial institutions that collect information on fewer than 5,000 consumers from incident response plan, annual reporting and written risk assessment requirements.
• expand the definition of financial institutions, bringing finders — companies that bring together buyers and sellers of products or services — within the scope of the rule.
• define several terms and provide examples of the rule itself.

Overall, the second modification noted above is significant in that directors and leaders of financial institutions need to take a deliberate and non-passive role in data security issues and organizational efforts to address them. While directors certainly may not need to be involved in the finite details, they should understand the development and implementation of security efforts, maintain accountability and ensure protection of consumer information is an organization-wide endeavor.

ITEMS TO KNOW AND KEEP IN MIND GOING FORWARD

Who is Satoshi Nakamoto?

An ongoing trial in federal court in Miami, Fla., stemming from a federal lawsuit filed in February 2018 may finally determine who actually invented bitcoin, the first and most well-known cryptocurrency.

The lawsuit was filed by the estate of Dave Kleiman, an American computer forensic expert who passed away in 2013, against Craig Wright, an Australian computer scientist, who claims to be the creator of bitcoin. At issue in the case are 1.1 million bitcoins (currently worth approximately $67 billion) and intellectual property related to bitcoin software, which Wright allegedly transferred to himself.

Bitcoin, a decentralized, digital currency utilizing a public distributed ledger network referred to as a blockchain to verify and record transactions, was created in 2008 with the publishing of the white paper, “Bitcoin: A peer-to-peer electronic cash system” by Satoshi Nakamoto, the pseudonym of bitcoin’s creator. Hal Finney, a computer scientist who passed away in 2014, is recognized as having received the first bitcoin transaction from Satoshi and was an early contributor to its development. However, the identity of Satoshi has never been conclusively confirmed, although, in recent years, Wright has claimed to be Satoshi.

The estate of Kleiman seeks to show that Satoshi was, in fact, a partnership involving both Wright and Kleiman through various emails exchanged between the brother of Kleiman and Wright following Dave Kleiman’s death.

Along with demonstrating the importance of documenting business relationships, this case highlights the necessity of securely storing bitcoins obtained from mining or other means and providing a manner for transfer of ownership and access to one’s successors.

Update: The Ohio Personal Privacy Act

As covered in our August edition, Ohio may soon join California, Virginia and Colorado in passing a comprehensive privacy statute. Broadly, the Ohio Personal Privacy Act (OPPA) would provide Ohioans with legal rights to access, delete, correct and opt-out of the sale of their personal data — elements familiar to those found in other comprehensive privacy laws like the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). However, Ohio’s legislation takes a unique and perhaps more business-friendly approach by encouraging companies to adopt privacy standards set by the National Institute of Standards and Technology (NIST). In turn, the OPPA would provide for an affirmative defense where an entity can show compliance with NIST standards. Overall, this approach might better encourage businesses to adhere to best practices as they change over time while avoiding cumbersome regulations unresponsive to changes in technology.

The OPPA was drafted by CyberOhio, a committee launched by Gov. DeWine while he was attorney general and that is made up of members from academia, business and government. Notably, unlike similar legislation elsewhere, the OPPA has not received significant opposition from privacy groups. While the OPPA likely will be amended as it makes its way through the Ohio legislature, a private right of action seems unlikely given concerns over a wave of litigation seen after the enactment of privacy legislation in Illinois and California. The OPPA has the support of Ohio’s governor and lieutenant governor and, absent a private right of action, the OPPA would be a different approach to providing baseline protections while balancing legitimate business concerns related to litigation and potential liability.

Across the globe, concerns continue regarding cryptocurrencies and digital currency exchanges. In the October edition of our Privacy and Security Roundup, we dive into the latest details surrounding OFAC’s efforts to stifle ransomware attacks, how organizations should carefully assess the new Personal Information Protection Law in China, the new EU Standard Contractual Clauses requirement effective Sept. 27, and more.

RECENT DEVELOPMENTS

Increasing government pressure on cryptocurrencies and related businesses

The exchange infrastructure that enables use of cryptocurrencies for malicious purposes has come under increased scrutiny. As previously covered by Matt Lapin, on Sept. 21 the Department of Treasury, Office of Foreign Assets Control (OFAC), stepped up efforts to disrupt use of crypto exchanges that facilitate payments to ransomware actors by sanctioning SUEX, an exchange that enables the purchase and sale of virtual currencies. While over 40% of SUEX’s transaction history was likely associated with illicit actors, this move by OFAC represents an attempt to lower the frequency and profitability of ransomware attacks. At the same time, however, this also might increase the risk for companies and facilitators assessing how to respond to ransomware attacks. In effect, sanctioning exchanges used to facilitate ransomware payments means companies struggling to cope with a ransomware attack and the consultants hired to negotiate payments may both end up on the wrong side of the law.

Meanwhile, on Sept. 24, China’s central bank announced a widely publicized ban on all cryptocurrency transactions, including services provided by off-shore exchanges. This ban follows several other measures by Chinese authorities, including bans on initial coin offerings, bank handling of Bitcoin and certain crypto mining activities. Like other countries, including the U.S., China has confronted concerns that highly volatile digital currencies could undercut or destabilize financial and monetary systems, introduce systemic risk, and promote financially motivated crimes. Notably, while the impact on the official state-backed digital currency e-CNY appears unclear, this development highlights the regulatory risks and uncertainties faced by cryptocurrency-related businesses.

China’s sweeping new Personal Information Protection Law

In the past few years, the legislative and regulatory landscape regarding privacy and data security has changed significantly in China, and businesses with China-facing operations should continue to evaluate their compliance, especially given recent news. On Sept. 1, China’s Data Security Law went into effect, which primarily applies to businesses that conduct data processing in China. Most recently, the Standing Committee of China’s National People’s Congress enacted the Personal Information Protection Law (PIPL), which will take effect on Nov. 1, 2021. An unofficial translation is available here. Although the PIPL shares several similarities with the General Data Protection Regulation (GDPR), including with respect to personal information rights, there are significant substantive differences. Also, despite the looming effective date, commentators have highlighted major areas of uncertainty or ambiguity within the law and suggest the PIPL may create a surge in demand for compliance-related products and services. While several key features are summarized below, organizations should carefully assess the PIPL’s applicability and requirements.

• Extraterritorial application and requirements: The PIPL applies within China and generally applies to the collection or processing of personal information on natural persons by entities outside of China that (1) provide products or services to individuals in China or (2) analyze or assess behavior of individuals in China. While anonymized information is not considered personal information under the PIPL, “personal information” is broadly defined to include “various types of electronic or otherwise recorded information relating to identified or identifiable natural person.” “Processing” is also broadly defined to include “collection, storage, use, refining, transmission, provision, public disclosure or deletion of personal information.” Additionally, offshore personal information processing entities (PIPEs)—akin to a data controller under the GDPR—will need to establish a dedicated office or appoint a dedicated representative within China to be responsible for personal information issues.
• Basis for processing: Like the GDPR, under the PIPL, organizations must have a lawful basis to process personal information. Broadly, notice and consent appears to be the primary legal basis on which companies can rely for processing. That said, organizations should also be aware that the PIPL definition of consent is broadly in line with the strict GDPR requirements for consent. There are several exceptions to the notice and consent requirement, including where processing is necessary to enter or perform a contract to which an individual is a party or in the context of human resources management. However, the PIPL still requires a separate consent if processing involves: (i) sharing of personal information with other processing entities; (ii) public disclosure of personal information; (iii) sensitive personal informational; or (iv) transfer of personal information outside of China.
• Cross border transfers: As noted above, to transfer personal information outside of China, PIPEs must obtain consent as well as provide individuals with certain information about the transfers and adopt measures to ensure the same level of protection by recipients overseas. Importantly, entities must also carry out a Personal Information Protection Impact Assessment. Additionally, where Critical Information Infrastructure (CII) operators are involved, including entities who process a certain volume of personal information exceeding an amount to be determined by Chinese authorities, those entities must (1) locally store personal information collected and generated in China and (2) pass a security assessment by the Cyberspace Administration of China.
• Personal Information Protection Impact Assessments: As indicated above, transfers of personal information overseas trigger an assessment requirement. However, PIPEs must also conduct assessments where processing involves automated decision-making and processing of sensitive information. Further, PIPEs are required to maintain processing records for at least three years.
• Penalties and enforcement: The PIPL provides for certain private rights of action for violation of personal information rights (e.g., rejecting individual requests for access, correction, deletion, etc.). From an enforcement standpoint, regulators have broad discretion and may impose corrective actions, issue warrants, confiscate income and impose fines, suspend services, or even record violations in the credit files of the PIPE under the national social credit system. Like the GDPR, top-end penalties are potentially steep, including up to 5% of annual revenue for more serious violations (although whether this includes revenue generated in China or globally is unclear).

ITEMS TO KNOW AND KEEP IN MIND GOING FORWARD

In with the new: New EU SCCs required as of Sept. 27

As previously covered by Katja Garvey, entities that use EU Standard Contractual Clauses (SCCs) for transfers of personal information from the European Economic Area (EAA) had until Sept. 27 to start using the new SCCs for new agreements involving the transfer of personal information. Significantly, however, organizations can continue to rely on the previous iteration of SCCs in existing agreements until Dec. 27, 2021. That said, whether relying on the old or new SCCs, organizations also need to be aware of the requirement to conduct Transfer Impact Assessments (TIAs) on accounts of the Schrems II decision (with the old SCCs) and as an explicit contractual requirement under the new SCCs. Broadly, TIAs should consider the sufficiency of foreign (non-EEA) protections on a case-by-case basis. For the new SCCs, among other considerations applicable to TIAs, parties are expressly required to warrant “they have no reason to believe that the laws and practices in the third country of destination applicable to the processing of the personal data by the data importer, including any requirements to disclose personal data or measures authorising access by public authorities, prevent the data importer from fulfilling its obligations under these Clauses.” Further, the new SCCs require TIAs to be documented and available to the competent supervisory authority upon request.

Taking a step back, organizations with a large number of agreements relying on SCCs should already be cognizant of the potentially heavy lift of managing the TIA requirements and the transition to the new and more exacting SCCs by the deadline next year. This might also be an opportunity to double-check that service providers/sub-processors also meet GDPR requirements. Finally, as covered in last month’s edition, while transfers from the U.K. still fall under the old SCCs modified for U.K. data protection laws, organizations should keep an eye out for changes that may result in better EEA/U.K. alignment with respect to transfers out of the U.K. and EEA.

A new CFPB director and expectations for increased enforcement

After months of uncertainty, on Sept. 30, the Senate confirmed a current FTC Commissioner, Rohit Chopra, as the new Director of the Consumer Financial Protection Bureau (CFPB). The party-line confirmation vote reflects division over both Director Chopra’s nomination and the ultimate role of the CFPB tasked with consumer protection in the financial sector in the aftermath of 2007 and 2008. Interestingly, Chopra’s confirmation also means the FTC will once again be split along party lines. Supporters view Director Chopra as an experienced regulator who has advocated for action against significant market participants. However, given Director Chopra’s prior involvement with the CFPB and actions as an FTC Commissioner, detractors would argue that Director Chopra will pursue an anti-business agenda, seeking to further expensive regulation. Under the prior administration, the CFPB generally pursued few actions against major financial institutions, and the number of enforcement actions and consumer recoveries decreased. The CFPB under Director Chopra is expected to be more active in deploying supervisory, rulemaking and enforcement authorities, particularly with respect to unfair, deceptive or abusive acts and practices (UDAAP). Further, among other priorities, Director Chopra has outlined an interest in examining data-collection and privacy practices at major lenders. Given the expectations for increased CFPB activity, organizations subject to CFPB oversight will likely want to review their compliance management systems and closely follow the work of the CFPB’s new leadership.

A new data privacy and security focused bureau: A step towards broader data privacy and security authority for the FTC?

At a time when businesses of all sizes are grappling with how to address an increasingly complex patchwork of state privacy requirements, a new proposal has garnered attention that would appropriate $1 billion towards the establishment of a privacy bureau at the Federal Trade Commission (FTC). This follows headline cyber security incidents, greater public awareness of privacy concerns and a new batch of privacy and security-related Congressional proposals that involve mandatory breach notification requirements. As part of a $3.5 trillion spending bill that faces an uncertain future, the new bureau would be tasked with “accomplishing the work of the [FTC] related to unfair or deceptive acts or practices relating to privacy, data security, identity theft, data abuses and related matters.” The FTC is currently split into three bureaus, with the Bureau of Consumer Protection addressing data privacy and security-related actions against unfair or deceptive acts or practices under Section 5 of the FTC Act. While the measure’s future is currently uncertain, this proposal reflects a broader focus at the federal level on boosting federal privacy oversight via existing regulatory infrastructure, if not through legislation.

On Sept. 21, 2021, the Department of Treasury, Office of Foreign Assets Control (OFAC), updated its published guidance regarding sanctions risks associated with making ransomware payments and its official policy on such payments. This updated guidance, taken in conjunction with OFAC’s recent sanctions designation of a cryptocurrency payment exchange frequently used for ransomware payments, and other ongoing regulatory legislative efforts to address ransomware attacks, further highlights the whole of government effort by the United States to discourage ransomware attacks and address the compliance responsibilities this effort continues to impose upon the business community.

Background on ransomware payments and sanctions

In October 2020, in the wake of a spike of ransomware attacks, OFAC issued guidance regarding sanctions risk associated with making ransomware payments. This guidance emphasized that 1) facilitating a ransomware payment that is demanded as a result of malicious cyber activities may enable parties with a sanctions nexus to profit and advance their illicit aims and 2) as a result, there is a risk that a ransomware payment may involve a specially designated national (SDN) or blocked person, blocked account (including cryptocurrency wallets) or a comprehensively embargoed jurisdiction (e.g. Cuba, Iran, N. Korea).

This guidance also highlighted potential reporting requirements with the Financial Crimes Enforcement Network (FinCEN) as well as other expected risk mitigation measures, including coordination with federal law enforcement and, where required, disclosure to OFAC.

Updated guidance

The updated 2021 guidance retains directives of the 2020 guidance, including coordination with law enforcement. It also retains OFAC’s policy of denial with respect to granting licenses to authorize transactions related to ransomware payments involving sanctioned parties.

The updated guidance indicates that OFAC’s enforcement posture with respect to businesses that are considering ransomware payments will be impacted by adherence to the September 2020 Cybersecurity and Infrastructure Security Agency (CISA) ransomware guidance.

The updated guidance emphasizes the risk of facilitating or processing payments, specifically noting that OFAC has listed SUEX, a company that allows customers to convert digital currency into cash or other forms of assets, as an SDN. In this designation, OFAC stated that companies operating or facilitating digital currency platforms such as SUEX “are critical to the profitability of ransomware attacks, which help fund additional cybercriminal activity.”

Coordination with U.S. government cyberstrategy and legislative efforts

In line with the whole of government approach, this updated OFAC guidance coincides with regulatory and legislative efforts at the federal level to enhance cybersecurity. For example:

• As previously covered in our September Privacy and Security Roundup, the U.S. Securities and Exchange Commission has sanctioned investment advisors and broker-dealers over failures to protect confidential information.
• As briefly covered in our September Privacy and Security Roundup, bipartisan legislation currently before Congress would introduce mandatory reporting requirements for federal agencies, contractors, and critical infrastructure owners and operations in the event of cyber intrusions within 24 hours of discovery.
• On the specific topic of ransomware, Congress is eyeing a similar bipartisan piece of legislation, the Sanction and Stop Ransomware Act. In addition to mandatory owner/operator reporting requirements in the event of ransomware attacks on critical infrastructure, the act would require: (1) the development of cybersecurity standards for critical infrastructure entities; (2) development of cryptocurrency exchange regulations to reduce anonymity in ransomware situations; and (3) the imposition of sanctions/penalties on states designated as “state sponsors of ransomware.”
• The United States Innovation and Competition Act would invest roughly $200 billion into U.S. scientific and technological innovation over the next five years and includes several national security-oriented measures aimed at limiting the exposure of U.S. supply chains to foreign influence and protection of U.S. intellectual property, with particular focus on threats from China, including improvements in cybersecurity infrastructure.

Conclusions on new ransomware payments guidance

The recent OFAC update and ongoing regulatory and legislative efforts noted above should clearly indicate to the business community that the U.S. government expects companies to exercise diligence and due care when seeking to prevent, mitigate or make payments related to ransomware attacks.

The continued emphasis on sanctions in both regulatory actions and legislation indicates that OFAC will remain a key player in addressing the actors responsible for malicious cyber-activities and companies should evaluate their cyber-response policies to ensure that they are appropriately calibrated to comply with OFAC, as well as FinCen, CISA and other regulatory and law enforcement expectations regarding addressing cyberattacks and ransomware.

Not only are public and private companies increasingly targeted for cyber-attacks, but local and state governments across the country are as well. In our latest Privacy and Security Roundup, we cover the Senate-passed bill that includes nearly $2 billion in national cybersecurity funding, recent sanctions by the SEC on investment advisors and broker-dealers, a new initiative that aims to improve defense planning and information sharing between the public and private sectors, and more.

RECENT DEVELOPMENTS

An opportunity to improve national cybersecurity at state and local levels

Following weeks of stalemate and negotiation, the Senate passed its version of the Infrastructure Investment and Jobs Act (H.R. 3684) that includes hundreds of billions of dollars in new spending on traditional infrastructure like the transportation system, airports, the electrical grid, and broadband. Not surprisingly, however, amid growing threats to critical infrastructure, the bill also aims at shoring up national cybersecurity.

As passed by the Senate, the measure includes more than $1.9 billion in cybersecurity funding. Among other uses, the bill would allocate funds to improve the cybersecurity of state and local governments — entities that malicious actors have targeted with increased frequency. Specifically, the bill would create a specialized grant program under the Department of Homeland Security (DHS) to provide funds to state and local governments over four years, with 25% of the funds going to particularly vulnerable rural government entities. The bill also would allocate funds to various federal agencies and entities tasked with cybersecurity, including the Department of Energy (DOE) to provide enhanced grid and energy cybersecurity, and the DHS’s Cybersecurity and Infrastructure Security Agency (CISA).

While bipartisan support for national cybersecurity initiatives found in the legislation helped the bill pass the Senate, this massive legislation faces a somewhat uncertain future in the House. That said, if passed, the legislation could be a big win for state and local governments as well as utilities and energy providers dealing with cybersecurity risks.

SEC sanctions investment advisors and broker-dealers over email hacks

On Aug. 30, 2021, the Securities and Exchange Commission (SEC) sanctioned eight firms in three actions for failures related to cybersecurity policies and procedures. The failures resulted in the exploitation of vulnerable email accounts and exposed the personal information of thousands of customers and clients. The SEC sanctions included both cease-and-desist orders and financial penalties against investment advisors and broker-dealers for violation of the Safeguards Rule. Broadly, the Safeguards Rule requires every registered broker-dealer and investment advisor to adopt policies/procedures reasonably designed to:

• insure security and confidentiality of customer information;
• protect against anticipated threats or hazards to the security or the integrity of customer records or information; and
• protect against unauthorized access to or use of customer information or records that could result in harm to any customer.

As noted in an SEC statement on the matter, these actions make clear that simply having a policy requiring enhanced security is not enough if those requirements are not implemented, especially in the face of known attacks. In other words, for SEC registered broker-dealers and investment advisors, the ROI for following national cybersecurity best practices includes avoiding run-ins with regulators.

ITEMS TO KNOW AND KEEP IN MIND GOING FORWARD

A new public and private effort to combat cyber threats

CISA unveiled its Joint Cyber Defense Collaborative at a BlackHat 2021 keynote event in August. This initiative, which aims to improve defense planning and information sharing between the public and private sectors, comes on the heels of several high-profile ransomware, supply chain and other attacks (e.g., Solar Winds, Colonial Pipeline, Kaseya, etc.). Not surprisingly, initial efforts under the collaborative will focus on ransomware and developing a planning framework to coordinate incidents affecting cloud service providers.

Participants in the Joint Cyber Defense Collaborative include several well-known cybersecurity companies and telecommunications vendors. Generally, following almost every high-profile cybersecurity incident, commentators highlight the degree of information sharing (or lack thereof) between the private and public sectors. Consequently, as pointed out by CISA’s director, this initiative can be seen as a response to the need to improve information sharing between government and companies in an effort to identify and combat threats “such as what happened with SolarWinds.” That said, while some may view a voluntary public and private effort at collaboration to be a step in the right direction, Congress is eyeing legislation that might make collaboration mandatory in the form of CISA reporting requirements for critical infrastructure operations that suffer cyber incidents.

UK data transfers: New developments and alignment with the EU

In the wake of Brexit, the UK’s data protection regulator, the Information Commissioner’s Office (ICO), launched a public consultation on data transfers. In short, despite the significant overlap between the EU and UK’s General Data Protection Regulation (GDPR) variants, changes are necessary to account for UK law, making the consolation relevant to any entity that transfers personal data from the UK or provides services in the UK. Broadly, commentators have also noted that the UK may seek to more definitively chart its own course on privacy, a move which could have adequacy implications with respect to the EU. That said, the consolation asks for input on several items, including:

• Use of SCCs: At present, the EU’s Standard Contractual Clauses (SCCs) cannot be used for transfers from the UK, leading organizations to prepare new vendor, customer or intra-group alternatives for the EU and UK, a costly and time-consuming prospect. However, the ICO is considering issuing an international data transfer agreement in the form of a UK addendum to data transfer agreements that could be used for the EU SCCs. The UK addendum would modify those parts of the SCCs that refer to EU member state law/institutions. The addendum would be compact, flexible and able to be modified if appropriate safeguards are maintained. That said, the challenge will likely be in the fine print. Organizations transferring data from the UK should remember that the EU’s new SCCs will only be permitted if amended, and the old SCCs do not account for Schremes II. Moreover, because the ICO is unlikely to approve and issue an addendum until very late this year or in 2022, organizations will, in effect, need two different data transfer agreements for the EU and UK. However, they may later be able to utilize the SCCs with the UK addendum for UK transfers.
• UK Specific Data Transfer Agreement (IDTA): The ICO has asked for feedback on its draft IDTA. Unlike the modular structure of the SCCs, the IDTA is a one-size-fits-all agreement, meaning there is no need for the parties to cut and paste text to create an agreement appropriate to their situation. Additionally, while certain mandatory clauses cannot be changed, parties are free to edit and delete sections irrelevant to them. The draft IDTA also allows parties to cross-reference items like master service or data processing agreements. While still early, one issue will likely be the mandated annual transfer risk assessment, a requirement that might be excessive for low-risk data transfers.
• Transfer Risk Assessment (TRA): Designed for use alongside the IDTA, the ICO is seeking input on its draft TRA. Unlike the EU’s approach, the TRA leaves room for legitimate laws regulating surveillance. Additionally, the TRA offers accessible scenarios and better clarity on low, medium or high-risk transfers. Finally, the TRA takes a more holistic approach to assessing risk. When it comes to enforcement actions involving a TRA, the ICO will take into account situations where an organization can show best efforts to complete the TRA, but whose analysis is incorrect. However, in its current form, the TRA is lengthy and somewhat cumbersome for smaller enterprises.

Questions on the efficacy of the CCPA

The California Consumer Privacy Protection Act (CCPA) is one well-known and high-profile example of comprehensive privacy legislation. As initially enacted, the landmark legislation aimed, in part, to force entities that collect personal information to account for how that information is used and disclosed. Additionally, the CCPA’s regulations also require certain companies to report consumer request metrics annually. Yet, with the numbers now public, exactly how many California consumers have exercised their rights under the CCPA, and how the most prominent players are specifically complying, is challenging to ascertain. CCPA supporters hoped that disclosures would show voters what they were getting and help track enforcement of the law. However, based on disclosures, the number of consumer requests made under the CCPA varied significantly from company to company. Moreover, in terms of enforcement, the California Department of Justice has not maintained a complete list of firms that must comply with the CCPA’s requirements.

Arguably, an explanation for the broad inconsistencies in the exercise of individual rights under the CCPA and a lack of clarity on enforcement might be found in the different compliance approaches of individual companies. For example, while some companies prominently display CCPA related links and notices, others are buried and hard to find. Similarly, companies may use different metrics to track compliance (e.g., nationwide versus California-specific metrics). Functionally, this makes tracking compliance difficult. Moreover, it highlights that companies have drawn different conclusions regarding their responsibilities under the CCPA. For example, companies that allow people to opt-out of sales of information seem to report a higher volume of those requests than any other. Alternatively, companies can take the position that they don’t sell personal data to third parties and, therefore, the CCPA’s right to opt-out of sales doesn’t apply.

Yet, despite company views to the contrary, privacy advocates might argue that the CCPA applies to certain commonly-used tools, such as third-party cookies that track users across sites for marketing purposes. Privacy may now be in the public consciousness and something companies are more likely to take seriously. Nevertheless, with the California Privacy Rights Act effective in 2023 (bringing greater enforcement and prohibitions), the most recent metrics highlight major questions on efficacy and enforcement that may need to be addressed going forward.