On July 13, 2018, over 50 civil liberties groups, technology companies and associations submitted a joint letter to Congress in support of the Email Privacy Act (EPA), which was recently included in the House- passed version of the National Defense Authorization Act (NDAA) for Fiscal Year 2019. The list of signatories included such tech giants as Google, Facebook, Amazon, Dropbox, Cisco Systems and Adobe. The EPA, if passed, would amend the Electronics Communications Privacy Act (ECPA) by requiring law enforcement and other government agencies to obtain a search warrant, based upon a showing of probable cause, before seizing emails, texts, and other information stored in the cloud. The EPA has been proposed, yet failed to pass, in prior legislative sessions, but proponents of the bill are hopeful that the time is right for these privacy protections to be put into place.
In an alert sent to banks on August 10th, the FBI warned banks that it had “obtained unspecified reporting indicating cyber criminals are planning to conduct a global Automated Teller Machine (ATM) cash-out scheme in the coming days, likely associated with an unknown card issuer breach and commonly referred to as an ‘unlimited operation’.”
Most companies perform background checks on employees at the outset as part of the application / new hire process. A number of background check companies are now offering “continuous screening” or re-screening services as a risk management tool where background checks are performed on all employees annually or semi-annually. Continuous background checks are gaining popularity among employers. In theory, this will catch items that were missed during the new hire process as well as criminal events that have transpired since the employee was hired. This is viewed as a risk management tool to protect against employee theft, embezzlement, fraud, violence, etc.
On May 29, 2018, Governor Hickenlooper signed HB—1128 into law. Importantly, the Bill amends the State’s data breach notification law to require that affected Colorado residents be notified within 30 days of a data breach, and specifies the information that must be included in the data breach notice. The new law, which takes effect September 1, 2018, applies to “covered entities,” (if your business maintains, owns, or licenses information of Colorado residents, regardless of where the business or data is based, it is a “covered entity”), also sets forth certain data security requirements, and adds requirements regarding the disposal of personal identifying information.
The California Senate narrowly passed a bill earlier this week that would allow businesses to be sued for data breaches without proof of any injury. As this bill moves to the Assembly, there is already talk among legislators about amending it to include a safe harbor provision. But will any safe harbor address opponents’ concerns?
After much anticipation, the General Data Protection Regulation (GDPR) finally went into effect on May 25, 2018. For employers, that means some enhanced employee rights, and the risk of significant penalties for non-compliance. This includes potential maximum fines of up to 4 percent of global annual revenue or 20 million euros, whichever is greater.
SB 1121, which is making its way through the California Legislature, would allow businesses to be sued for data breaches even when no one was actually injured. This includes being sued for failing to implement and maintain reasonable security procedures as well as for failing to properly notify affected individuals of a breach of their personal information. Opponents of this bill are calling it a “job killer”.
On April 24, 2018, the Securities Exchange Commission (SEC) announced a $35 million fine against the company formerly known as Yahoo! Inc. (now known as Altaba, Inc.) for failing to disclose a massive cyber data breach to its investors for nearly two years. This is the first time the SEC has punished a company for such conduct.
The average internet user may be largely unaware that there are actually different “levels” of the internet. First, there is the surface level of the internet where companies post their webpages, and where employees may browse the news, shopping options, and Facebook. The surface level means that the internet is indexed, and can be accessed using a search engine such as Google. There is also the Deep Web, which means that the web pages cannot be accessed by a search engine because they are not indexed. In other words, you would not be able to search for or stumble upon these websites. Instead, you’d only be able to access them if you knew their exact web address. What may surprise people is that most of the internet today is actually considered part of the Deep Web. Next, there is the Dark Web, whose very name sounds a bit ominous. The Dark Web is a part of the Deep Web, but it also requires special browsers, such as TOR, and configurations in order to access it. The primary goal of the Dark Web is to maintain privacy and anonymity. While some may use this area for perfectly legitimate purposes, such as a journalist speaking to a source in private, not surprisingly, this setting can also be exploited for illegal purposes, such as drug and human trafficking and child pornography.