Hilary Wandall

“Negligent” #Cybersecurity?: That Doesn’t Quite Cut It John Tozzi reports on #SenatorWyden’s referral to the #FTC and the #SEC to investigate #UnitedHealthGroup’s massive cybersecurity failures. In one sense, this announcement is much ado about nothing, as #DOJ had previously announced it had opened an investigation, and it is virtually certain that, long before Senator Wyden took this step, both FTC and SEC had opened a file. It would be act of governmental malpractice for them not to have done so. Wyden, in what strikes me as an uncharacteristically gentle assessment of a corporate giant, calls #UHG’s utterly deficient systems and safeguards “negligent”. I think UHG blew past “negligent”, blew past “gross negligence”, and made it all the way to “reckless” and “willfully blind”. Every business school in America is going to do a case on this #fiasco. #privacy #security #databreaches #hacks #ChangeHealth #Optum #managedcare #UnitedHealth

8

2 Comments

The IAPP - International Association of Privacy Professionals launched its Organizational Digital Governance Report (https://lnkd.in/eNBbD7is) today and it really hits hard on how the role of the traditional “privacy officer” has evolved over the years, from regulatory proliferation to the growing digital responsibilities being vested into C-suite leaders. Privacy officials are finding new areas of responsibility being tacked onto their title every day, partially out of necessity but also because the privacy officer/counsel often times is best positioned to tackle emerging data-related responsibilities at a company—as page 22 in the report illustrates. While the report focuses on the private sector, US federal, state, and local government privacy officials should take heed and observe closely to this as a potential bellwether for how government privacy officers may be finding the needs of their role and agency rapidly changing—if it hasn’t already. Even here at the Cybersecurity and Infrastructure Security Agency, the office that houses the privacy officer has expanded well beyond its original privacy oversight and compliance mandate—evolving into the Office of Privacy, Access, Civil Liberties, and Transparency. Thanks to the great tutelage of former and current career DHS oversight leaders like Jamie Danker Jonathan Cantor and Peter M., CISA’s office was prepared to evolve and take on the expanded scope. It’s probably not the greatest model to replicate as it was purpose built just for CISA, but from executive orders like the AI EO to data collections becoming more expansive and complicated to quantum computing destroying modern concepts of data protection—privacy offices and officers will need to evolve to meet public and agency expectations. WSJ has good coverage of the report (https://lnkd.in/ed33J-jb) if you need a shorter read, but I would definitely encourage you to read the entire report.

31

1 Comment

The U.S. Federal Trade Commission has made the privacy and security of sensitive consumer health information a top priority. It has recently announced rules it intends to enforce in this space, demonstrated its intentions in cases against BetterHelp and GoodRx, and issued a report summarizing its recent privacy and data security enforcement efforts and other initiatives. Most recently, the FTC announced two new enforcement actions: One against Monument, an online addiction treatment firm, and another against Cerebral, an online telehealth provider. In “Sense and Sensitivity: Latest FTC Enforcement Actions Continue Focus on Sensitive Health Data,” Alex Pearce of Wyrick Robbins (Raleigh, North Carolina, USA) offers lessons from these cases for companies that handle consumer health information. 🔗 Read the full article: https://lnkd.in/g8mvN5zz The article first appeared in the newsletter of Meritas’ Healthcare and Life Sciences group, a forum for Meritas members to share and exchange information, advance the field of health law, and build relationships to enhance seamless cross-border legal service for healthcare clients around the globe. If you have any issues or legal needs related to the Healthcare and Life Sciences sector, contact Kim Gendron to be connected with a Meritas lawyer who can help. #MeritasUSA #WeAreMeritas #HealthLaw #IndependentButUnited

12

1 Comment

A great review of the latest state privacy law - Minnesota - and the question mark surrounding what could be the 20th state privacy & data protection law.

2

Protecting our youth online has never been more critical. 📱 In a recent Forbes article, Nizan Geslevich Packin highlights the urgent need for stronger protections in the U.S. that can safeguard young minds from the risks of social media. From New York City’s proposed cellphone ban in schools to Minnesota’s groundbreaking legislation on social media transparency, there's clear progress to protect children online. 🌟   Read more about the different approaches developing on this crucial topic here: https://lnkd.in/gqF6uNHG   #DigitalSafety #YouthProtection #TechPolicy #SocialMedia

30

1 Comment

🏛 Vermont just passed a comprehensive privacy law that, in part, draws inspiration from the American Privacy Rights Act/American Data Privacy and Protection Act. This is a complex bill that includes a novel private right of action, substantive data minimization rules, and unique scoping provisions. If enacted, the Vermont Data Privacy Act could be the farthest-reaching comprehensive privacy law to date. Read my analysis here: https://lnkd.in/dHn7GvjK

67

Angela Preston and I answered the top-trending questions about how to help ensure #compliance in the #AdverseAction process during a recent webinar. Get a full recap of the webinar in this blog: https://lnkd.in/gvdYRp4c #HRCompliance

15

Unveiling the American Privacy Rights Act (APRA) CheatSheet:   Explore this cheat sheet summarising the key points of APRA. This significant measure was announced on April 7, 2024, by House Committee Chair Cathy McMorris Rodgers and Senate Committee Chair Maria Cantwell, which aims to set national standards for consumer data privacy and security.    Source: https://lnkd.in/dPKVsB2h #dataprivacy #US #Americanprivacylaw #cheatsheet #APRA

61