Does your company collect biometric information? Are you not entirely sure what “biometric information” means? Would you like to understand the differences between the different state biometric privacy laws? Do you want to know why more than 50 companies were hit with class action lawsuits within a period of three months as a result of
Al Saikali
New Wave of Biometric Privacy Class Actions: Could You Be A Target?
By Al Saikali on
While the privacy world is focused on the Equifax data breach, another development is taking place that could have a more lasting effect on privacy law. In the last month, plaintiffs’ lawyers in Illinois have filed over 20 lawsuits against companies that authenticate their employees or customers with their fingerprints. The lawsuits are based on…
Court Applies Work Product Protection to Breach Investigation Reports
By Al Saikali on
One of the most significant questions in data security law is whether reports created by forensic firms investigating data breaches at the direction of counsel are protected from discovery in civil class action lawsuits. They are, at least according to an order issued last week in In re Experian Data Breach Litigation. 15-01592 (C.D.…
Incident Response: The Increasing Risks to Corporate Legal Departments
By Al Saikali on
The consequences of a data breach reached new heights last week when Yahoo announced the resignation of its General Counsel in response to a series of security incidents the company suffered. A more fulsome explanation of the security incidents and Yahoo’s response can be found in item seven of the company’s 10-K, but here…
Law Firm Data Security: The First Class Action
By Al Saikali on
Earlier this year, Bloomberg Law reported that Edelson PC, a leading plaintiffs’ firm in privacy and data security law, filed a class action lawsuit against a regional law firm that had vulnerabilities in its information security systems. This week, the identity of the firm and the allegations of the lawsuit were unsealed. The case,…
The SEC Makes Clear There is No Room For Error in Cybersecurity
By Al Saikali on
The SEC recently agreed to a $1,000,000 settlement of an enforcement action against Morgan Stanley for its failure to have sufficient data security policies and procedures to protect customer data. The settlement was significant for its amount. The true noteworthiness here, however, lies not in the end result but the implications of how it was…
Understanding EMV Payment Card Technology
By Al Saikali on
Posted in Data Security, Payment Cards
A significant change is happening to payment card technology. Any company that accepts credit cards as a form of payment needs to know about it if they intend to continue accepting payment cards in the future. The technology is called “EMV” (EuroPay, MasterCard, Visa). The card brands hope that EMV technology will significantly reduce the…
FDA Issues Draft Guidance on Postmarket Cybersecurity Programs for Medical Devices
By Al Saikali & Tim Moore on
In 2014, the Food and Drug Administration (“FDA”) articulated its expectations for how device manufacturers address cybersecurity premarket in Content of Premarket Submissions for Management of Cybersecurity in Medical Devices. Recently, the FDA released complementary draft guidance in Postmarket Management of Cybersecurity in Medical Devices. In the new guidance, the FDA explains what…
60 Minutes Reports on Payment Card Data Breaches
By Al Saikali on
Ever wonder how your credit card gets compromised and how the bad guys get your information? This report on tonight’s episode of 60 Minutes provides an overview of what happens from the moment you swipe your card at the point-of-sale terminal to the moment when the card number is compromised and sold on a black…
Why Every Business Should Care About Florida’s Information Protection Act
By Al Saikali on
My last post described what the recently passed Florida Information Protection Act (FIPA) will do. This post analyzes how FIPA differs from Florida’s existing breach notification law and explains why those differences will hurt or help companies that maintain information about Florida residents. Florida’s Governor must still sign the FIPA into law, but his signature…