As we have previously detailed here, the latest generation of regulations under the California Consumer Privacy Act (CCPA), drafted by the California Privacy Protection Agency (CPPA), have advanced beyond public comments are closer to becoming final. These include regulations on automated decision-making technology (ADMT), data processing evaluation and risk assessment requirements and cybersecurity audits.
Keypoint: Last week, consumer data privacy amendment bills crossed chambers in Montana and Kentucky, a social media bill crossed chambers in Colorado, and there were movements with numerous other bills.
Below is the eighth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and
On February 13, 2025, a federal court issued a highly anticipated ruling in Estate of Gene B. Lokken v. UnitedHealth Group (CASE 0:23-cv-03514-JRT-SGE)—denying UnitedHealthcare’s attempt to dismiss certain state law claims and allowing breach of contract and good faith claims to move forward. It’s a major development in a case I first discussed
On the heels of the formation of the House Privacy Working Group, Congressman Brett Guthrie (KY-02), Chairman of the House Committee on Energy and Commerce, and Congressman John Joyce, M.D. (PA-13), Vice Chairman of the House Committee on Energy and Commerce, issued a Request for Information (RFI) regarding a Federal Privacy Law.
“The challenge of
In this week’s installment of our blog series on the U.S. Department of Health and Human Services’ (HHS) HIPAA Security Rule updates in its January 6 Notice of Proposed Rulemaking (NPRM), we are exploring the justifications for the proposed updates to the Security Rule. Last week’s post on the updates related to Vulnerability Management, Incident
@media screen and (max-width: 1023px){section[data-id=”block_2f9c81ba9de5edfb057a9ab00f6083c9″]{ }}@media screen and (min-width: 1024px) and (max-width: 1365px){section[data-id=”block_2f9c81ba9de5edfb057a9ab00f6083c9″]{ }}@media screen and (min-width: 1366px){section[data-id=”block_2f9c81ba9de5edfb057a9ab00f6083c9″]{ }}
The Trump Administration’s recent AI pronouncements decry “ideological bias or engineered social agendas” as antithetical to continued American AI leadership. Executive Order 14179, repealing prior Biden Administration Executive Order 14110 on AI safety, reflects that theme and so does Vice President Vance’s speech at the February 11 Paris AI summit. “We feel very
The Google Threat Intelligence Group revealed a chilling reality: nation-states are weaponizing AI tools like Gemini for sophisticated cyberattacks. This new frontier of AI-powered fraud demands immediate attention from business leaders and general counsel, who stand at the confluence of technology, data security, and governance.
Recent Incidents and the Evolving Sophistication of These Attacks
Generative
After what seems like forever, the most recent (and last?) public comment period for the draft California Consumer Privacy Act (CCPA) regulations finally closed on February 19, 2025. (Read Privacy World coverage here and here.)
Following an initial public comment period on an earlier draft, the formal comment period for the current version of
The Oregon AG’s Office, along with the state’s Department of Justice, issued guidance late last year on how state laws apply to the ways businesses use AI. The guidance may be two months old, but the cautions are still timely. The guidance seeks to give companies direction on times when AI uses might be regulated