Virginia Passes Comprehensive Data Privacy Law

in ,

By Charlotte Lunday

On March 2, 2021, Virginia Governor Ralph Northam signed the Virginia Consumer Data Protection Act (VCDPA) into law. The VCDPA, which takes effect January 1, 2023, will look familiar to those who work with the GDPR and California’s Consumer Privacy Act and Privacy Rights Act (CCPA and CPRA, respectively). Companies that have already invested in GDPR and CCPA/CPRA compliance will find that most VCDPA obligations are similar to what they have already addressed in some form for Europe and California.  But the new Virginia law also contains some novel provisions, such as excluding a broad range of “publicly available information” from the definition of personal data, contractual requirements for sharing de-identified data, and establishing an appeals process for data rights requests. 

Read More

California Privacy Rights Act (CPRA) Passed by California Voters

in ,

By Mike Hintze

On November 3, California voters passed Proposition 24, the California Privacy Rights Act (CPRA). This new privacy law, which substantially amends the California Consumer Privacy Act (CCPA), will come into effect on January 1, 2023, and enforcement will begin July 1, 2023. CPRA is, at best, a mixed bag. The fact that it was opposed by a wide range of critics, from privacy advocates, to academics, to industry coalitions is telling. It is long, complex, and poorly drafted. While it clarifies some aspects of CCPA, it adds new ambiguous provisions that will cause more confusion and uncertainty. It changes (mostly expanding) the consumer rights in CCPA, and it imposes a wide range of new compliance obligations on companies.

Read More

Emeka Egwuatu to Join Hintze Law Class of 2021

in

We proudly announce that Emeka Egwuatu has accepted a position to join Hintze Law as an incoming 2021 associate. Emeka formerly interned at Expedia gaining valuable privacy experience on GDPR and EU privacy matters.  As a summer associate at Hintze Law he worked on a variety of matters including COPPA, CCPA, BIPA, FERPA, facial recognition technology, data security breach law, and data protection agreements providing valuable contributions to our clients.

Read More

Sheila Sokolowski Joins Hintze Law as Partner and Chair of Health and Biotech Privacy Group

in

We are excited to announce that Sheila Sokolowski has joined the Hintze Law team. Sheila joins as Partner and Chair of the firm’s new Health and Biotech Privacy Group. Sheila is ranked by Chambers USA, which described her as “incredibly quick to understand complex, innovative technologies and develop practical, risk-indexed advice that clients understand and use.”

Read More

Is our U.S. company subject to GDPR? New guidance on territorial scope from EDPB

in

By Jennifer Ruehr and Susan Lyon-Hintze

Non-EU organizations that process personal data as data controllers or processors frequently ask whether they are subject to the General Data Protection Regulation (“GDPR”). The answer depends in part on the “territorial scope” provisions in Article 3 of the GDPR. Organizations fall under the territorial scope of the GDPR when they meet one of two main criteria: the “establishment” criterion under Article 3(1) or the “targeting” criterion under Article 3(2). On November 16, 2018, the European Data Protection Board (“EDPB”) released “Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)-Version for public consultation.” These guidelines provide interpretation and clarification of the Article 3 criteria that can help organizations understand and evaluate how the GDPR applies to their data processing. 

Read More