Consumer Privacy
Canada may require express consent for cross-border transfers of personal information
Canada’s comprehensive privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), has permitted companies in receipt of individuals’ personal information to transfer such data outside Canada for processing or storage without the express consent of the individuals. That may change, however.—Benjamin R. Dwyer
Consumer private right of action blocked; penalties still strong under the California Consumer Privacy Act
An amendment seeking to expand the CCPA's private right of action and remove the thirty-day cure period did not receive a vote in the Senate Appropriations Committee, effectively blocking the bill.—Jenny L. Holmes
Health Care & HIPAA
Three million dollar settlement emphasizes the importance of a robust HIPAA compliance program
While limited in scope, permitting HIPAA-regulated entities to transmit and store patient data through Alexa marks significant progress toward the use of digital assistants in health care.—Valerie Breslin Montague
OCR revises HIPAA annual penalty limits to address culpability
OCR published the Notification to alert the public that OCR is exercising its discretion in assessing Civil Money Penalties under HIPAA as amended by the HITECH Act.—Jena M. Grady