Cybersecurity

Subscribe to Cybersecurity via RSS
IoT_1200x600_GettyImages-2163547048

Good decisions depend on good data. Football coaches study film to learn what an opponent calls on third-and-long so they can deploy the right defense. Businesses collect vast amounts of data to develop and market new products. No general counsel (GC) would approve a major business decision without first gathering the available facts and conducting the necessary legal research. Yet GCs make high-stakes regulatory decisions every day without a complete, data-driven picture of the enforcement landscape. Sometimes the gamble pays off, but when it does not, it can cause serious problems for the company.

Cybersecurity_1073242516

California’s latest legislative session delivered a wave of privacy developments, with Governor Gavin Newsom signing a broad set of measures affecting consumer rights. But one proposal did not make it across the finish line: AB 1542, which would have prohibited the sale or sharing of sensitive personal information with third parties. This article examines the governor’s veto of AB 1542 and what it means for the direction of privacy policy and for businesses and consumers subject to California law.

Cyber_1200x600_GettyImages-2156097092

The Securities and Exchange Commission’s (SEC) 2024 amendments to Regulation S-P are now fully in effect, with both compliance deadlines now behind us. For broker-dealers, investment advisers, private fund managers, and other covered institutions that worked hard to prepare incident response programs and other items necessary to meet their respective implementation deadlines, there’s no rest for the weary. Covered institutions should expect the SEC’s Division of Examinations to focus on whether firms have actually put their Reg S-P obligations into practice. According to the SEC’s Division of Examinations (Division) Fiscal Year 2026 Examination Priorities, the Division will examine whether firms have developed, implemented, and maintained policies and procedures in accordance with the rule’s new provisions that address administrative, technical, and physical safeguards for the protection of customer information. Now is the time for firms to assess their operational resiliency and the effectiveness of their programs in practice, not just on paper.

Webinars_1200x600_GettyImages-1055951048

Key Point: In a significant ruling for the AI industry, the Ninth Circuit vacated a preliminary injunction against Perplexity AI, holding that Amazon was unlikely to succeed on its Computer Fraud and Abuse Act (CFAA) and California Comprehensive Data Access and Fraud Act (CDAFA) claims. The court concluded that Perplexity’s AI Assistant is a “tool, not a person” for statutory purposes, and that it is the user who “accesses” websites visited using the AI-powered Comet browser. The decision provides the first major appellate guidance on how the CFAA applies to agentic AI systems, though the court was careful to cabin its holding to the specific facts presented.

Data-Breach_1200x600_GettyImages-2157164022

Key Points

  • OCR reached two 2026 settlements — totaling $695,000 — with self-funded group health plans following ransomware breaches, marking a notable expansion of direct HIPAA enforcement against self-funded health plans.
  • Both plans were cited for failing to conduct an accurate and thorough risk analysis to identify vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) stored on plan sponsor systems.
  • Self-funded group health plans are HIPAA-covered entities with independent compliance obligations that are separate from those of their plan sponsors, third-party administrators, and business associates.
  • Plan sponsors should conduct a plan-specific HIPAA risk analysis that explicitly evaluates ePHI data flows and any connections between the plan’s systems and the employer’s corporate IT environment.
  • OCR corrective action plans in both cases require comprehensive risk analyses, policy updates, workforce training, and periodic compliance reporting — requirements plan sponsors should proactively implement.
Artificial_Intelligence_1200x600_GettyImages-2201092747

Key Point: A multistate coalition of 42 state AGs reached a landmark $150 million settlement with 23andMe over a 2023 data breach affecting 6.9 million customers, marking the largest AG multistate settlement involving consumer genetic data to date. This resolution signals heightened regulatory scrutiny of genetic data security practices and establishes a precedent for state enforcement authority in bankruptcy proceedings.

Privacy_1200x600_GettyImages-1347310666

Key points: Troutman Pepper Locke’s Regulatory Investigations, Strategy + Enforcement (RISE) and Privacy + Cyber + AI practice groups worked with the firm’s innovation team using AI to collect and curate five years of data concerning state AG activities and actions related to privacy, security, and AI. This Regulatory…

Data_1200x600_GettyImages-1196044470

On June 30, 2026, New Jersey enacted legislation A5328 (P.L.2026, c.25), which will expose a broad swath of U.S. companies to data broker registration fees ranging from $5,000 to $1.5 million annually. The new legislation is not limited to data brokers in the conventional sense. It applies generally to any company that sells or licenses personal data of New Jersey residents, including those with direct customer relationships. Much of the law takes effect immediately, so companies should begin reviewing the requirements now to comply.

In the prior Part 4 of this series, we explained how CCPA cybersecurity audits are likely to surface in CalPrivacy and California Attorney General enforcement actions, and how that regime impacts governance and executive responsibility.