Sidley Data Privacy

Thank you to all who joined Sidley’s Francesca Blythe and Lauren Cuyvers in Brussels on Wednesday for the Women in Privacy Luncheon. Joined by over 65 guests, the duo led an afternoon of networking and engaging discussion on AI and data privacy, featuring insights from speakers Andrea Batalla Eguidazu of Baxter International Inc., Sarah Drennan-Jones of Reckitt, and Pagona Tsormpatzoudi of Mastercard.

Enacted in 2008, the Illinois Biometric Information Privacy Act (“BIPA”) regulates the collection and possession of biometric data by private entities operating in Illinois. Notably, BIPA establishes a private right of action, allowing any person to seek damages, attorneys’ fees, and injunctive relief if the person has been aggrieved by a BIPA violation. Read more on "Biometric Litigation Risks Endure Even Post BIPA Amendment" on Kathleen Carlson,?Lawrence Fogel,?Colleen Theresa Brown,?and?Andy Rodheim's blog post.

Formed in 2013, Women in Privacy? is an international network of more than 4,900 women working as in-house counsel, compliance officers, and other professionals in the field of privacy. In the the November edition of?Spotlight on Women in Privacy, we highlight Esther Silberstein - Associate General Counsel, Privacy & Product at Meta. Read here as Esther shares her views on being a privacy professional, the best advice she ever received, what she’s closely watching now, and more.??

Read more "FY2024 in Review: SEC Enforcement Actions Against Investment Advisers to Private Funds, Registered Funds, and Retail Clients" on Hardy Callcott,?Stephen Cohen,?Chuck Daly,?Ranah Esmaili,?Lara Shalov Mehraban,?Ashley Pfeiffer,?and?Sarah K Gromet's blog post.

For the past few years, hundreds of companies have been caught in a wave of privacy class actions relying on decades-old wiretapping laws to attack modern website technologies and business tools. Last week, Massachusetts’s highest court engaged in a thorough assessment of that state’s wiretap law and rejected plaintiff’s argument that commonly used website advertising and analytical tools intercepted “communications” in violation of the law. Read more on "Massachusetts’ Highest Court Signals Willingness to Scrutinize State Wiretapping Laws and Knock Out Claims at the Pleading Stage" on Amy Lally,?Jack Pirozzolo,?Ian Ross,?Colleen Theresa Brown,?Sheri Porath Rockwell,?and?Kseniya Belysheva's blog post.

On October 22, 2024, the U.S. Consumer Financial Protection Bureau (CFPB) issued a final rule under Section 1033 of the Consumer Financial Protection Act of 2010. Read more on "CFPB Releases Final Rule on Personal Financial Data Rights" on Joel Feinberg,?David Teitelbaum,?and?Stanley Boris' blog post.

Salazar v. National Basketball Association offers an interpretation of the 1988 Video Privacy Protection Act (VPPA) definition of “consumer” that differs from how most courts have used that term. Although this decision may lead to new VPPA lawsuits in other cases involving consumer newsletter subscriptions, the Second Circuit was careful to state that its ruling was “narrow” and limited to Salazar’s specific subscriber allegations. Read our insights here, https://bit.ly/3Nu74Db.?

Digital health AI technologies are transforming the advancement of drug development and healthcare delivery at an unprecedented speed, backed by governments facilitating the momentum to improve healthcare for their growing populations. Sidley’s European life sciences lawyers?Josefine Liv Sommer,?Eva von Mühlenen, LL.M., and?Francesca Blythe?share a timely take on the top 5 life sciences industry trends being shaped by pioneering digital technologies. Read more on "Top Trends in the European Digital Health/AI Market."

On September 23, 2024, the U.S. Department of Justice (DOJ) updated its Evaluation of Corporate Compliance Programs (the ECCP) to reflect DOJ’s evolving expectations with respect to corporate compliance programs, including how those programs appropriately address the compliance risks of new technology such as artificial intelligence (AI). Read more on "Compliance Programs Expected to Evolve With Technology: DOJ Updates Corporate Compliance Guidance to Include Artificial Intelligence."

On 12 September 2024, Advocate General Medina issued their Opinion in Case C-383/23 in which they confirmed that supervisory data protection authorities must, when calculating the fine for a GDPR infringement committed by a subsidiary, take into account the total annual turnover of the entire group—a concept known as parental liability. Read more on "Advisor to the CJEU Confirms GDPR Fines For Subsidiary Infringements Should Reflect Group Turnover" in William Long, Francesca Blythe and Anila Rayani's blog post.