Remove Compliance Remove Definition Remove Failure-to-appear
article thumbnail

Federal Trade Commission Finalizes Updates to the Health Breach Notification Rule

Debevoise Data Blog

Failure to comply with the HBNR can result in penalties of up to $51,744 per violation. While this language may appear exceedingly broad at first glance, certain definitions limit the scope of the HBNR to businesses whose services involve offering or maintaining (e.g., fertility, fitness, glucose levels, heart rate).

article thumbnail

A Summary of the Final Amendments to the NYDFS Cyber Rules

Debevoise Data Blog

The Second Amendment’s compliance requirements will take effect in phases. The Second Amendment’s compliance requirements will take effect in phases. April 15, 2024: 500.17(b): b): Certification requirements. May 1, 2025: 500.5(a)(2): a)(2): Scanning requirements; 500.7: Access privilege and password requirements; 500.14(a)(2):

professionals

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

NYDFS Publishes Revised Amendments to Its Cybersecurity Regulation – What Got Fixed, and What Still Needs Fixing

Debevoise Data Blog

The Revised Amendment narrows the definition of a Class A company by adding that, “when calculating the number of employees and gross annual revenue, affiliates shall include only those that share information systems, cybersecurity resources or all or any part of a cybersecurity program with the covered entity.”

article thumbnail

UK Data Protection Bill No.2 – What is changed?

Technology Law Dispatch

As with the previous bill, the new bill aims to alleviate the burden of compliance with the UK GDPR and its implementing UK Data Protection Act (2018) for organisations in the UK. What are the main proposed changes? Records of processing No longer required unless the organisation is involved in high-risk processing.

article thumbnail

CCPA Enforcement Actions Take Aim at Sales of Personal Information

Debevoise Data Blog

A large number of the examples focused on compliance with the CCPA’s requirements for “sales” of personal information, including the obligation that businesses honor consumers’ use of a Global Privacy Control (“GPC”) opt-out signals.

article thumbnail

Can staking-as-a-service providers be regarded as alternative investment funds?

new tech law blog

(For this reason, for a while there was a risk that the European Parliament would include in the proposed Markets in Crypto-assets Regulation a ban on the use of consensus based on PoW.) StaaS providers offer this service to numerous participants, and this greatly increases the pool of tokens they can present to the network as their stake.

article thumbnail

NYDFS Publishes Official Amendments to Its Cybersecurity Regulation (Part 2) – Answers to the Top Questions from Our Webcast

Debevoise Data Blog

But as more cybersecurity requirements are placed on covered entities, they are more likely to rely on outside assistance for compliance. To the extent that covered entities rely on noncovered entity affiliate(s) for compliance with any of the obligations created by the Proposed Amendments (e.g.,