Photo of Katie Townley

Email
(202) 342-8557
Bio

The FTC and the New York Attorney General recently announced a record-setting $170 million ($136 million to the FTC and $34 million to the NY AG) joint settlement with Google. The settlement resolves allegations that YouTube violated the Children’s Online Privacy Protection Act (“COPPA”) and is the largest penalty the FTC has ever received in

Effective January 1, 2020, New Hampshire’s new Insurance Data Security Law will impose certain information security requirements on entities that (1) are licensed under the state’s insurance laws and (2) handle “nonpublic information.” “Nonpublic information” is defined as information that is not publicly available and falls into one of the two following categories:

  1. Information that

Last week, the New York Attorney General’s Office announced that Bombas had agreed to pay $65,000 and implement a number of injunctive provisions to settle allegations that the sock startup failed to comply with the state’s data breach notification statute. According to the press release, Bombas learned in November 2014, that an unauthorized intruder

Earlier this month, the Department of Justice released a White Paper and FAQ on the Clarifying Lawful Overseas Use of Data (CLOUD) Act. Enacted in March 2018, the CLOUD Act attempts to resolve the legal conflicts that arise when one country orders the disclosure of electronic data pursuant to a criminal investigation, but another country’s

Yesterday, Christine Wilson was sworn in as FTC Commissioner. Commissioner Wilson – the fifth and final Trump appointee – joins the FTC from Delta Airlines and assumes former Commissioner Maureen Ohlhausen’s seat. Commissioner Ohlhausen announced her departure on Tuesday – the day her term ended, concluding over six years of service as Commissioner, including a

On Tuesday, in an 80 to 19 vote, the Senate confirmed Peter Feldman as CPSC Commissioner – to finish Commissioner Mohorovic’s term ending October 26, 2019. Today, in a narrow 51 to 49 vote, the Senate confirmed him to a full, seven-year term. As we discussed here, Mr. Feldman previously served as Senior Counsel

You’ve probably heard of the dreaded four-letter word – GDPR.  Companies around the globe had been preparing for the May 25th implementation date for quite some time.  But U.S.-based companies with no apparent EU presence may not have thought twice about whether the data protection law across the pond even applies to them.  Let’s face it, we have enough federal and state laws here in the U.S. to worry about.  But now that the GDPR dust has settled a bit, these U.S. companies may want to take a closer to look to confirm they aren’t captured within GDPR’s sweeping scope.

In this first installment of GDPR SIDEBAR, we address the fundamental threshold question of whether and to what extent a U.S.-based company must comply with the GDPR.  [click here for a primer on GDPR]


Continue Reading

Just when you think you have it all under control, the data breach notification law landscape changes – again. Over the past few weeks, several data breach notification statutes were updated, including an effective date for Canada’s mandatory breach notification obligations, as well as the adoption of legislation in the two holdout states (Alabama and

Last Friday, the CPSC voted to sue Britax Child Safety, Inc. to force the company to recall various models of single and double B.O.B. jogging strollers. The one-count administrative complaint alleges that the strollers present a substantial product hazard under Section 15(a)(2) of the Consumer Product Safety Act because they contain a product defect that

Last Friday, ten consumer and privacy advocacy groups, including the Electronic Privacy Information Center, Center for Digital Democracy, and Consumer Watchdog, sent a letter to Acting Chairman Ann Marie Buerkle, requesting that the CPSC recall the Google Home Mini smart speaker. The speaker was designed to respond to the voice commands, “OK, Google” and “Hey,