CPPA Adopts Data Broker Registration Regulations, Begins Delete Act Enforcement
On November 9, 2024, the five-person board of the California Privacy Protection Agency (CPPA) voted unanimously to adopt the proposed Data Broker Registration regulations without modifications. The new regulations seek to clarify key provisions of the California Delete Act, which requires data brokers to register with the state of California […]
China Issues Network Data Security Management Regulations
On September 30, 2024, China’s State Council released the Network Data Security Management Regulations, which will enter into force on January 1, 2025. The regulations apply to “electronic data processed and generated through the network” (covering personal information, “important data” and all other types of electronic data) and provide implementing […]
Cybersecurity in the US
As our world becomes increasingly digital, the importance of cybersecurity has never been more critical. In the first blog post in our series for Cybersecurity Awareness Month, we explored the cybersecurity regulatory efforts in Europe, looking at the Digital Operational Resilience Act (DORA), the Network and Information Security Directive (NIS2) […]
Navigating Privacy and Cybersecurity Challenges in the Automotive and Mobility Sector
In this first installment of our series on the automotive and mobility sector, Cooley cyber/data/privacy lawyers introduce the key data privacy legal issues facing the automotive and mobility sector and provide an overview of the US state and federal regulatory enforcement environment. US Regulators Target Automotive Sector The wave of […]
Cybersecurity in the European Union
As our world becomes increasingly digital, the importance of cybersecurity has never been more critical. From personal devices to enterprise networks, cyber threats are evolving at an alarming pace, targeting vulnerabilities and exploiting our growing reliance on technology. October marks ‘Cybersecurity Awareness Month’ – a global initiative to promote awareness […]
EU AI Act: Does It Affect Your Organization or Not?
This blog post is part of our series on the European Union’s Artificial Intelligence (AI) Act. As we explained in our July 2024 blog post, the EU’s AI Act establishes an extensive regulatory framework for AI and will be fully effective starting 2 August 2026, with some requirements (such as […]
Federal Court Dismisses Bulk of SEC’s Complaint Against SolarWinds in Cyberattack Case
On July 18, 2024, US District Judge Paul Engelmayer of the Southern District of New York issued a detailed 107-page opinion and order dismissing most of the US Securities and Exchange Commission (SEC) case against SolarWinds and its chief information security officer (CISO). The SEC’s amended complaint alleged that SolarWinds and its […]
SEC Reporting Implications for Publicly Traded Companies Impacted by CrowdStrike Defective Software Update
There are a number of US Securities and Exchange Commission (SEC) reporting implications arising from the server-related outages caused by CrowdStrike’s defective software update on July 19, 2024, and their impacts on public companies, particularly in light of the SEC’s new cybersecurity disclosure rules. While the situation on the ground […]
SEC Settles Charges Against RR Donnelley Related to Cybersecurity Incident Disclosure and Internal Access Controls
On June 18, 2024, the Securities and Exchange Commission (SEC) announced that it had settled claims against RR Donnelley (RRD) related to a 2021 ransomware and cyber extortion attack. Despite RRD having discovered and reported the incident within 30 days (a relatively short time frame for investigating complex data breaches), […]
AI Act Enters Into Force
On 12 July 2024, the long-awaited Artificial Intelligence Act (AI Act) was published in the Official Journal of the European Union (OJEU), meaning that 20 days from this date it will enter into force and will apply from 2 August 2026, bringing certainty regarding the timeline for its applicability, which […]