By Adrianne Appel2023-02-13T19:00:00
The California Privacy Protection Agency (CPPA) is seeking comment on privacy rules requiring certain large businesses to conduct annual cybersecurity audits and risk assessments if the state believes they are placing consumer data at risk.
The California Privacy Rights Act (CPRA) mandated the agency write cybersecurity audit and risk assessment rules for businesses whose processing of consumer personal data presents “significant risk to consumers’ privacy or security,” according to the CPPA’s request for comments published Friday.
The agency also will write rules concerning use of automated decision-making technology by businesses regarding consumers’ opt-out rights and their access to data.
2023-09-15T20:11:00Z By Adrianne Appel
Draft risk assessment regulations under the California Consumer Privacy Act are designed to prohibit businesses from handling consumer data if uncontrolled risks—to the security and privacy of the consumer, the public, or the business—outweigh the benefits.
2023-07-17T14:37:00Z By Kyle Brasseur
The California Office of the Attorney General has turned its attention to the practices of large companies regarding the protection of the personal information of employees and job applicants as part of its latest investigative sweep under the California Consumer Privacy Act.
2023-03-02T14:00:00Z By Kyle Brasseur
Three years in, the promise of the California Consumer Privacy Act as a means of handing down eye-watering penalties against companies for data protection violations remains unfulfilled. And yet, the expanding U.S. data privacy legislation landscape is better for this.
2025-08-28T20:40:00Z By Aaron Nicodemus
The order barring three Mexican financial institutions from doing business with U.S. financial institutions has been delayed until October.
2025-08-27T19:46:00Z By Aly McDevitt
The SEC has named Margaret “Meg” Ryan, a senior military judge and Harvard Law lecturer, as its next Enforcement Division Director—an unconventional pick that could signal changes in enforcement strategy.
2025-08-22T19:05:00Z By Adrianne Appel
Businesses operating in California will need to meet new, first-in-the-nation privacy requirements for cybersecurity, risk assessments, and automated decision-making technology, under a large expansion of rules by the state.
Site powered by Webvision Cloud