United States: Data Protection

On July 9, 2026, the Federal Trade Commission (“FTC”), entered into a settlement with RentGrow, Inc. (“RentGrow”) after the filing of an agreed-upon consent order...

California's privacy agency has launched its first sectoral audit targeting gig economy platforms to examine whether these companies are properly respecting workers' rights to access and control their personal information.

In anticipation of these audits, gig economy companies should evaluate their privacy compliance programs, particularly their procedures for receiving, tracking, and responding to data rights requests.

Federal regulators are dramatically expanding health information exchange through TEFCA while simultaneously ramping up enforcement against information blocking practices. With over 1 billion health records now flowing through the network and a new federal auditor in place, healthcare organizations face heightened scrutiny and potential penalties reaching $1 million per violation. How should providers prepare for this new era of interoperability oversight?

The European Data Protection Board has released new guidelines that fundamentally reshape how life sciences companies can determine whether clinical trial data, genomic information, and real-world evidence qualify as truly anonymous under EU law. These guidelines introduce a perspective-relative framework where the same dataset can be considered anonymous for one recipient while remaining personal data for another, depending on their actual means of re-identification. The guidance establishes a structured t

On 16 July 2026, the SEC proposed Regulation E-Delivery, a new rule that would make e-delivery the default for how investors receive regulatory information under the federal securities laws.

This page provides information about cookie usage and data collection practices, explaining how the site uses cookies for operation, performance improvement, and content personalization. Users can manage their cookie preferences and learn about data sharing with third parties through linked privacy policies.

A federal court in Illinois has ruled that violations of the DOJ's Bulk Sensitive Data rule can serve as the predicate tort to overcome the Electronic Communications Privacy Act's one-party consent defense. This decision creates new litigation exposure for digital advertising platforms and data brokers that transfer sensitive personal data to entities in countries of concern, including China, Russia, Iran, North Korea, Cuba, and Venezuela.

This article examines critical lessons learned from managing data breaches, focusing on the often-overlooked long-term challenges of data analytics and notification obligations. The authors explore how organizations can better prepare for and navigate the extended lifecycle of breach response, from initial detection through regulatory compliance and beyond.