GLOBAL PRIVACY & CYBERSECURITY UPDATE View PDF | Forward | - - PDF document

GLOBAL PRIVACY & CYBERSECURITY UPDATE

Jones Day Cybersecurity, Privacy & Data Protection Lawyer Spotlight:

Edward S. Chang

Data privacy­ and security­related class actions appear to be on the rise, and effectively defending them requires the right mix of substantive and procedural

• knowledge. Edward Chang is a

partner based in Irvine, California, and, for nearly 15 years, has represented institutional clients in a wide array of complex litigation matters, with an emphasis on cybersecurity, privacy, and consumer issues. He has served as lead counsel in hundreds of class and individual actions, complicated business disputes, and regulatory investigations, including bet­the­company matters. As a leader in Jones Day's cybersecurity practice in California, Ed advises clients on their most sensitive business and cybersecurity issues. He advises industry leaders on a variety of cyber and privacy matters, including industry standards, cybersecurity management, data governance, third­party management, product liability risk, licensing, and regulatory and litigation risks. Ed also advises clients on data­breach response and data­ breach class actions filed in state and federal courts across the country, including working on a team handling more than 47 nationwide data­breach class actions in one

• f the largest data­breach matters in U.S. history

United States

Regulatory—Policy, Best Practices, and Standards

NIST Evaluates Advances in Face Recognition

PRACTICE DIRECTORY

Daniel J. McLoon, Los Angeles Mauricio F. Paez, New York Jay Johnson, Dallas Jonathon Little, London Elizabeth A. Robertson, London Todd S. McClelland, Atlanta Jeff Rabkin, San Francisco Lisa M. Ropple, Boston Adam Salter, Perth Michiru Takahashi, Tokyo Undine von Diemar, Munich Richard M. Martinez, Minneapolis Samir C. Jain, Washington John A. Vogt, Irvine Edward S. Chang, Irvine Aaron D. Charfoos, Chicago Elizabeth Cole, Singapore Chiang Ling Li, Hong Kong Richard DeNatale, San Francisco Olivier Haas, Paris Jörg Hladjk, Brussels Guillermo E. Larrea, Mexico City Todd Kennard, Columbus Jimmy Kitchen, Pittsburgh Ryan M. DiSantis, Boston Matthew L. Jacobs, Washington Editor­in­Chief: Kerianne N. Tobitsch Partner Lead: Jay Johnson

HOT TOPICS IN THIS ISSUE

Additional U.S. States Propose Bills with CCPA­Like Provisions Canadian Health Department Seeks

Global Privacy & Cybersecurity Update Issue 21 | February 2019 Jones Day

View PDF | Forward | Subscribe | Subscribe to RSS | Related Publications United States | Latin America | Europe | Asia | Australia

Software On November 30, 2018, the National Institute of Standards and Technology ("NIST") published a report evaluating the accuracy of facial recognition software. NIST's study found that between 2014 and 2018, facial recognition software became 20 times better at searching databases to find matching photographs. The evaluation used 127 software algorithms from 39 different developers, which represent the bulk of the industry. NIST Proposes Steps to Modernize Technology Transfer and Innovation On December 6, 2018, NIST released a draft green paper with proposed steps to modernize the transfer and commercialization of technology developed through federally funded research and development initiatives. The proposals include updating legal tools for the transfer

• f technology, such as intellectual property rights for the

licensing and commercial development of federal

• research. The draft green paper includes input from

federal stakeholders, such as the National Science and Technology Council's Lab­to­Market Subcommittee, as well as public comments.

Regulatory—Consumer and Retail

FTC Releases Do Not Call Registry Data for Fiscal Year 2018 On December 6, 2018, the Federal Trade Commission ("FTC") released the National Do Not Call Registry Data Book for Fiscal Year 2018, along with state­by­state analyses of the data. The number of registrants with the Do Not Call list has increased significantly, while the number of complaints has decreased and the most prevalent types of calls have changed. FTC Holds Hearings on Data Security On December 11­12, 2018, the FTC held hearings on data security as part of its examination of consumer protection in the 21st century. The hearings included discussions on incentives to invest in data security, consumer demand for data security, data security assessments, a U.S. consumer framework for data security, and the FTC's data security enforcement program. Video recordings and transcripts of the hearing are available on the FTC website. Retailer Discloses Cybersecurity Attack On December 21, 2018, a retailer disclosed that it was the victim of a cybersecurity attack involving suspicious log­in

• activity. The retailer planned to notify all customers whose

usernames and passwords may have been used to access their accounts, even though there was no indication that the usernames and passwords used in the log­in attempts were obtained from its systems, or that any personal information stored on its customers' accounts were

• btained.

Hotel Discloses Approximately 383 Million Records Comment on Medical Device Cybersecurity Guidance Argentinian Agency Approves Guidelines for Binding Corporate Rules EU Negotiators Reach an Agreement

• n Cybersecurity Act

European Commission Adopts Adequacy Decision on Japan

RECENT AND UPCOMING SPEAKING ENGAGEMENTS

Industrial IoT, Privacy. Security.

• Risk. 2019, Las Vegas (September

2019). Jones Day Speaker: Mauricio Paez 2019 Fourth Annual Latin America Privacy & Cybersecurity Symposium, Mexico City (May 2019): Jones Day Speakers: Mauricio Paez, Guillermo Larrea, Todd McClelland, Olivier Haas, and Rick Martinez Data Privacy, Retail Robotics & AI Conference, Northwestern University, Evanston, IL (April 2019). Jones Day Speaker: Mauricio Paez Fraud & Breach Summit, Information Security Media Group, Dallas, Texas (April 2019). Jones Day Speaker: Jay Johnson 50 Points of Law—What's New & Dangerous in Civil Litigation!, MCLE 50th Anniversary Series, Boston, Massachusetts (April 2019). Jones Day Speaker: Lisa Ropple Cybercrime, Cryptocurrency, and ICOs, Handling Your First (or Next) White Collar Crime Case, Texas State Bar, Austin, Texas (April 2019). Jones Day Speakers: Jay Johnson, Mark Rasmussen CIPP/E Training as part of the GDPR Ready 4 Day Training of the IAPP, Munich, Germany (March 2019). Jones Day Speaker: Undine von Diemar 2019 IoT National Institute, American Bar Association, Washington, D.C. (March 2019). Jones Day Speaker:

Affected in 2018 Breach On January 4, a hotel chain disclosed that up to 383 million guest records were compromised in a breach of its reservation database that began in 2014. This is an increase from the figure reported when the company first announced the existence of the breach on November 30,

• 2018. The hackers accessed names, addresses, phone

numbers, email addresses, and passport numbers stored in the reservation database. The incident affected approximately 8.6 million encrypted payment card numbers, 5.25 million unencrypted passport numbers, and 20.3 million encrypted passport numbers.

Regulatory—Financial

FTC Seeks Comments on Identity Theft Detection Requirements On December 4, 2018, the FTC announced that it is seeking comments on whether it should change rules that currently require financial institutions and creditors to take steps to detect signs of identity theft affecting customers. The FTC is seeking comments on the costs these rules impose on consumers and businesses, whether there is a continuing need for the rules, and whether to expand the types of creditors covered by the rules. SEC Office of Compliance and Examinations to Focus on Cybersecurity On December 20, 2018, the SEC's Office of Compliance Inspections and Examinations ("OCIE") announced its 2019 examination priorities, which include a focus on cybersecurity and digital assets. The SEC reiterated that all OCIE examination programs "will prioritize cybersecurity with an emphasis on, among other things, proper configuration of network storage devices, information security governance, and policies and procedures related to retail trading information security."

Regulatory—Energy/Utilities

DOE Announces Cyber Threats Targeting Cloud Services Providers On December 20, 2018, the United States Department of Energy ("DOE") announced that a Chinese cyber group is engaging in cyber­enabled theft targeting global managed service providers, cloud service providers, and their

• clients. The DOE stated that the group operated on behalf
• f the Chinese Ministry of State Security and used a mix
• f sophisticated custom malware and off­the­shelf

applications to compromise multiple service and cloud

• providers. The group targeted information from critical

infrastructure companies in the areas of information technology, energy, health care, communications, and critical manufacturing. DOE Announces $40 Million Grid Modernization Initiative On January 24, the DOE announced a $40 million initiative in Fiscal Year 2019 for its Grid Modernization Initiative. Jay Johnson Law Enforcement—Information & Data Sharing with the Private Sector, Third Annual Boston Conference on Cyber Security, Boston College, Boston, Massachusetts (March 2019). Jones Day Speaker: Samir Jain The Anatomy of a Cyber Attack, Third Annual Boston Conference on Cyber Security, Boston College, Boston, Massachusetts (March 2019). Jones Day Speaker: Lisa Ropple The Intersection of e­Discovery and Data Breach Response, The Master's Conference, Dallas, Texas (February 2019). Jones Day Speaker: Jay Johnson Current Developments in Global Data Privacy and Security, Ethics & Compliance Certificate Program, SMU Dedman School of Law, Dallas, Texas (February 2019). Jones Day Speaker: Jay Johnson Privacy by Design and Privacy by Default—On the Ground, IAPP Data Protection Intensive France 2019, Paris, France (February 2019). Jones Day Speaker: Olivier Haas Data Privacy—A Discussion of Law and Policy, Federalist Society, Notre Dame Law School, South Bend, Indiana (February 2019). Jones Day Speaker: Jay Johnson Handling a Cybersecurity Investigation: An Interactive Tabletop Exercise Led by a Regulator, a Lawyer, and a Security Expert, Utilities & Energy Compliance & Ethics Conference, SCCE, Houston, Texas (February 2019). Jones Day Speaker: Jay Johnson Evening Conversation on Privacy, Science & Technology Section, Dallas Bar Association, Dallas, Texas (February 2019). Jones Day Speaker: Jay Johnson Threat and Vulnerability Management, CISO Executive Network, Washington, D.C. (January 2019). Jones Day Speaker: Samir Jain

The initiative aims to work with public and private partners to develop tools and technologies for a modern "grid of the future" that is resilient, reliable, and secure. The initiative will leverage subject matter expertise across national laboratories, including on the topics of cybersecurity, resilience modeling, advanced sensors, and energy storage. Additional details are expected to be released by March.

Regulatory—Transportation

Pennsylvania Criminalizes Drone Misuse On January 12, Pennsylvania's law imposing criminal penalties for unlawful use of drones went into effect. The new law prohibits the use of drones to intentionally or knowingly conduct surveillance of another in a private space, or the operation of a drone in a manner that places another person in reasonable fear of bodily injury. The law permits a $300 fine for violations.

Regulatory—Health Care/HIPAA

HHS Releases New Health Industry Cybersecurity Practices On December 28, 2018, the U.S. Department of Health and Human Services ("HHS") released the publication of "Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients." The publication suggests voluntary cybersecurity practices, resources, and templates for small, medium, and large health care

• rganizations. The publication is the result of a two­year

industry­led effort in response to Section 405(d) of the Cybersecurity Act of 2015 mandating the development of practice guidelines to reduce cybersecurity risks for the health care industry. HHS Seeks Public Input on Modifications to the HIPAA Privacy Rule On December 12, 2018, HHS issued a Request for Information seeking public input on how the HIPAA Privacy Rule could be modified to further the goal of protecting the privacy and security of individuals' health information while permitting information­sharing needed for important purposes, such as coordination of treatment and care.

Regulatory—Defense and National Security

Secretaries Issue Joint Statement on Chinese Cyber Attacks On December 20, 2018, the Secretary of State and Secretary of Homeland issued a joint statement regarding hacks on managed service and cloud service providers by actors linked to the Chinese Ministry of State Security. The statement expressed concern that these hacks may have violated commitments made by China in 2015 to refrain from conducting or knowingly supporting "cyber­ enabled theft of intellectual property, including trade Cyber Incident Response Planning, Cybersecurity Policy & Governance Program, Boston College Law School, Boston, Massachusetts (January 2019). Jones Day Speaker: Samir Jain Implications of the US Cloud Act and Other Developments Regarding Data Protection in Context of the USA, GDD Winter Workshop, Germany (January 2019). Jones Day Speaker: Jörg Hladjk GDPR Regulatory Enforcement, CISO Executive Network, Houston, Texas (January 2019). Jones Day Speaker: Nicole Perry Strategic Breach Preparation and Response in 2019, Jones Day CLE Academy, Atlanta, Georgia (January 2019). Jones Day Speakers: Todd McClelland, Greg Hanthorn, Amisha Kotte, Jay Johnson Blockchain Technology, Security, and Privacy, ABA Science and Technology Section, Webinar (January 2019). Jones Day Speaker: Jay Johnson Recent Trends in Cybersecurity and Privacy, Including the New California Consumer Privacy Act, Jones Day, Irvine, California (January 2019). Jones Day Speakers: Rich DeNatale, Ed Chang, Jeff Rabkin, John Vogt Threat and Vulnerability Management, CISO Executive Network, New York, New York (January 2019). Jones Day Speaker: Mauricio Paez 2018 Privacy & Data Security Recap Webinar, Association of Corporate Counsel (ACC) Webinar (December 2018). Jones Day Speaker: Rick Martinez US Cybersecurity and Privacy Law, Peking University School of Law, Beijing China (November 2018). Jones Day Speaker: Mauricio Paez

RECENT AND UPCOMING PUBLICATIONS

secrets or other confidential business information, with the intent of providing competitive advantages to companies

• r commercial sectors."

Director of National Intelligence Unveils National Intelligence Strategy On January 24, the Director of National Intelligence unveiled the National Intelligence Strategy, a quadrennial publication that sets intelligence strategy for the next four

• years. The strategy calls attention to cyber and space as

new domains of warfare. In particular, the strategy notes that the relatively low cost of cyber operations and lack of attribution makes the cyber domain attractive to smaller nations, terror groups, transnational criminal networks, and individuals. The strategy also calls for the United States to be at the forefront of research on artificial intelligence, advanced automation, and nanotechnology.

Litigation, Judicial Rulings, and Agency Enforcement Actions

Hotel Chain Faces Multimillion­Dollar Data Breach Class Action On December 1, 2018, an individual filed a putative class action complaint in New York federal court against a hotel chain alleging violations of federal securities laws related to a massive data breach that potentially affected up to 500 million hotel guests. The complaint alleges that the company made materially false and misleading statements in SEC filings regarding the security of customer data. The company seeks to combine this case with other class actions filed throughout the United States. District of Columbia Sues Social Media Company Over Data Harvesting On December 19, 2018, the Attorney General for the District of Columbia sued a social media company for violations of the District's Consumer Protection Procedures Act in relation to the harvesting of user data by a third­party application developer who sold the data to a political consulting firm. The complaint alleges that the company engaged in unfair and deceptive trade practices for allegedly failing to inform consumers that their personal information may be shared with third­party applications without their knowledge or consent. Airline Reaches $2.3M Settlement to End Worker Background Check Class Action On January 3, an airline agreed to pay $2.3 million to settle a proposed class action brought on behalf of about 44,100 job applicants that claimed the company disregarded federal and California law by including extraneous and misleading information in notifications to prospective employees about background checks, and did not make standalone disclosures in compliance with the Fair Credit Reporting Act. SEC Charges Hackers of EDGAR System Chapter, "Liability, and Connected Products: Litigation and the IoT," American Bar Association book The Internet of Things (March 2019). Jones Day Author: Rick Martinez Chapter, "Blockchain and the Internet of Things," American Bar Association book The Internet of Things (March 2019). Jones Day Authors: Jay Johnson, Mark Rasmussen, Kerianne Tobitsch Chapter, "Privacy and the Internet of Things," American Bar Association book The Internet of Things (March 2019). Jones Day Authors: Mauricio

• F. Paez, Kerianne Tobitsch

Co­Author, The German Facebook Case–Towards an Increasing Symbiosis Between Competition and Data Protection Law? Competition Policy International CPI (February/March 2019). Jones Day Author: Jörg Hladjk Illinois Supreme Court Rules that Plaintiff Is "Aggrieved" Under State Biometrics Statute Despite Alleging No Injury (February 2019). Jones Day Authors: Jon Linas, Efrat Schulman, Todd Kennard, Aaron Charfoos SEC Enforcement in Financial Reporting and Disclosure—2018 Year ­End Update (January 2019). Jones Day Authors: David Woodcock, Joan McKown, Henry Klehm III, Tyson Lies Amended Massachusetts Data Breach Law Requires Additional Disclosures and Free Credit Monitoring (January 2019). Jones Day Authors: Various Stopping Data Breaches Will Require Help from Governments, Harvard Business Review (January 2019). Jones Day Authors: Samir Jain, Lisa Ropple California Consumer Privacy Act Guide (January 2019). Jones Day Authors: Various Blockchain Trading for Nonlisted

On January 15, the SEC announced charges against nine defendants for hacking into the SEC's EDGAR system and extracting nonpublic information. The SEC's complaint alleges that the hackers gained access to EDGAR in 2016 and extracted files containing nonpublic earnings results, and used the information to make trades and earn at least $4.1 million in illegal profits. Illinois Supreme Court Issues Highly Anticipated BIPA Decision On January 25, the Illinois Supreme Court unanimously held that a person has standing to sue under the Biometric Information Privacy Act ("BIPA") without alleging a separate, real­world harm. BIPA imposes requirements on companies that collect and handle biometric identifiers of Illinois residents, such as notice and consent requirements. BIPA permits an "aggrieved" person to sue for violations of the statute, and the Illinois Supreme Court determined that a plaintiff is "aggrieved" when the individual's rights have been infringed, without the need to plead an actual injury or adverse effect beyond a technical violation of the statute. For more information, please see our Jones Day Alert.

Legislative—Federal

Senator Calls for Data Minimization Laws On November 30, 2018, U.S. Senator Mark Warner (D­ VA) issued a press release calling for national data privacy legislation to safeguard consumer information. The announcement called for data minimization and retention requirements to limit how much sensitive information companies collect and retain about

• consumers. The announcement also called for the

legislation to hold companies accountable for security costs.

Legislative—States

Additional States Propose Bills with CCPA­Like Provisions Since January 1, a number of states have introduced bills modeled at least in part on California's Consumer Privacy Act ("CCPA") and borrow many of the same provisions, such as requiring companies to provide notice of the types

• f personal information they collect and the categories of

third parties to whom they disclose personal information. Securities: The New French Regime Is Achieved (January 2019). Jones Day Authors: Philippe Goutay, Alban Caillemer du Ferrage, Florent Bouyer FCC Establishes Reassigned Phone Number Database (January 2019). Jones Day Authors: Todd Kennard, Bill Dolan, Mike Hazzard European Data Protection Board Provides Clarifications on Territorial Scope of GDPR (December 2018). Jones Day Authors: Olivier Haas, Undine von Diemar, Jonathon Little, Jörg Hladjk Agent Actions Don't Equal Personal Jurisdiction in Telephone Consumer Protection Act Case (December 2018). Jones Day Authors: Bill Dolan, Todd Kennard, Brandy Hutton Ranjan New Regulation Favors Free Flow of Non­Personal Data in the EU (December 2018). Jones Day Author: Jörg Hladjk Regional Shake­Up or More of the Same? How the USMCA Impacts North American Trade (November 2018). Jones Day Authors: Laura Fraedrich, Javier Cortés, Chase Kaniecki, Chris Tipler Companies in France Need a Global and Consistent Culture to Face Unprecedented Regulatory Scrutiny (November 2018). Jones Day Authors: Various The bills also would grant individuals certain rights, such as the right to request access to their personal information and the right to opt­out of the sale of personal information. Washington's bill goes further and proposes requirements closer to the European Union's GDPR, such as defining roles for controllers and processors and imposing a requirement to correct inaccurate information. Most of these bills have been referred to committees and are under consideration (except for the Mississippi bill, which died in committee on February 5). For more information, please see our Jones Day Alert.

• On January 2, SB 176 was introduced in New Mexico.
• On January 9, S00224 was introduced in New York.
• On January 12, SD 341 was introduced in Massachusetts.
• On January 14, HB 1485 was introduced in North Dakota.
• On January 18, SB 418 was introduced in Hawaii.

• On January 25, HB 1253 was introduced in Mississippi.
• On January 30, SB 5376 was introduced in Washington.
• On January 31, S0234 was introduced in Rhode Island.
• On February 4, SB0613 was introduced in Maryland.

South Carolina Enacts Insurance Data Security Act On January 1, South Carolina enacted a breach notification and information security law for insurers, agents, and other licensed entities authorized to operate under the state's insurance laws. The South Carolina Insurance Data Security Act is based on the National Association of Insurance Commissioners' Insurance Data Security Model Law and includes stringent requirements for investigating and disclosing certain cybersecurity events within 72 hours of discovery. Vermont Regulates Data Brokers On January 1, Vermont passed a law to regulate data brokers that collect and sell personal information about consumers. The law requires data brokers to register with the Secretary of State, provide information about the broker's opt­out policies, maintain a written information security program, and make certain disclosures to consumers. Vermont passed the law in response to reported risks associated with the widespread aggregation and sale of data about consumers. Massachusetts Amends Data Breach Notification Law On January 10, the Governor of Massachusetts signed legislation to amend Massachusetts' data breach notification law to require the sharing of additional information with state regulators, among other

• changes. Entities must provide information about the nature of the breach, the number of affected state

residents, the identity of the person responsible for the breach, and a description of the information

• compromised. Companies also must disclose whether they have a written information security program

and the steps taken after the data breach. The new law goes into effect on April 11.

Canada

Canadian Health Department Seeks Comment on Medical Device Cybersecurity Guidance On December 7, 2018, Health Canada published draft guidance on cybersecurity for medical devices. The guidance recommended the incorporation of cybersecurity into the design of the device and across the device's lifecycle, and recommended that manufacturers engage in post­market monitoring to identify and address evolving vulnerabilities. Health Canada requested comments from across the industry on the "technical considerations related to cybersecurity of medical devices and the submission requirements for a medical device license." The following Jones Day lawyers contributed to this section: Kaeley Brown, Shirley Chan, Jeremy Close, Meredith Collier, Jennifer Everett, Levent Hergüner, Jay Johnson, Christopher Markham, Mallory McKenzie, Mary Alexander Myers, Nicole Perry, and Kerianne Tobitsch. [Return to Top]

Latin America

Argentina

Agency Approves Guidelines for Binding Corporate Rules On December 7, 2018, the Access to Public Information Agency (Agencia de Acceso a la Información Pública) issued through an official communication the Guidelines and Basic Contents of Binding Corporate Rules (Lineamientos y Contenidos Básicos de Normas Corporativas Vinculantes), which provides guiding principles of self­regulation standards for personal data protection among entities from the same group of companies (source documents in Spanish). The guidelines allow companies to prove before the Agency that international data transfers are secure and have an adequate level of protection, especially when the recipient country does not have the same security standards for personal data.

Brazil

Federal District Attorney's Office Investigates Hotel Data Breach On December 3, 2018, the Federal District Attorney's Office in Brasília (Ministério Público do Distrito

Federal e Territórios), through its Special Unit for Data Protection and Artificial Intelligence, started an investigation into the potential leak of Brazilians' personal data stored in the servers of an international hotel chain. The breach potentially exposed the personal data of up to 500 million guests worldwide, including personal information such as full name, passport number, mailing address, email, phone number, date of birth, arrival and departure dates, and, in some cases, credit card information. Brazil Creates National Data Protection Authority On December 27, 2018, the former Brazilian President signed Executive Order No. 869/2018, which established the Brazilian National Data Protection Authority (Agência Nacional de Proteção de Dados, or "ANPD") (source document in Portuguese). Brazil created the ANPD pursuant to the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais). The ANPD will regulate data protection issues,

• versee persons subject to the Brazilian General Data Protection Law, and enforce penalties for data

protection violations.

Chile

Ministry Announces Cybersecurity Campaign On December 28, 2018, the Ministry of the Interior and Public Security (Ministerio del Interior y Seguridad Publica) announced a cybersecurity campaign to promote protection of individuals' rights in digital environments (source document in Spanish). As part of the campaign, the Ministry issued recommendations for safely navigating the internet, posting on social networks, and using online security

• settings. The Ministry also issued guidance regarding the sharing of personal information online (source

document in Spanish).

Costa Rica

Costa Rica Hosts the Ibero­American Meeting of Data Protection On December 4, 2018, the Inhabitants Data Protection Agency (Agencia de Protección de Datos de los Habitantes, or "PRODHAB") issued an official communication stating that Costa Rica hosted the sixth Ibero ­American Data Protection Meeting (Encuentro Iberoamericano de Protección de Datos) (source document in Spanish). Experts across the Latin American region came together to discuss actions to protect the security and privacy of personal data. The government's announcement highlighted the takeaways from the meeting, including the need create a data protection culture, update compliance models, and invest in privacy.

Mexico

Data Protection Agency Resolves More Than 10,000 Appeals in 2018 On December 30, 2018, the National Institute for Transparency, Access to Information, and Personal Data Protection (Instituto Nacional de Acceso a la Información y Protección de Datos Personales) announced that, between January and November 2018, it had resolved 10,745 appeals related to data protection and access to information (source document in Spanish). Among these appeals, 9,485 (approximately 88%) related to the right to access information, and 1,260 (approximately 12%) related to personal data protection. Data Protection Agency Hosts International Personal Data Protection Day On January 28, the Instituto Nacional de Acceso a la Información y Protección de Datos Personales hosted the International Personal Data Protection Day to discuss significant and controversial issues regarding personal data (source document in Spanish). The topics of discussion included: (i) the personal data protection rights of legal entities and (ii) the legal requirement to obtain a judicial order to use geolocation services to locate possible criminals in Mexico.

Peru

Peru Fines Entities More Than US$230M in 2018 for Privacy Violations On January 1, the Peruvian National Authority of Data Protection (Autoridad Nacional de Protección de Datos) announced that it fined several public and private entities throughout 2018 for violations of the Peruvian Data Privacy Law (source document in Spanish). Peruvian authorities found that these entities should have implemented security measures for the protection of personal data, such as security protocols for access, privileged data management, and periodic review of privileges, among other

measures.

Uruguay

Agency Modifies Data Protection Law On January 28, the Regulatory and Personal Data Control Unit (Unidad Reguladora y de Control de Datos Personales) announced modifications to the Law of Accountability N°19.670 (Ley de Rendición de Cuentas N°19.670) (source documents in Spanish). These modifications include extending the law's application to the processing of personal data outside of Uruguayan territory in certain circumstances, requiring that entities provide notice of security breaches to data owners and implement remediation steps, and requiring entities that process personal data on a regular basis to designate a data protection official. The following Jones Day lawyers contributed to this section: Guillermo Larrea, Daniel D'Agostini, and Juan Carlos Quinzaños. [Return to Top]

Europe

European Council

European Council Publishes New Electronic Communications Code On December 4, 2018, the European Council adopted the European Electronic Communication Code ("EEOC"), which it published in the Official Journal on December 17, 2018. The EEOC expands the ePrivacy Directive to regulate over­the­top (or OTT) communications services, such as instant messages and email, and to promote the rollout of high­capacity networks, such as 5G and fiber networks. Each EU member state has two years to enact national implementing legislation for the EEOC.

European Court of Justice

Advocate General Makes Recommendation in Case Involving Third­Party Plugin On December 19, 2018, Advocate General Bobek recommended to the European Court of Justice ("ECJ") that when a website operator embeds a third­party plugin into its website that collects and transmits a user's personal data, both the website operator and the third party should be considered joint controllers. This recommendation is limited to circumstances in which both parties co­determine the means and processing of data, but not preceding or subsequent stages of processing. The Advocate General made this recommendation in the context of a case before the ECJ involving a fashion company that embedded

• n its website a "Like" button from a third­party social media platform.

Advocate General Makes Recommendation on De­Referencing of Sensitive Data On January 10, Advocate General Szpunar recommended to the ECJ that when the operator of a search engine receives a request to de­reference links displaying sensitive data, the operator must accede to the request as a matter of course. If the issue of the derogation of freedom of expression arises, the Advocate General recommends that the operator balance data protection and respect for private life with the right of the public to access the information and the right to freedom of expression. The Advocate General made this recommendation in the context of a case before the ECJ involving a request by individuals to de­reference a webpage that contained sensitive information and satirized government

• fficials.

Advocate General Recommends that "Right To Be Forgotten" Not Apply to Search Engines Beyond EU Borders On January 10, Advocate General Szpunar recommended that the ECJ limit the application of the "right to be forgotten" to the territory of the European Union. The Advocate General recommended that a search engine operator responding to a request for de­referencing should not be required to de­reference search results on domains outside of EU borders, although he did not rule out the possibility that there may be some circumstances where de­referencing should occur at a worldwide level. The Advocate General also recommended that search engines must implement all possible measures, including geo­blocking, to enforce effective de­referencing for all IP addresses located in the European Union, regardless of the

• domain. The Advocate General made this recommendation in the context of a case before the ECJ

involving a search engine operator that refused to comply with a demand by the French Data Protection Authority to conduct de­referencing on all of its domain name extensions regardless of location.

European Parliament

EU Negotiators Reach Agreement on Cybersecurity Act On December 10, 2018, the European Parliament, the EU Council, and the European Commission reached a political agreement on the Cybersecurity Act, which was first introduced by the European Commission

• n September 13, 2017. The agreement creates the first EU­wide certification scheme to ensure that

products and services sold in EU countries meet certain cybersecurity standards. The agreement also upgrades the European Union Agency for Network and Information and Security ("ENISA") with a permanent grant to coordinate responses to cybersecurity attacks among EU member states and assist EU institutions in developing cybersecurity policies. The new regulation must be formally approved by the European Parliament and the Council of the European Union.

European Data Protection Board

EDPB Adopts Revised Guidelines on Accreditation On December 4, 2018, the European Data Protection Board ("EDPB") adopted revised guidelines on accreditation of certification bodies under Article 43 of the GDPR, including a new annex. The document provides guidance on how to interpret and implement Article 43, which requires member states to ensure that certification bodies, which issue certification under Article 42(1) of the GDPR, are accredited by either

• r both the competent supervisory authority or the national accreditation body. The annex will be subject

to public consultation. EDPB Adopts Opinion on EU­Japan Draft Adequacy Decision On December 5, 2018, the EDPB published an opinion regarding the European Commission's draft decision on the adequate protection of personal data by Japan. The EDPB noted the areas of convergence between the legal frameworks of each region but noted several remaining concerns, such as monitoring of compliance, the need to protect personal data transferred from the European Union to Japan throughout the entire data lifecycle, and access by public authorities to data transferred to Japan.

Belgium

Belgian DPA Publishes GDPR Activity Review On November 23, 2018, the Belgian Data Protection Authority ("DPA") published a six­month review of its activities since the GDPR came into effect on May 25, 2018 (source document in French and in Dutch). The review assesses the impact of the GDPR, including the structural changes made to the former Belgian Privacy Commission to accommodate increased demand. Since the GDPR took effect, the Belgian DPA has received 317 reports of data breaches, 3,599 requests for information, and 148 complaints. Belgium Adopts Law Reforming Belgian Privacy Commission On January 10, the Law of December 3, 2017, creating the Data Protection Authority, was published in the Belgian Official Gazette (source documents in French and in Dutch). The law aims at reforming the Belgian Privacy Commission, originally established by the Law of December 8, 1992, implementing Directive 95/46/EC, and replaces the Belgian Privacy Commission with the Belgian DPA. The main purpose of the new law is to provide the Belgian DPA with more powers to fulfill its tasks under the GDPR. Belgian DPA Publishes Prior Consultation Form in Context of DPIAs In January, the Belgian DPA published a form to be completed for prior consultation in the context of a data protection impact assessment ("DPIA") under Article 35 of the GDPR (source document in French and in Dutch). The form includes questions regarding details of the processing activity and how to manage risks associated with the processing activity. Belgian DPA Issues Legal Note Defining Roles of Controllers and Processors In January, the Belgian DPA published guidance on the role of a data controller versus data processor (source documents in French and Dutch). The guidance sets out the basic principles, definitions, and criteria to help entities identify their status as a controller or processor, as well as the data protection responsibilities of entities in each role.

France

CNIL Warns about Privacy Risks from Internet­Connected Toys On December 3, 2018, the French Data Protection Authority ("CNIL") published an article about the privacy risks that can arise from the use of internet­connected toys (source document in French). The CNIL warned about the types of data processing activities that may be carried out through internet­ connected toys, such as targeted advertising directed to children. The CNIL provided guidance to customers on how to secure these toys. CNIL Issues Guidance on Consent to Data Sharing On December 28, 2018, the CNIL published guidance on the sharing of personal data with business partners (source document in French). The CNIL stated that companies must inform data subjects of the identity of their business partners and obtain consent before sharing any personal data with their

• partners. The recipient of the personal data must obtain new consent from the data subject before sharing

it with additional business partners. CNIL Publishes Booklet on Digital Interfaces On January 18, the CNIL's Digital Innovation Laboratory published its sixth booklet regarding best practices for the design of a digital service interface, which should incorporate privacy designs (source document in French). CNIL Fines Internet Search Engine €50 Million On January 21, the CNIL fined an internet search engine company up to €50 million after investigating data privacy complaints from two associations representing about 10,000 persons (source document in French). The CNIL conducted an investigation of the complaints and found two violations: the company did not provide adequate notice to users and did not have a valid legal basis to process users' personal data for targeted advertising. CNIL Releases Guidelines for Social Workers On January 23, the CNIL published guidelines for social workers who assist individuals in their use of

• nline public services (source document in French). The CNIL stressed that social workers who have

access to individuals' personal data while assisting them should: (i) request only information that is strictly necessary for use of the online public services; (ii) urge the individuals to delete any navigation history when disconnecting; (iii) not keep any information relating to such individuals; and (iv) request a written authorization prior to carrying out any formality on behalf of the individual.

Germany

Bavarian DPA to Investigate Deletion Concepts by Enterprises Using SAP Systems In December 2018, the Data Protection Authority of Bavaria for the Private Sector ("BayLDA") announced that it will investigate larger enterprises using SAP Enterprise­Resource­Planning systems with respect to their deletion routines. The audits will focus on GDPR compliance and timely deletion of personal data. BayLDA has not yet published selection criteria for the enterprises to be audited.

Italy

Italian DPA Verifies that Codes of Conduct Comply with GDPR On December 24, 2018, the Italian DPA verified that Codes of Conduct issued under the pre­GDPR regime for newspaper activity, scientific and statistic research activity, and defensive investigations are consistent with the GDPR (source document in Italian). The provisions contained in the Codes of Conduct, as revised by the Italian DPA, were published in the Italian Official Gazette in January 2019 and supplement the conditions for lawful processing set forth under the GDPR and the Harmonization Decree No. 101/2018. Italian DPA Starts Public Consultation on General Authorizations for Processing of Sensitive Data In December 2018, the Italian DPA identified five provisions under the pre­GDPR regime for the processing of sensitive data that are compatible with the GDPR (source document in Italian). These provisions include the processing of sensitive data in the employment context, for scientific research purposes, and in other circumstances. On January 11, 2019, the DPA made these provisions available for public consultation to gather comments, observations, and proposals from all interested subjects before

their final approval.

The Netherlands

DDPA Limits WiFi Tracking to Exceptional Circumstances On November 30, 2018, the DDPA announced that companies may track people on the street, in shopping centers, or in stations via WiFi tracking or other means on their mobile devices in only a few circumstances and under strict conditions (source document in Dutch). The DDPA published a Q&A on this subject on its website. DDPA Clarifies "Large­Scale" Processing for Health Care Providers On December 11, 2018, the DDPA explained that it considers all processing of personal data by hospitals, doctors, and care groups to be processing of personal data on a "large scale" (source document in Dutch). All other health care providers are considered to engage in large­scale processing of personal data if they process data of more than 10,000 patients in one information system. Banks and Insurance Companies Meet DPO Obligations After DDPA Audit On January 14, the DDPA completed its audit of banks and insurance companies and determined that all 45 banks and 93 insurance companies have registered a data protection officer ("DPO") with the DDPA and published contact information for their DPO on their websites (source document in Dutch).

Spain

Spain Approves National Law Implementing GDPR On December 5, 2018, Spain's Parliament approved the Organic Law 3/2018 for the Protection of Personal Data and the Guarantee of Digital Rights ("LOPDGDD"), which implements the GDPR in Spain. The LOPDGDD creates rules for notifying citizens about the processing of their personal data, sets the age of consent at 14 years old, provides for the right to be forgotten on social networks or similar services, and updates the right to privacy against the use of video surveillance and sound recording in the workplace. SDPA Publishes Data Protection Officers Registry On December 11, 2018, the Spanish Data Protection Agency ("SDPA") published the registry of DPOs. The registry contains the contact data of nearly 20,000 entities, of which approximately 3,000 correspond to the public sector and the rest to the private sector. Citizens who want to exercise their rights can find contact details of the DPO on the registry by searching by the company name or tax identification number. SDPA Publishes Report on Processing of Personal Data Related to Political Opinions On December 19, 2018, the SDPA published a report analyzing the processing by political parties of personal data related to political opinions. The report states that political parties, federations, coalitions, and constituencies can process political opinions only when they have been freely expressed by people in the exercise of their right to freedom of expression and their ideological freedom. The report also states that the processing must be proportional to the objective.

United Kingdom

Survey Shows Increase in Data Subject Access Requests to Medical Providers On December 14, 2018, the British Medical Association released the results of an online survey showing a more than 30 percent increase in the number of subject access requests that UK doctors are receiving each month from patients or their representatives after implementation of the GDPR. Though doctors previously were allowed to charge a reasonable fee to cover the administrative costs of completing subject access requests, the GDPR now requires that these be free of charge unless the request is "manifestly unfounded" or "excessive." The survey also found that, on average, more than three­quarters

• f requests were made by companies acting on behalf of patients, such as solicitors, compared to 22

percent made by patients themselves. Government Appoints Chair of New Geospatial Commission On December 19, 2018, Sir Andrew Dilnot was appointed Chair of the UK Government's new Geospatial

• Commission. The Commission was established in 2018 to set geospatial strategy, policy, and data

standards and encourage more productive use of location­linked data. Unlike the independent Information

Commissioner's Office, the Geospatial Commission is part of the UK Government and sits within the Cabinet Office, the governmental body responsible for coordinating government policy. The following Jones Day lawyers contributed to this section: Laurent De Muyter, Undine von Diemar, Olivier Haas, Jörg Hladjk, Levent Herguner, Bastiaan Kout, Jonathon Little, Martin Lotz, Hatziri Minaudier, Selma Olthof, Audrey Paquet, Sara Rizzon, Irene Robledo, Elizabeth Robertson, Lucia Stoican, Rhys Thomas, and Kerianne Tobitsch. [Return to Top]

Asia

Hong Kong

Privacy Commissioner Receives Notification of Data Breach On November 28, 2018, Hong Kong's Privacy Commissioner for Personal Data ("Privacy Commissioner") received a data breach notification from a consumer credit reporting agency regarding suspected security loopholes in its application procedures for credit reports. The Privacy Commissioner initiated a compliance check, and the company took immediate remedial actions to mitigate any possible losses, including freezing the affected online accounts and notifying affected individuals. Privacy Commissioner Releases Inspection Report on Private Tutorial Services Industry On December 28, 2018, the Privacy Commissioner released a report with the results of its inspections of the personal data systems of companies in the private tutorial services industry. While the Commissioner found that personal data protection measures are generally acceptable in the industry, there are still some inadequacies, such as unnecessary or excessive collection of personal data, indefinite data retention, improper use of personal data, and inadequate personal data security.

Japan

European Commission Adopts Adequacy Decision on Japan On January 23, the European Commission adopted its adequacy decision on Japan, which allows personal data to flow freely under adequate data protection guarantees between the two regions. The decision includes a set of rules that will bridge several differences between the two data protection systems and a complaint mechanism for Europeans regarding access to their data by Japanese public authorities. The decision went into effect on the day of adoption.

People's Republic of China

Committee Releases National Standard for Health Information On December 26, 2018, the National Information Security Standardization Technical Committee released a national standard for the handling of health information called "Information Security Technology Health and Medical Information Security Guide" ("Standard") (source document in Chinese). The Standard defines "personal health information" and requires controllers to obtain authorization from the individuals when using or disclosing their personal health information. The Standard provides measures that controllers can implement to protect personal health information, including employee training and assessment, data system management, data categorization, access control, user restrictions, and encryption. Cyberspace Administration Approves New Rules for Blockchain Service Providers On January 10, the Cyberspace Administration of China approved new rules for blockchain service providers called the "Provisions on the Administration of Blockchain Information Services," which will take effect on February 15 (source document in Chinese). The Provisions require blockchain service providers to register with the Cyberspace Administration of China and be subject to regular monitoring. Blockchain service providers must implement comprehensive measures, such as user registration and identity verification, and report to the government any new products, applications, or functions before launching them. Government to Inspect Data Collection through Mobile Applications On January 25, four government agencies announced a campaign to inspect mobile applications that

Follow us on:

Jones Day is a legal institution with more than 2,500 lawyers on five continents. One Firm WorldwideSM.

• btain personal information (source documents in Chinese). Between January and December, the

government will inspect mobile applications to ensure that they comply with cybersecurity laws when collecting or processing personal information. The campaign will evaluate data privacy policies on the applications and the type and amount of personal information collected through the applications. The campaign will focus on applications that have a large number of users or are closely related to users' daily

• life. Applications that pass the inspection will receive verification certificates, while those that fail will be

referred to law enforcement.

Singapore

IMDA Launches Data Protection Trustmark Certification On January 9, the Infocomm Media Development Authority ("IMDA") announced that its Data Protection Trustmark ("DPTM") certification was available for applicants. DPTM is a voluntary enterprise­wide certification of a company's data protection policies, processes, and accountability practices that is meant to help companies build trust with consumers by demonstrating accountable data protection practices. The certification is valid for three years. The following Jones Day lawyers contributed to this section: Michiru Takahashi, Sharon Yiu, and Grace Zhang. [Return to Top]

Australia

New Legislation Provides Law Enforcement Access to Communications On December 6, 2018, Parliament passed the Telecommunications and Other Legislation (Assistance and Access) Act 2018. The Act amended existing legislation to require designated communications providers to grant access to communications on their platforms when requested by law enforcement agencies investigating serious offenses that are punishable by a term of imprisonment of three years or more. The Australian Federal Government has agreed to consider amendments to the Act proposed by the Opposition Labour Party and industry groups in the new legislative session, so the Act may be amended in the short term. Federal Government Introduces Consumer Data Rights Legislation On January 13, the Australian Federal Government introduced legislation to Parliament that would establish the Consumer Data Right ("CDR"). The CDR would allow consumers to access data held by businesses about their consumption of goods and services, and would allow consumers to obtain the data directly from businesses in a standard format. If the Australian Parliament passes the legislation, the CDR will apply to the banking sector incrementally starting on July 1, 2019. The following Jones Day lawyers contributed to this section: Adam Salter and Drew Broadfoot. [Return to Top]

Upcoming Events

Jones Day Hosts Fourth Annual Latin America Privacy & Cybersecurity Symposium On May 16­17, Jones Day will host its Fourth Annual Latin America Privacy & Cybersecurity Symposium, bringing together privacy professionals, data protection agencies, and policymakers to discuss new legal

• bligations and trends in cybersecurity and data privacy in the region. The Symposium will address

Brazil’s new General Data Protection Law, compliance obligations and best practices for companies in the region, and privacy and security issues related to data­driven initiatives, including fintech, artificial intelligence, and blockchain. [Return to Top]

Jones Day's publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any

• ther publication or proceeding without the prior written consent of the Firm, to be given or withheld at our
• discretion. To request reprint permission for any of our publications, please use our "Contact Us" form, which

can be found on our website at www.jonesday.com/contactus. The electronic mailing/distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney­client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.