This year, new data privacy laws will go into effect in California, Colorado and Virginia, with more states expected to follow this legislative trend. As businesses grapple with a myriad of compliance issues relating to these new laws, one requirement that many tend to underestimate is the creation of an external-facing privacy policy. In fact, some companies may be tempted to simply copy another’s policy, upload it to their websites, and call it a day.

Bolstering the protections afforded under the California Consumer Privacy Act (as amended by the California Privacy Rights Act, the CCPA), California has enacted the California Age-Appropriate Design Code Act (AADC), which expands the scope of online privacy protections for children under 18. The AADC will take effect on July 1, 2024 and apply to CCPA-regulated businesses. As such, those businesses are encouraged to begin conducting impact assessments now in light of the possibility that material design changes may be necessitated by the AADC.

Outside GC Partners Lakshmi Sarma Ramani and Anita Drummond have co-authored a new article for the ACC Docket's Non-Profit Knowledge column, in which they review the Colorado Privacy Act and its applicability to non-profit organizations. 

As we reported last year, the invalidation of the EU-U.S. Privacy Shield on July 16, 2020 is forcing the hand of U.S. companies which access the personal data of EU residents to find a new, lawful mechanism by which to do so in accordance with EU data protection laws. One such alternative – the use of the EU’s standard contractual clauses (SCCs) (a/k/a “Model Clauses”) – was recently bolstered by much-needed proposed updates to the clauses themselves.

Enforcement of the California Consumer Protection Act (CCPA), which went into effect on January 1, 2020, officially started on July 1st. But instead of feeling prepared, many companies are still grappling with how this legislation will impact their operations. In fact, the CCPA has been widely regarded as “unfinished business” since its expedited passage in 2018.

After years of uncertainty, the fate of the EU-U.S. Privacy Shield (“Shield”) has finally been determined. On July 16^th, the EU’s highest court, the Court of Justice of the European Union (CJEU), declared the Shield to be invalid as a lawful mechanism for transferring the personal data of EU residents to the U.S.