Gov. Andrew Cuomo’s recently released 2022 budget includes a proposal for a comprehensive data privacy bill, and with Democratic supermajorities in both houses of the state Legislature for the first time in history, it is likely that New York may soon have a comprehensive data privacy law that rivals the California Consumer Protection Act and the newly enacted California Privacy Rights and Enforcement Act.
This focus on data protection is not new in New York — the state recently enacted the Stop Hacks and Improve Electronic Data Security, or SHIELD, Act, an update to the state data breach notification law, and the New York Department of Financial Services, or NYDFS, has increased pressure on companies regarding data security.
The continuing shift in data privacy and data security law is set to have a significant impact on businesses’ compliance efforts and operational risk, as well as on the expectations of consumers. Below we discuss what businesses can do to prepare.
Originally published by Law360 on January 29, 2021.
Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, any member of the firm’s Privacy, Cybersecurity and Consumer Protection practice group, or the following authors in New York:
Mylan L. Denerstein (+1 212-351-3850, mdenerstein@gibsondunn.com)
Alexander H. Southwell (+1 212-351-3981, asouthwell@gibsondunn.com)
Amanda M. Aycock (+1 212-351-2356, aaycock@gibsondunn.com)
© 2021 Gibson, Dunn & Crutcher LLP
Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.
Munich associate Marcus Geiss and of counsel Birgit Friedl are the authors of “German Corporate Law 2021: A New Dawn Beyond Covid-19, Protectionist Tendencies and the Wirecard Fall-Out,” [PDF] published by M&A Review on January 29, 2021.
Munich partner Lutz Englisch, of counsel Silke Beiter and associate Sonja Ruttmann and Frankfurt associate Stefanie Zirkel also contributed to the article.
Palo Alto partner Benjamin Wagner, of counsel Cassandra Gaedt-Sheckter and associate Iman Charania are the authors of “The Evolution of Privacy Enforcement in California: CPRA and the CA Attorney General’s Office,” [PDF] published by The Recorder on January 20, 2021.
Washington, D.C. partner M. Kendall Day and Los Angeles associate Chris Jones are the authors of “New federal anti-money laundering law could affect your company,” [PDF] published by the Daily Journal on January 20, 2021.
Palo Alto partner H. Mark Lyon and associate Cassandra L. Gaedt-Sheckter and Los Angeles associate Frances A. Waldmann are the authors of “United States: Artificial Intelligence,” [PDF] published in the Global Data Review Insight Handbook 2021 in December 2020.
Los Angeles partner Maurice Suh, of counsel Daniel Weiss and associate Zathrina Perez are the authors of “Supreme Court needs to rethink NCAA ‘amateurism’” [PDF] published by the Daily Journal on January 5, 2021.
Washington, D.C. counsel Roscoe Jones Jr., New York partner Joel Cohen, Washington, D.C. partner Michael Bopp, New York partner Arthur Long, Washington, D.C. partner Jeffrey Steiner, Washington, D.C. associate Samantha Ostrom, Orange County associate Maggie Zhang and San Francisco associate Alexandra Farmer are the authors of “Financial Policy in the Incoming Biden Administration: What Can We Expect?” [PDF] published by Wall Street Lawyer in its December 2020 issue.
San Francisco partner Ethan Dettmer and Washington, D.C. associates Suria Bahadue and Matthew Rozen are the authors of “Invalid appointments and the restoration of DACA,” [PDF] published by the Daily Journal on January 4, 2021.
New York partner Akiva Shapiro and associates Lee Crain and Amanda LeSavage are the authors of “Tips for District Court Amicus Brief Success,” [PDF] published by the New York Law Journal on December 23, 2020.
Brussels of counsel Alejandro Guerrero and London of counsel Sarah Wazen are the contributors to the “Belgium” chapter of the Data Protection & Privacy Laws feature published by Financier Worldwide in November 2020.
Paris partner Ahmed Baladi is the contributor to the “France” [PDF] chapter of the Data Protection & Privacy Laws feature published by Financier Worldwide in November 2020.
New York associate James Manzione is the author of “Real Estate Partnerships: The Basics and Some Technical Stuff,” [PDF] published by Tax Notes Federal on November 23, 2020.
Paris partner Pierre-Emmanuel Fender is the author of “Weathering the Covid-19 Crisis in France,” [PDF] published in the Europe, Middle East and Africa Review 2020 by Global Restructuring Review in December 2020.
New York partner Akiva Shapiro is the author of “Holocaust Survivors Deserve Their Day in Court,” [PDF] published by The Wall Street Journal on December 6, 2020.
New York partners Reed Brodsky and Avi Weitzman and associate David Salant are the authors of “Due Process Protections Act Sends a Message to the Government” [PDF] published by the New York Law Journal on December 2, 2020.
New York partner Alexander Southwell, Denver partner Ryan Bergsieker and Denver associate Sarah Erickson are the authors of “Where Data Privacy And CFPB Are Headed Under Biden,” [PDF] published by Law360 on November 24, 2020.
Californians have ushered in a law protecting individuals’ privacy unlike any other in the United States, and businesses are well-advised to evaluate its impact and prepare to comply. Proposition 24, which passed during this month’s vote, establishes the California Privacy Rights Act (CPRA), which will take effect Jan. 1, 2023. If this seems like déjà vu, it is because just two years ago, the California legislature passed an unprecedented privacy law, the California Consumer Privacy Act (CCPA), which the CPRA amends. The continuing shift in privacy law embodied by the CPRA is set to make a significant impact on businesses’ compliance efforts and operational risk, as well as individuals’ expectations.
Businesses should take comfort that the Jan. 1, 2023 effective date, and delayed enforcement start (July 1, 2023), means there is time to come into compliance. However, the law imposes various changes that will require businesses to address new considerations—even factoring in the efforts many already have made to comply with the CCPA.
Originally published by The Recorder on November 18, 2020.
The following Gibson Dunn lawyers assisted in the preparation of this article: Cassandra Gaedt-Sheckter, Alexander H. Southwell and Ryan Bergsieker.
Gibson Dunn’s lawyers are available to assist in addressing any questions you may have regarding these developments. Please contact the Gibson Dunn lawyer with whom you usually work, the authors, or any member of the firm’s California Consumer Privacy Act Task Force or its Privacy, Cybersecurity and Consumer Protection practice group:
California Consumer Privacy Act Task Force:
Benjamin B. Wagner – Palo Alto (+1 650-849-5395, bwagner@gibsondunn.com)
Ryan T. Bergsieker – Denver (+1 303-298-5774, rbergsieker@gibsondunn.com)
Cassandra L. Gaedt-Sheckter – Palo Alto (+1 650-849-5203, cgaedt-sheckter@gibsondunn.com)
Joshua A. Jessen – Orange County/Palo Alto (+1 949-451-4114/+1 650-849-5375, jjessen@gibsondunn.com)
H. Mark Lyon – Palo Alto (+1 650-849-5307, mlyon@gibsondunn.com)
Alexander H. Southwell – New York (+1 212-351-3981, asouthwell@gibsondunn.com)
Deborah L. Stein – Los Angeles (+1 213-229-7164, dstein@gibsondunn.com)
Eric D. Vandevelde – Los Angeles (+1 213-229-7186, evandevelde@gibsondunn.com)
Please also feel free to contact any member of the Privacy, Cybersecurity and Consumer Protection practice group:
United States
Alexander H. Southwell – Co-Chair, PCCP Practice, New York (+1 212-351-3981, asouthwell@gibsondunn.com)
Debra Wong Yang – Los Angeles (+1 213-229-7472, dwongyang@gibsondunn.com)
Matthew Benjamin – New York (+1 212-351-4079, mbenjamin@gibsondunn.com)
Ryan T. Bergsieker – Denver (+1 303-298-5774, rbergsieker@gibsondunn.com)
Howard S. Hogan – Washington, D.C. (+1 202-887-3640, hhogan@gibsondunn.com)
Joshua A. Jessen – Orange County/Palo Alto (+1 949-451-4114/+1 650-849-5375, jjessen@gibsondunn.com)
Kristin A. Linsley – San Francisco (+1 415-393-8395, klinsley@gibsondunn.com)
H. Mark Lyon – Palo Alto (+1 650-849-5307, mlyon@gibsondunn.com)
Karl G. Nelson – Dallas (+1 214-698-3203, knelson@gibsondunn.com)
Deborah L. Stein – Los Angeles (+1 213-229-7164, dstein@gibsondunn.com)
Eric D. Vandevelde – Los Angeles (+1 213-229-7186, evandevelde@gibsondunn.com)
Benjamin B. Wagner – Palo Alto (+1 650-849-5395, bwagner@gibsondunn.com)
Michael Li-Ming Wong – San Francisco/Palo Alto (+1 415-393-8333/+1 650-849-5393, mwong@gibsondunn.com)
Europe
Ahmed Baladi – Co-Chair, PCCP Practice, Paris (+33 (0)1 56 43 13 00, abaladi@gibsondunn.com)
James A. Cox – London (+44 (0)20 7071 4250, jacox@gibsondunn.com)
Patrick Doris – London (+44 (0)20 7071 4276, pdoris@gibsondunn.com)
Bernard Grinspan – Paris (+33 (0)1 56 43 13 00, bgrinspan@gibsondunn.com)
Penny Madden – London (+44 (0)20 7071 4226, pmadden@gibsondunn.com)
Michael Walther – Munich (+49 89 189 33-180, mwalther@gibsondunn.com)
Kai Gesing – Munich (+49 89 189 33-180, kgesing@gibsondunn.com)
Alejandro Guerrero – Brussels (+32 2 554 7218, aguerrero@gibsondunn.com)
Vera Lukic – Paris (+33 (0)1 56 43 13 00, vlukic@gibsondunn.com)
Sarah Wazen – London (+44 (0)20 7071 4203, swazen@gibsondunn.com)
Asia
Kelly Austin – Hong Kong (+852 2214 3788, kaustin@gibsondunn.com)
Connell O’Neill – Hong Kong (+852 2214 3812, co’neill@gibsondunn.com)
Jai S. Pathak – Singapore (+65 6507 3683, jpathak@gibsondunn.com)
© 2020 Gibson, Dunn & Crutcher LLP
Attorney Advertising: The enclosed materials have been prepared for general informational purposes only and are not intended as legal advice.
Los Angeles partner James L. Zelenay, Jr. and associate Jeremy S. Smith are the authors of “FCA update: Will the Supreme Court address materiality (again)?” [PDF] published by the Daily Journal on November 11, 2020.
San Francisco partner Brian M. Lutz and Orange County associate Colin B. Davis are the authors of “Chancery Court Ruling Confirms High Bar to Pleading a Nonexculpated ‘Revlon’ Claim” [PDF] published by Delaware Business Court Insider on November 11, 2020.
Singapore partner Robson Lee is the author of “Rising corporate failures and new Act on insolvency, restructuring and dissolution,” [PDF] published by NextInsight on November 7, 2020. He was assisted by Singapore associates Marcus Tan and Eliza Teo.