Privacy Law Recap 2024: Data Security

Continued cyberthreats drove expanded data security and breach notification requirements in 2024.

Although sectors deemed high-risk saw significant activity, we also saw proposed regulations that stand to have a significant impact on a wide swath of private companies in the year to come. The highlights include:

• Enhanced sectoral regulations. On the federal front, the Federal Trade Commission (FTC), U.S. Securities and Exchange Commission (SEC), and Federal Communications Commission (FCC) all expanded regulations that apply to companies within specialized sectors or with respect to particular types of data in their jurisdiction. The FTC's sweeping breach notification requirements applying to nonbank financial institutions went into effect in May, shortly after the FTC finalized revisions to the Health Breach Notification Rule that applies to companies working with health records that are not otherwise regulated by HIPAA. The SEC revised Regulation S-P in May to