Comparison Of Requirements Under The Privacy Shield/Safe Harbor Principles

Scott L. Vernick was quoted in The Legal Intelligencer article, "Did UPMC Data Breach Ruling Lock Plaintiffs Out of State Court?" on January 23, 2017.

California Governor Newsom has signed Senate Bill 574 into law, establishing the nation's first statutory framework governing how attorneys and arbitrators use generative AI in their professional practice. The legislation creates specific obligations around confidentiality protection, accuracy verification, and disclosure requirements that take effect January 1, 2027.

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

Meta Platforms has agreed to pay $17 billion over ten years to resolve multistate litigation alleging the company engineered Facebook and Instagram to addict minors while concealing the risks. Beyond the historic financial penalty, the settlement mandates sweeping platform changes including default usage limits, overnight lockouts, and parental controls for users under eighteen.

On September 15, the Federal Trade Commission ("FTC") issued a policy statement ("Statement") addressing the scope of its Health Breach Notification Rule ("Rule") on health apps and connected devices.

Multiple organizations have recently disclosed significant data breaches affecting thousands of individuals, with compromised information ranging from basic contact details to highly sensitive medical records and financial data. The incidents span various sectors including healthcare, insurance, and professional services, raising questions about the scope of exposure and potential remedies for affected individuals.

California's legislature has sent a comprehensive package of privacy, AI, and advertising bills to Governor Newsom's desk, with decisions due by September 30, 2026. The legislation addresses sensitive personal information protections, data broker obligations, AI-powered chatbot regulations, and digital replica rights, potentially reshaping how businesses handle consumer data and automated decision-making systems. Will these bills become law and set new national standards for technology regulation?

Federal and state regulators are intensifying scrutiny of healthcare and digital health companies over tracking technologies that share sensitive patient data with advertising platforms. Recent enforcement actions against major telehealth providers and healthcare systems reveal how common marketing practices can trigger significant legal liability under privacy laws, even for organizations not covered by HIPAA.

The USPTO has released its latest economic impact report on IP-intensive industries, announced a new community engagement office in North Carolina, and issued several administrative updates including relief for Japanese applicants affected by a severe earthquake. The Patent Trial and Appeal Board has also designated new precedential and informative decisions addressing obviousness-type double patenting and Markush groupings.

The SEC has proposed a comprehensive overhaul of transfer agent regulations that would formally recognize distributed ledger technology and blockchain-based recordkeeping systems within the existing regulatory framework. This modernization effort imposes enhanced operational, safeguarding, and compliance obligations while establishing technology-neutral standards that could significantly impact tokenization initiatives and digital asset market infrastructure.

California's Air Resources Board has released significant modifications to its greenhouse gas emissions reporting regulation, deferring the first reporting deadline to November 10, 2026, and clarifying key requirements for companies doing business in California with over $1 billion in annual revenue. The updates provide additional flexibility for 2026 reporting while enforcement of the Climate-Related Financial Risk Act remains paused pending federal litigation.

The US International Trade Commission has opened a rare public comment period on how it should fulfill its data collection and reporting obligations under Section 338 of the Tariff Act of 1930, a long-dormant authority recently invoked by the Trump Administration to impose restrictions on Canadian imports. This presents a unique opportunity for companies and stakeholders to shape from the ground up how the Commission interprets discriminatory foreign trade practices, evaluates allegations, and reports findi

The sports and gaming industries are evolving faster than existing legal frameworks can accommodate, creating unprecedented jurisdictional battles, regulatory shifts, and commercial opportunities. From the escalating fight over prediction markets between federal regulators and states to the emergence of responsible gaming as a standalone policy priority, the first half of 2026 has reshaped the legal landscape governing these sectors while raising fundamental questions about innovation, consumer protection

As discussed in previous client alerts, the rapid growth of artificial intelligence (AI), cloud computing, and digital services has dramatically increased demand for data centers.

Washington Attorney General Nick Brown released the state's first Data Privacy Report, examining how the modern data economy incentivizes personal information collection and retention. The report catalogs resulting harms and recommends that lawmakers strengthen privacy protections, enforcement, and public education while highlighting Washington's continued lack of a comprehensive consumer privacy statute despite inspiring other states' privacy laws.

As investment in data center infrastructure accelerates globally, disputes are emerging from contractual and investment-related risks that commonly accompany large-scale infrastructure projects. This analysis examines the growing wave of contractual claims among owners, contractors, and subcontractors, as well as investment treaty claims that may arise when governmental actions impact overseas data center developments.

The US Department of Justice has signaled a potential expansion of enforcement under the Foreign Agents Registration Act (FARA) and Section 951, despite earlier indications of limited criminal enforcement. Recent regulatory developments, policy announcements, and high-profile prosecutions of US officials suggest a renewed focus on foreign agent disclosure requirements and potential criminal liability for undisclosed relationships with foreign governments.

The U.S. Department of Justice has announced three major settlements totaling over $558 million against healthcare providers partnering with Medicare Advantage plans for allegedly submitting false diagnosis codes. These enforcement actions reveal DOJ's intensified scrutiny of risk-sharing payment arrangements between Medicare Advantage plans and healthcare providers, while demonstrating the significant benefits that self-disclosure and cooperation can provide to companies facing potential False Claims Act l