Privacy & Cybersecurity Update May 2019

California Governor Newsom has signed Senate Bill 574 into law, establishing the nation's first statutory framework governing how attorneys and arbitrators use generative AI in their professional practice. The legislation creates specific obligations around confidentiality protection, accuracy verification, and disclosure requirements that take effect January 1, 2027.

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.

Connecticut’s Governor has signed into law Public Act No. 26-64, “An Act Concerning Consumer Privacy and Protection,” which introduces substantial new compliance obligations for businesses that operate as data brokers...

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...

Scott L. Vernick was quoted in The Legal Intelligencer article, "Did UPMC Data Breach Ruling Lock Plaintiffs Out of State Court?" on January 23, 2017.

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?

Legal risk intensifies for companies offering online interactive features to minors across Georgia, Florida, and Alabama as the Eleventh Circuit vacates preliminary injunctions against state social media laws. With Florida's HB 3 and Georgia's SB 351 now enforceable and Alabama's HB 161 set to take effect January 1, 2027, businesses face divergent compliance requirements including age verification, parental consent mechanisms, and account deletion protocols.

In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.

California is poised to enact a one-stop global deletion request option that all "data brokers" operating in the State would be required to follow.

Four states have adopted laws regulating data brokers, but only one – California – has established a universal deletion mechanism whereby consumers are able to request that all data brokers...

New York City has enacted the nation's first municipal click-to-cancel rule, requiring businesses to provide clear disclosures, simple cancellation processes, and advance renewal notices for subscription services. With approximately 30 states already implementing similar regulations and the federal landscape in flux following the FTC's vacated rule, companies now face an increasingly complex patchwork of compliance obligations. The rule takes effect October 1, 2026, and imposes penalties ranging from $525 t

California has enacted SB 1050, a groundbreaking law requiring clear disclosure when AI-generated synthetic performers appear prominently in advertisements. The legislation, which takes effect January 1, 2027, aims to protect consumers from being misled by artificial intelligence-created digital figures and voices while establishing enforcement mechanisms through existing false advertising statutes.

The U.S. government has dramatically expanded Iran-related sanctions through new sectoral determinations, entity designations, and the suspension of key authorizations, while simultaneously targeting third-country financial institutions that facilitate Iranian transactions. These measures significantly broaden secondary sanctions risks across aviation, digital assets, gold, shipping, and technology sectors, marking a comprehensive escalation in economic pressure against Iran and its international networks.

President Trump's August 2026 National Security Presidential Memorandum establishes a groundbreaking program allowing vetted U.S. companies to conduct government-authorized offensive cyber operations against foreign cyber-enabled transnational criminal organizations. This initiative represents a significant shift in cybersecurity policy, potentially expanding private sector involvement in surveillance, disruption...

The U.S. Office of the Comptroller of the Currency and the FDIC have issued a joint final rule redefining "unsafe or unsound practice" and establishing new standards for matters requiring attention (MRAs) in bank supervision. How will these changes, which prioritize material financial risk over procedural deficiencies, reshape the regulatory landscape for financial institutions when they take effect in November 2026?

The Centers for Medicare and Medicaid Services has published a final rule establishing the GLOBE Model, implementing most-favored-nation pricing for Medicare Part B drugs with dramatically expanded exemptions. Pharmaceutical companies face potential rebate obligations under this mandatory payment model, though the rule's narrowed scope and GENEROUS Model carve-out significantly limit its reach compared to the original proposal.

This edition focuses on rulings issued between February 16, 2018, and June 15, 2018.

The Supreme Court's decision in National Republican Senatorial Committee v. FEC has fundamentally altered the landscape of political party spending by eliminating federal limits on coordinated expenditures between parties and candidates. This ruling preserves existing campaign finance guardrails while potentially reshaping the power dynamics of party committees, joint fundraising operations, and various political action committees.

Rules requiring material agreements to be filed as exhibits to reports and registration statements with the Securities and Exchange Commission (SEC)

Japan and the European Union recently announced an agreement to recognize each other's data protection regimes as adequate.