Last week, the Eighth Circuit Court of Appeals rejected the district court’s approval of the class action settlement in the Target data breach litigation. See In re Target Corp. Customer Data Sec. Breach Litig., 2017 U.S. App. Lexis 1767 (8th Cir. Feb. 1 2017).
Two decisions last week further widened the divide among the Courts of Appeals in applying Spokeo in cybersecurity litigation.
The U.S. Computer Emergency Readiness Team (US-CERT) is implementing new reporting requirements beginning April 1, 2017, and just released new guidelines to help federal departments and agencies; state, local, tribal, and territorial government entities; information sharing and analysis organizations; and foreign, commercial and private-sector organizations submit incident notifications to the federal government.
Two Courts of Appeals have issued decisions during the past week related to cybersecurity and data retention which anyone who maintains electronic data and personal information should read.
As we recently touched on at the KMK Cybersecurity Seminar, lower courts are beginning to apply Spokeo Inc. v. Robins as defendants renew challenges to class certification.
This post is a follow-up to January’s cybersecurity post discussing the cybersecurity considerations in performing due diligence in M&A transactions. The previous discussion can be found here. This post addresses two contractual provisions, the closing conditions and indemnification, which, if properly utilized, can protect acquiring companies from taking on too much cybersecurity risk in M&A transactions.
The Cybersecurity Information Sharing Act (CISA), S. 754, was signed into law by President Obama on December 18, 2015 as part of the larger 2016 Omnibus Spending Bill, and arrived on the cybersecurity landscape with an equally strong set of supporters and opponents. With strong views on both sides, CISA is the first step in building what all will likely agree is of critical importance – improving cybersecurity in the United States.
In today’s M&A transactions, cybersecurity deficiencies in a target company pose potentially significant financial and regulatory risks to the acquiring company. For this reason, new measures must be implemented in M&A transactions to protect both companies from today’s emerging cybersecurity epidemic.
Recently, the European Union Court of Justice invalidated a Safe Harbor Framework (established in 2000), which thousands of companies relied upon to facilitate the transfer, processing and storage of data from the EU to the U.S. Any company that processes and stores data from the EU, including customer and employee personal data, should be reviewing its contracts and procedures and monitoring these developments.
In a case that will have significant ramifications for the legal landscape relating to cybersecurity, the Third Circuit Court of Appeals affirmed a lower court’s decision that the Federal Trade Commission (FTC) had the authority to regulate companies’ data security practices.
This blog is devoted to cybersecurity and privacy related issues. Our interdisciplinary group of attorneys with corporate, insurance coverage/risk prevention, information governance, labor & employment, HIPAA, employee benefits, and litigation experience, will discuss best practices for protecting your organization against data breaches and cyber attacks as well as recent developments in litigation and federal and state regulations.
- Information Governance
- Incident Response Plan
- Corporate Law
- Mergers & Acquisitions
- Federal Trade Commission
- Cybersecurity Regulation
- Seventh Circuit
- Class Action Litigation
- Department of Justice
- Data Breach
- Cybersecurity and Privacy Law
- Cyber Insurance
- Target Class Action Settlement Temporarily Upended
- Spokeo Continues to Divide the Lower Courts in Cybersecurity Litigation
- Cyber Breach Incident Notification Guidelines Ahead
- CyberSecurity News: Spokeo, Galaria and Braitberg
- Privacy Class Action Dismissed Under Spokeo
- Cybersecurity Issues in M&A Transactions – Part II
- CISA Makes Its Debut in 2016
- Cybersecurity Issues in M&A Due Diligence
- Recent Ruling Changes How Companies Should Process or Store Data From EU
- Federal Trade Commission’s Position As Cybersecurity Regulator Is Confirmed
Other KMK Blogs
- KMK Law Complex Litigation Blog
- KMK Law Corporate & Securities Blog
- KMK Law Cybersecurity & Privacy Blog
- KMK Law Electronic Discovery Road Map Blog
- KMK Law Management Rights Blog
- KMK Law Real Estate Blog
- KMK Law Intellectual Property Blog