Today, we are all facing a public health crisis unlike any other we have seen in our lifetime. In addition to serious consequences to global health, the COVID-19 pandemic has created significant disruption in the legal system and privacy law initiatives have not been immune to the virus’s impact. With many state legislatures nearing or at the end of legislative sessions taken over by pandemic priorities, state privacy bill initiatives across the country are grinding to a halt. However, some lawmakers are pushing forward with targeted proposals to protect individual privacy in the face of COVID-19 and some states, particularly California, continue public and private efforts to bolster privacy in their jurisdiction. Below is a summary of the 2020 privacy legislative efforts to date and the impact COVID-19 has had on their progress. READ MORE
Privacy and cybersecurity underpins the innovative strategies of businesses across all sectors and introduces both legal and operational concerns. As a Managing Associate in Orrick's internationally recognized Cyber, Privacy & Data Innovation team, Nick Farnsworth advises clients on a broad range of privacy and cybersecurity matters, including compliance, risk management, government investigations and incident response.
Nick's practice focuses on guiding clients through the patchwork of state, federal and international privacy and cybersecurity laws. His practice includes advising clients on proposed and effective state privacy and cybersecurity laws, such as the California Consumer Privacy Act (CCPA), Section 5 of the Federal Trade Commission Act (FTC Act), biometric privacy laws, such as the Illinois Biometric Information Privacy Act (BIPA), the Children's Online Privacy Protection Act (COPPA), the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the Telephone Consumer Protection Act (TCPA), CAN-SPAM, and state breach notification laws. Nick also advises clients on the impact of international laws from a U.S. perspective, including the European Union General Data Protection Regulation (GDPR).
Nick assists clients from a broad range of industries and sectors in assessing their current privacy and cybersecurity practices. He regularly assists clients in developing global privacy and cybersecurity programs to practically implement the principles and obligations underlying various legal regimes, as well as assessing proposed marketing/advertising, product and business strategies from a privacy and cybersecurity perspective. Nick also advises clients on privacy and cybersecurity government investigations and the assessment of suspected incidents/breaches and any associated notification obligations, as well as the privacy and cybersecurity risks associated with proposed transactions and the development and deployment of advanced technologies, including adtech, artificial intelligence and machine learning, automated and connected vehicles, and biometric tools.
In addition, Nick has an active pro bono practice, which has included representing clients in immigration and innocence matters and assisting small businesses with their legal needs.
To make the California Consumer Privacy Act (CCPA) more accessible, Nick was a member of the team that developed Orrick's CCPA Readiness Assessment Tool. The tool provides companies an opportunity to test their preparedness for compliance with the CCPA as a first step to constructing their strategic compliance roadmap.
Prior to law school, Nick worked in the defense industry, which spurred his interest in innovative, cutting-edge technology and helps him better understand how to integrate legal solutions with business practicality in order to address the needs of his clients.
Posts by: Nicholas Farnsworth
On May 4, 2020, Californians for Consumer Privacy announced that it submitted over 900,000 signatures to qualify the California Privacy Rights Act of 2020 (“CPRA”) for California’s November 2020 ballot. With the California Consumer Privacy Act of 2018 (“CCPA”) set to become enforceable on July 1, 2020, this new ballot initiative has left many wondering what the CPRA is and whether the CPRA will become law. We explore these questions further below.
On Tuesday, Washington Governor Jay Inslee signed into law legal restrictions on the use of facial recognition by public agencies (SB 6280), while the Washington Legislature previously reached an impasse on the proposed Washington Privacy Act (SB 6281) due to a few big ticket items, particularly whether the Act would be enforceable via a private right of action for Washington residents. READ MORE
On March 11, 2020, the California Attorney General, Xavier Becerra, (“California AG”) released a second set of modifications to the proposed regulations pursuant to the California Consumer Privacy Act of 2018 (“CCPA”). These recent modifications reflect some minor changes and clarifications from the first set of modifications to the proposed regulations (published on February 10, 2020).
On February 7 and again on February 10, 2020, the California Attorney General Xavier Becerra released an updated draft of proposed regulations pursuant to the California Consumer Privacy Act of 2018 (“CCPA”). The updated drafts feature significant changes, clarifications and reversals of policy from the original proposal.
The updated draft regulations—available here (clean) and here (redline to the original October 2019 Draft)—reflect input gathered during the public comment period and series of public hearings which concluded on December 6, 2019. The first draft of the proposed regulations, the public comments and the transcripts and audio of the public hearings are available on the Attorney General’s CCPA webpage. The Attorney General also updated the online cache of documents and other information relied upon in preparing the revised draft regulations here.
Happy New Year! At long last, the California Consumer Privacy Act of 2018 (“CCPA”) went into effect yesterday, January 1, 2020. For those who have not yet heard, the CCPA establishes a comprehensive legal framework to govern the collection and use of personal information, both online and offline, and provides unprecedented privacy rights to California consumers, in effect becoming the de facto national standard for U.S. privacy law. The law introduces new legal risks and considerations for companies that collect information from California consumers, due to the law’s expansive scope, broad definition of personal information, increased disclosure obligations, enhanced consumer rights, potential for statutory fines and, in the event of a security incident, the potential for consumer class action litigation. READ MORE
With the January 1, 2020 effective date of the California Consumer Privacy Act (the “CCPA”) rapidly approaching, all eyes have been on the California legislature’s consideration of a robust suite of amendments that would clarify ambiguities and address discrepancies underlying the prominent privacy statute. On October 11, 2019, six CCPA amendments were signed into law by the California Governor, as well as an amendment to the state’s breach notification statute. The rest of the CCPA amendments have either failed or will have to wait until next year for further consideration.
On October 10, 2019, the California Attorney General added to the complexity of the California Consumer Privacy Act of 2018 (“CCPA”) by releasing long-awaited proposed regulations that provide guidance on various elements of the CCPA. The text of the proposed regulations is available here and the California Attorney General has made other documents and information relating to the proposed regulations available here. The comment period for the proposed regulations will close on December 6, 2019. Interested parties may review and provide written comments addressing the proposed regulations prior to that date or attend one of four scheduled public hearings on the proposed regulations to be held on December 2-5, 2019. READ MORE
While the California Consumer Privacy Act (“CCPA”) has inspired many states to consider their own consumer privacy bills, including Nevada which recently enacted a new law, not to be lost in the CCPA-focused frenzy is the fact that states continue to revise their data breach notification statutes. In recent weeks, the new Massachusetts breach notification amendment has gone into effect, New Jersey, Maryland, Oregon, Texas, and Washington have enacted their own breach notification amendments, and Illinois has proposed a bill that is poised to become law in the near term. READ MORE