For the first time, a U.S. fintech company is acquiring a regulated U.S. bank, which will give it access to a stable and cheaper source of funding – as well as a national bank charter.
On February 18th, LendingClub, one of the largest providers of personal loans in the U.S., announced that it will pay…
A recent federal court decision should serve as an important reminder to providers that the Centers for Medicare and Medicaid Services (“CMS”) and its contractors have substantial authority to audit provider Medicare claims and to broadly apply extrapolation to calculate overpayments. In Palm Valley Health Care, Inc. v. Azar, No. 18-41067, 2020 BL 14097…
“[P]rivacy legislation should have some kind of safe harbor provision in it so that companies understand that if they take certain steps, what they are doing is consistent with the law.” Karen Zacharia, Chief Privacy Officer at Verizon
The California Consumer Privacy Act (CCPA) provides unparalleled rights for California residents with regard to data privacy. The CCPA contains an expansive definition of “personal information” and establishes completely new data privacy entitlements for California consumers, including rights to access, delete and opt-out of the sale of personal information. In addition, the CCPA provides new statutory damages and consumer private rights of action in the event of a data breach.
FINRA’s examination program has undergone its most significant reorganization in decades. As stated in a press release, Oct. 1, 2018, FINRA’s goal for the reorganization was to “consolidate its Examination and Risk Monitoring Programs, integrating three separate programs into a single, unified program to drive more effective oversight and greater consistency, eliminate duplication and…
On January 7, 2020, the Securities and Exchange Commission’s Office of Compliance Inspections and Examinations (OCIE) released its 2020 examination priorities. OCIE is prioritizing practices, products, and services that it believes present heightened risks to investors or market integrity. The examination priorities are organized around seven themes, many of which build on OCIE’s priorities…
Across the country, school districts use technology to facilitate learning and assist in classroom management. From tracking grades and communicating with parents to monitoring bathroom breaks, technology is everywhere in our schools. But as technology becomes more prevalent in the classroom, what does that mean for student data privacy?
Federal Laws Governing Student Data Privacy
There are several federal laws that govern student data privacy. The Family Educational Rights and Privacy Act (FERPA) protects student educational records and requires the consent of parents or students age 18 or older to consent to the release of education records. The Protection of Pupil Rights Amendment (PPRA) requires parental consent for any federally funded student survey or evaluation that requires the student to provide sensitive information. Lastly, the Children’s Online Privacy Protection Act (COPPA) regulates companies collecting data about kids under the age of thirteen. Under the law, educational products may not require parental consent, and instead, schools can consent on behalf of parents. Importantly, the Federal Trade Commission (FTC) is considering updating COPPA’s regulations. The FTC requested comments on the rule in July and held a workshop in October.
For years, corporate boards have hired third-party companies to conduct financial audits to assure that there is no fraud or other breaches of fiduciary responsibility by management. Cyber risks should be managed similarly. Who can thoroughly evaluate whether management is prepared to protect the company when its systems are attacked or when a data breach occurs? Is management prepared to execute the company’s incident response plan, or is it just sitting on the shelf untested?
On Oct. 18, 2019, the Securities and Exchange Commission (SEC) Division of Investment Management staff published Frequently Asked Questions Regarding Disclosure of Certain Financial Conflicts Related to Investment Adviser Compensation (FAQs). Many in the industry view the FAQs as overdue SEC guidance in an area that has been a focus of the SEC Division of…
The Office of Inspector General (“OIG”) recently launched a new, redesigned hotline webpage to better guide the public through the tip and complaint reporting process. The OIG hotline operations accepts tips and complaints from all sources regarding potential fraud, waste, abuse, and mismanagement in the U.S. Department of Health and Human Services’ (“HHS”) programs. The…
A recent letter from researchers at the Mayo Clinic to the editor of The New England Journal of Medicine outlined a new challenge in de-identifying, or preserving the de-identified nature of, research and medical records.[1] The Mayo Clinic researchers described their successful use of commercially available facial recognition software to match the digitally reconstructed images of research subjects’ faces from cranial magnetic resonance imaging (“MRI”) scans with photographs of the subjects.[2] MRI scans, often considered non-identifiable once metadata (e.g., names and other scan identifiers) are removed, are frequently made publicly available in published studies and databases. For example, administrators of a national study called the Alzheimer’s Disease Neuroimaging Initiative estimate other researchers have downloaded millions of MRI scans collected in connection with their study.[3] The Mayo Clinic researchers assert that the digitally reconstructed facial images, paired with individuals’ photographs, could allow the linkage of other private information associated with the scans (e.g., cognitive scores, genetic data, biomarkers, other imaging results and participation in certain studies or trials) to these now-identifiable individuals.[4]
