Continuing our coverage of cybersecurity issues during National Cybersecurity Awareness Month (NCSAM), we have identified 5 important cybersecurity questions and talking points you can use to start a meaningful cybersecurity conversation at your business.

Counsel and business executives take note: cybersecurity is not just an IT problem, robust cybersecurity starts with a healthy dialogue between legal, business, and IT. The chart below illustrates how failure to engage in meaningful oversight of your company’s data and systems security will create costly, significant, and unnecessary risk.

(https://digitalguardian.com/blog/whats-cost-data-breach-2019)

The good news is that you need not be an IT expert to oversee your company’s cybersecurity risk. You do not need to be able to write code, or to know exactly what software is needed to keep the company’s data secure. The first step is to open a healthy dialogue with your IT professionals – a dialogue that will allow you to assess more capably your company’s readiness to counter a broad range of exploitation techniques.

Try calling your CISO or CIO and asking these questions:

On June 5, 2019, the SEC adopted Regulation Best Interest (“Reg BI”), which requires broker-dealers and associated persons to make recommendations regarding securities transactions (or investments involving securities) that are in the “best interest” of their retail clients. The SEC also adopted Form CRS, requiring broker-dealers and investment advisers to provide a brief relationship summary…

Social media posts have become so common and reflexive that people often fire off posts without appropriately considering the consequences.  This can be costly on multiple fronts.  In the health care context, beyond the risk of losing patients (and the revenue they bring), inappropriate posts can result in Health Insurance Portability and Accountability Act (HIPAA) violations.  Indeed, as the Director of the U.S. Department of Health and Human Services Office for Civil Rights (OCR) has stated, “Social media is not the place for providers to discuss a patient’s care… [doctors] and dentists must think carefully about patient privacy before responding to online reviews.”  Of course, this warning is not limited to dentists; all health care providers should take heed. 

In 2016, the Department of Health and Human Services’ Office for Civil Rights (OCR) provided a variety of guidance to address the importance of honoring the right of patients to have access to their medical information and not to be over-charged for exercising that right.

Earlier this week, the OCR announced an enforcement action and settlement under its Right of Access Initiative against Bayfront Health St. Petersburg (Bayfront) in Florida. This settlement, the first of its kind under OCR’s initiative to enforce patients’ rights to promptly receive copies of their medical records without being overcharged, has cost Bayfront $85,000. The 480-bed hospital is also required to undertake a corrective action plan that includes a one-year period of monitoring by OCR.

On Monday, July 8th, FINRA and the SEC took the unusual step of issuing a joint statement on broker-dealer custody of digital asset securities. In doing so, the Staffs of the SEC’s Division of Trading and Markets and of FINRA’s Office of General Counsel made clear that the SEC and FINRA will continue to apply…

Members of the SEC’s Strategic Hub for Innovation and Financial Technology (“FinHub”) and experts in Fintech came together on May 31st for the SEC’s public forum focusing on distributed ledger technology and digital assets.  As a whole, the panelists grappled with the challenge of regulating an emerging technology that does not fit neatly within the…

Although not a new practice, the application of geofencing continues to increase in sophistication and expand into personal space on an unprecedented scale, jumping beyond commercial retail advertising schemes and diving into the depths of employment, health care, law enforcement, and politics. As the growth of these applications prompt privacy and security concerns, including government surveillance concerns, regulations lag and may be further delayed considering lawmakers’ very use of geofencing to win a governing seat.

Geofencing is the practice of using wireless internet, cellular data, global positioning system (GPS) or radio-frequency identification (RFID), or a combination of such technologies, to create a virtual boundary around a particular geographic area. When a smart-phone, tablet, or other targeted device crosses over the geofence perimeter, it triggers a response from the geofence software. So-called “active” geofencing technology powers things like home applications or “apps” that automatically adjust ambient temperature and lighting when a person enters their house. “Passive” geofencing technology is used to both (1) push advertising and other information to consumers through social media apps and other channels and (2) monitor or pull information about a consumer’s habits.

The European Union’s (EU) ambitious and far-reaching regulation, the General Data Protection Regulation (GDPR), became effective on 25 May 2018. On the one-year anniversary, we reflect on some of the principal developments following the implementation of the GDPR
European privacy values: a cultural shift
Critics have derided the GDPR for placing an onerous and expensive compliance burden on businesses, causing confusion and creating ‘data privacy fatigue’ amongst consumers and businesses alike.

Conversely, the furore has generated significant publicity around the GDPR, contributing to a cultural shift towards greater consumer empowerment and control over personal information. Public awareness of the GDPR is high – in May 2018, GDPR was searched more often on Google than either Beyoncé or Kim Kardashian. Individuals have a better understanding of their rights in respect of their personal data – which presents more of a risk to data controllers.

Equally, GDPR has completely changed the risk profile of data protection for most businesses. Under the previous, weakly enforced regime, most businesses treated data protection as a low risk issue. Under the new regime, data protection has become a high-risk issue.

This post follows up on our earlier “primer” and flash alert on the Consumer Financial Protection Bureau’s proposed rule (the proposal) to implement the Fair Debt Collection Practices Act, which the CFPB released with a Fact Sheet and a Table of Contents to the proposal. Below, we describe key details of the proposal, and provide further information from stakeholders and the CFPB that has become available since the proposal’s publication.

McGuireWoods also will host a free webinar on the proposal in the coming weeks; a date will be announced soon.

Comments on all aspects of the proposal are due 90 days after it appears in the Federal Register, which should be any day now.
I. Summary of Key Points

  • The proposal would apply only to “debt collectors” as defined by the FDCPA. Importantly, owners of debt — even debt in default when purchased — would continue to fall outside the branch of the “debt collector” definition that covers those who regularly collect debts “owed or due, to another.” As a practical matter, this means that the only “first-party” collectors (i.e., collectors who own the debt) who would generally be regulated as “debt collectors” would continue to be those who operate a “business the principal purpose of which is the collection of debts.”
  • Nonetheless, many of the proposal’s requirements regarding what is unfair, deceptive or abusive under the FDCPA likely would be viewed as informing the UDAAP/UDAP analysis that applies to every person collecting consumer debts.
  • The proposal would regulate communications by debt collectors in several key ways. In particular, it would:
    • cap at seven the number of telephone calls that debt collectors may place to consumers within a seven-day window about a particular debt;
    • impose a waiting period of seven days after a debt collector has a telephone conversation with a person about a particular debt;
    • permit unlimited electronic communications about a debt, but require a debt collector to include in any e-mail, text message or other electronic communication a clear and conspicuous statement describing a way for the consumer to “opt out” from receiving any further messages through that particular medium;
    • prohibit communications about a debt via a workplace email addresses (with exceptions) and through public-facing social media platforms; and
    • create an exception to communications limits and requirements for messages satisfying the definition of a new term, “limited content message.”
  • The proposal would standardize the “debt-validation” disclosures to consumers long required by § 809 of the FDCPA.