Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—Oct./Nov. 2024, (Dec 2, 2024)

Welcome again to The Week in State Privacy and Cybersecurity Legislation, your update on the latest developments in proposed and enacted privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the upcoming schedule.

As we made our way through a contentious election season and more states adjourned for the year, there was a dearth of legislative activity, so we decided to consolidate out monthly updates into a single article for October and November. As always, we continue to monitor activity on a daily basis and to update the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard, as new bills are introduced or move through the legislative process.

RECENT DEVELOPMENTS

CPPA adopts data broker regs; director to resign. On Nov. 8, the California Privacy Protection Agency (CPPA) held its monthly board meeting, at which it adopted final regulations governing data broker registration under the recently enacted Delete Act. It also advanced a proposed rulemaking package pertaining to insurance, cybersecurity audits, risk assessments, and automated decision-making technologies (ADMT) as required by the California Consumer Privacy Act (CCPA). On the same day, Ashkan Soltani, the agency’s executive director, announced that he would leave the agency at the beginning of next year (CPR, Nov. 12).

In addition, on Nov. 14, the CPPA announced that it had reached settlements with two data brokers for failing to register and pay annual fees as required under California’s Delete Act (CPR, Nov. 14).

New Jersey bill would establish cyber infrastructure office.S.B. 3835, Reg. Sess., introduced in the New Jersey state Senate on Oct. 24, would establish the Office of Cybersecurity Infrastructure within the executive branch of the state government. The bill would direct the new office to develop and implement cybersecurity policies across the state, establish and monitor technology infrastructure to ensure secure interactions between nonprofit and private organizations and state residents, and form policies for the “safe integration of artificial intelligence (AI) into professional practices” (CPR, Oct. 28). The bill has been assigned to the Senate State Government, Wagering, Tourism & Historic Preservation Committee.

NYDFS cybersecurity amendments take effect. New obligations under amendments to the cybersecurity regulations of the New York Department of Financial Services (NYDFS) took effect on Nov. 1. The agency has established a resource center to help covered entities comply with the amended regulations, which address cybersecurity governance and require written cybersecurity policies, incident response plans, and business continuity plans (CPR, Nov. 1).

Marriott settles with states, FTC over data breaches. Marriott International, Inc., will pay $52 million and implement a stringent data security program to settle complaints brought by state attorneys general and the Federal Trade Commission over a series of data breaches that plagued the hospitality company between 2014 and 2018. The cybersecurity program mandated by the FTC settlement, which is largely mirrored in the state settlements, would require Marriott “to provide all its U.S. customers with a way to request deletion of personal information associated with their email address or loyalty rewards account number,” the FTC said (CPR, Oct. 9).

Enforcement actions issued in New York. On Oct. 29, New York Attorney General Letitia James (D.) reached a settlement with health care provider Albany ENT & Allergy Services P.C. (AENT) that failed to protect the private information and medical data of more than 200,000 New Yorkers. The AG’s investigation found that AENT did not have adequate safeguards in place to protect patient data and that it failed to effectively respond to a pair of cyber attacks over a 10-day period in 2023 (CPR, Oct. 31).

The New York AG also secured a $250,000 settlement with movie theater operator National Amusements, Inc., after finding that the company failed to protect the information of former and current employees and contractors. In addition to the financial penalty, the settlement requires National Amusements to update and improve its cyber defenses to protect employee data (CPR, Nov. 15).

Finally, on Nov. 25, AG James, in tandem with NYDFS Superintendent Adrienne Harris, announced that their agencies had secured $11.3 million in penalties against the Government Employees Insurance Co. (GEICO) and Travelers Indemnity Co. for inadequate data security that led to the compromise of the personal information of more than 120,000 New Yorkers. The sanctions come after an industry-wide campaign by hackers who stole consumers’ personal information, including driver’s license numbers and dates of birth, from online auto insurance quoting applications. The hackers then used stolen driver’s license information to file fraudulent unemployment claims during the COVID-19 pandemic (CPR, Nov. 26).

WHAT’S COMING UP

Looking ahead to December, there is currently only one hearing scheduled on a cybersecurity bill, in Ohio. H.B. 507 135th Gen. Assemb., a bill that would extend a legal safe harbor to political subdivisions that implement a cybersecurity program that meets specified requirements, will be discussed in the House Technology and Innovations Committee on Dec. 4.

WHAT WE’RE TRACKING

Oct./Nov. 2024

Introduced Bills: 8

Enacted Bills: 1

Failed Bills: 17

2024 Total

Introduced Bills: 638

Enacted Bills: 70

Failed Bills/No Further Action on Adjournment: 48

MainStory: CCPA DataBreach DataPrivacy DataSecurity StateLegislation LitigationEnforcement