Communication Media & Internet Archives - Page 17 of 66

New Survey Shows that Americans are Ready for More Deliveries by Drone

Auterion, a drone software company, commissioned a survey from the market research company, Propeller Insights, of 1,022 adults. The survey was gender-balanced and distributed across age groups from 18 to 65+, living in rural, suburban, and city environments in the United States, and was conducted in May 2022.

In the report summarizing the survey, “Consumer Attitudes on Drone Delivery,” Auterion reveals that 58 percent of Americans like the idea of drone deliveries, and 64 percent think drones are becoming an option for home delivery now or will be in the near future. With more than 80 percent of those surveyed reporting that they have packages delivered to their homes on a regular basis, the survey finds that Americans are generally ready to integrate drone delivery into daily life for ease and speed. Of the 64 percent who see drones becoming a more common option for home delivery, 32 percent think it’s possible now or within the next 1 to 2 years.

Only 36 percent of those surveyed had doubts about this type of drone integration, including some individuals who think the general public or governments will not approve of large-scale drone adoption for delivery and others who just prefer that drone delivery doesn’t happen at all.

With individuals choosing more than one option, the survey found that the most common types of home package deliveries reported by consumers today, by vehicles and trucks, are:

39 percent – groceries
34 percent – clothing
33 percent – household items
31 percent – meals
27 percent – medicine
11 percent – baby food/needs

Based on these findings, those surveyed were also asked if they were willing to consider drones as a “new corner store” for conveniently delivering small and last-minute necessities: 54 percent of the individuals said “yes.”

With regard to concerns related to these drone deliveries, 43 percent of those surveyed fear the drone will break down and they will not receive their item, and 19 percent are worried about not having human interaction with their delivery person. However, drone delivery and systems provide accurate trackability and direct delivery, and, therefore are more capable of accurate delivery timing. Delivery drones are built to analyze the environment with precision, to communicate through control software in a common language and predict safe landing spots for the packages. Air space is becoming a great option in a time when highways are filled with cars and trucks, and fuel prices are rising. Drones can help to reduce our reliance on gas-powered delivery vehicles, and provide safer, more flexible, and more cost-effective delivery.

Article By Kathryn M. Rattigan of Robinson & Cole LLP

For more privacy and cybersecurity legal news, click here to visit the National Law Review.

NYS Sexual Harassment Hotline Goes Live

Effective July 14, 2022 (pursuant to legislation amending the New York State Human Rights Law that was signed by New York State Governor Kathy Hochul in March 2022), New York established a telephone hotline that employees can use to report incidents of sexual harassment to the New York State Division of Human Rights. The hotline number is 800-HARASS-3 ((800) 427-2773) and will be staffed, on a pro bono basis, by NYS attorneys who have expertise in employment law and sexual harassment issues. The hotline can be called Monday through Friday, 9:00 a.m. to 5:00 p.m.

Because, under the law, information about the hotline must be contained in workplace policies and postings about sexual harassment, employers need to revise their anti-harassment policies promptly to include this information.

Article By Jonathan A. Wexler of Vedder Price

For more labor and employment legal news, click here to visit the National Law Review.

Government Brings First Cryptocurrency Insider Trading Charges

In a series of parallel actions announced on July 21, 2022, the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) initiated criminal and civil charges against three defendants in the first cryptocurrency insider trading case.

According to the criminal indictment, DOJ alleges that a former employee of a prominent cryptocurrency exchange used his position at the exchange to obtain confidential information about at least 25 future cryptocurrency listings, then tipped his brother and a friend who traded the digital assets in advance of the listing announcements, realizing gains of approximately $1.5 million. The indictment further alleges that the trio used various means to conceal their trading, and that one defendant attempted to flee the United States when their trading was discovered. The Government charged the three with wire fraud and wire fraud conspiracy. Notably, and like the Government’s recently announced case involving insider trading in nonfungible tokens, criminal prosecutors did not charge the defendants with securities or commodities fraud.

In its press release announcing the charges, US Attorney for the Southern District of New York Damian Williams said: “Today’s charges are a further reminder that Web3 is not a law-free zone. Just last month, I announced the first ever insider trading case involving NFTs, and today I announce the first ever insider trading case involving cryptocurrency markets. Our message with these charges is clear: fraud is fraud is fraud, whether it occurs on the blockchain or on Wall Street. And the Southern District of New York will continue to be relentless in bringing fraudsters to justice, wherever we may find them.”

Based on these facts, the SEC also announced charges against the three men in a civil complaint alleging securities fraud. In order to assert jurisdiction over the matter, the SEC alleges that at least nine of the cryptocurrencies involved in the alleged insider trading were securities, and the compliant traces through the Howey analysis for each. The SEC has not announced charges against the exchange itself, though in the past it has charged at least one cryptocurrency exchange that listed securities tokens for failure to register as a securities exchange. Perhaps coincidentally, on July 21 the exchange involved in the latest DOJ and SEC cases filed a rulemaking petition with the SEC urging it to “propose and adopt rules to govern the regulation of securities that are offered and traded via digitally native methods, including potential rules to identify which digital assets are securities.”

In an unusual move, Commissioner Caroline Pham of the Commodity Futures Trading Commission (CFTC) released a public statement criticizing the charges. Citing the Federalist Papers, Commissioner Pham described the cases as “a striking example of ‘regulation by enforcement.’” She noted that “the SEC’s allegations could have broad implications beyond this single case, underscoring how critical and urgent it is that regulators work together.” Commissioner Pham continued, “Major questions are best addressed through a transparent process that engages the public to develop appropriate policy with expert input—through notice-and-comment rulemaking pursuant to the Administrative Procedure Act.” She concluded by stating that, “Regulatory clarity comes from being out in the open, not in the dark.” The CFTC is not directly involved in either case, and it is atypical for a regulator to chide a sister agency on an enforcement matter in this fashion. On the same day, another CFTC Commissioner, Kristin Johnson, issued her own carefully-worded statement that seemed to support the Government’s actions.

Article By Scott H. Kimpel of Hunton Andrews Kurth

For more criminal law and business crimes legal news, click here to visit the National Law Review.

How to Market Your Firm When You Don’t Need an In-House Hire

Law firms of any size need some level of marketing for long-term growth and sustainability. To be successful, every law firm must focus on its marketing. In an ideal world, lawyers would have the time to do what they do best and also market their business so it can grow. However, lawyers are inherently busy individuals, and it often doesn’t make sense to try to do it all themselves. Trying to do it all alone is overwhelming, and your time is best spent helping clients.

The simple answer to this time crunch dilemma is to hire someone in-house to take over the marketing efforts. But for many firms, that has a laundry list of drawbacks, such as additional time and expense. Perhaps you don’t have the marketing needs or budget to hire someone to market your law firm on a full- or even part-time basis. Hiring someone in-house means you need to have enough work and room in your budget to keep them busy. So, what are your other options?

Do it Yourself

Continuing to market your law firm yourself is one option. But let’s be realistic; you cannot do it all. With your busy schedule, you might only have one to three hours per week to dedicate to your marketing efforts. If this is the case, pick one or two marketing elements to be consistent with. For example, focus on your blogs or social media posts. If you need more help, as this tiny sliver of weekly time is not likely to move the needle or be sustainable, it’s time to outsource.

Hire an Agency or Freelancer

One viable option could be hiring an agency or freelancer to take over all or most of your marketing tasks. Outsourcing can help take some of this pressure off. Leaving your marketing in the hands of an experienced and knowledgeable agency or freelancer gives you peace of mind that it’s being done optimally. It also lets you focus on your clients and practicing law—which is what you went to school for, after all.

Identify Your Marketing Goals

If you decide to go this route, determine what your primary marketing goals are and go from there:

Do you want more leads?
Do you want to see more conversions?
Do you need to get more referrals?
Do you need a better ROI for your marketing dollars?

By listing your marketing goals and dreams and what you’re already doing, you can visualize your marketing gap and identify when it’s time to work with a professional. The more significant this gap, the more likely you need to hire a professional as soon as possible. In the meantime, you could be missing out on signing new clients.

Get an Outside Opinion

When you work with a freelancer or marketing agency, you will have a professional on your side who can also audit your marketing plan and tell you what your marketing is missing. Having another person, especially a marketing expert, lay eyes on what you’ve done to market your law firm and your future plans can help you identify your weaknesses and course correct to the right path. Marketing professionals can take what you have already started and turn it into something bigger and more successful.

Benefits of Working with a Marketing Agency or Freelancer

Working with a marketing agency or freelancer can provide your law firm with the following benefits:

Increased brand awareness
Greater ability to be found on the internet
More website traffic
Building trust and credibility with your audience
Improved online presence and engagement
Conversion rate optimization
Cost efficiency
Tracking and interpreting marketing efforts
Strategy and creativity – for example, creating targeted campaigns for niche clients

Last but not least, they allow you to focus on obtaining optimal outcomes for your clients instead of trying to market your law firm.

Article By Meranda M. Vieyra of Denver Legal Marketing

For more business of law legal news, click here to visit the National Law Review.

Five Ways to Encourage Lawyer Participation With Your CRM System

Lawyers are busy and often resistant to change, so getting them on board with using a new or even your existing CRM system can be challenging.

But if you approach your CRM efforts as a value-added benefit that will support their marketing and business development efforts and is not difficult to use or time-consuming, you can increase CRM adoption and participation by your lawyer population at any size law firm or professional services organization. Here’s how.

Explain what’s in it for them. Spend the time to clearly outline to users how the CRM system will directly benefit them, not just the organiztion as a whole.
Put yourself in their shoes. Overcomplicated systems and non-technical users are a recipe for disaster. The whole point of implementing a CRM system is to improve efficiency and productivity, not hinder it, so make it easy for your lawyers to use it – or they simply won’t. In addition, lawyers use many different systems on a daily basis, such as time and billing, practice management and document management. CRM can become the one place to get all or most of what they need and allow them more time to be lawyers. Tip – look for CRM systems that include customizable dashboards to personalize daily views.
Show lawyers how easy it is to gain value and insights from the information in the CRM on their own. Engage your marketing professionals to regularly meet with lawyers on a regular basis to gather new and updated contact information.
Find a system that makes it easy for lawyers to share appointments and activities with CRM. This way, marketing professionals can provide strategic, proactive support for upcoming prospect and client meetings based on CRM data. For example, let’s say your marketing manager sees a calendar appointment with a prospective client on an attorney’s schedule. She could then reach out to them and proactively create pitch materials and share who-knows-who info, past matters information and other intelligence. After meetings, attorneys can be prompted to add their meeting notes in CRM too.
Maintain clean, updated CRM data. Your CRM is only as useful and strong as the information entered into it, so if its users are inputting inaccurate data, you’ll only distill inaccurate insights from it. Ensure your data is up to date and accurate, and implement a regular data cleaning process which you can outsource if you don’t have internal resources to manage it.

While the keys to CRM adoption success will vary for each firm, the common, important thread is always the “value exchange.” If you make it easy for your attorneys to contribute valuable information – and ensure they are getting value out of the CRM – adoption and CRM success will follow.

Increasing CRM adoption and participation takes time, but it is an important investment to make and one that will provide many long-term benefits for your lawyers and your firm.

Another strategy to consider: redefining CRM success by minimizing the need for attorney adoption. Many smart firms are moving away from the traditional model of having attorneys be responsible for data entry. We’ll discuss that in an upcoming post.

Article By Christina R. Fritsch JD of CLIENTSFirst Consulting

For more business of law legal news, click here to visit the National Law Review.

FTC Takes First Actions Under New Made in USA Labeling Rule, Fining Battery Companies for Violations

The Federal Trade Commission (FTC) recently cracked down on Lithionics Battery, LLC, and Lions Not Sheep Products, LLC, for violating the FTC’s Made in USA Labeling Rule. These are some of the first enforcement actions after the FTC codified its longstanding informal Made in USA guidance, which makes it easier for the FTC to seek damages and levy fines. Under the proposed settlement, Lithionics will pay a $100,000 fine for falsely labeling batteries as US-made, while Lions Not Sheep will be required to pay $211,335 for falsely labeling clothing as US-made.

The Made in USA Labeling Rule

Under the Made in USA Labeling Rule, marketers suspected of making unqualified Made in USA claims must prove that their products:

are all or virtually all made in the US;
that all significant processing occurred in the US; and
that the final assembly occurred in the US.

Although Congress enacted legislation authorizing the FTC to seek relief for Made in USA fraud almost thirty years ago, the FTC long remained silent on enforcement due to a general consensus that this specific type of fraud should not be penalized. The 2021 Made in USA Labeling Rule alters this perspective, codifying the FTC’s enforcement policy. With the Commission now being allowed to levy fines, seek damages, penalties, and/or redress on marketers who deceptively and fraudulently represent that their products are made in the US, the FTC has stepped up its enforcement efforts.

The FTC’s Recent Allegations with Lithionics and Lions Not Sheep

Lithionics

Lithionics is a Florida-based company best known for its battery products. The company has become a regular brand throughout American households. It designs and sells products for vehicles, as well as amusement parks.

The FTC alleged that Lithionics has been in violation of the Made in USA Labeling Rule since at least 2018 by intentionally misrepresenting the origin of Lithionics products. According to the Complaint, Lithionics’ products are labeled “Proudly Designed and Built in the USA” and feature an American flag. The claims were also featured across company websites, social media platforms, videos, and printed catalogs. However, according to the FTC, “all Lithionics battery and battery module products contain imported lithium ion cells” and “other significant imported components,” which, if true, would render Lithionics’ Made in USA claims false or unsubstantiated under the Made in USA Labeling Rule.”

Under the proposed order, Lithionics and its owner must stop making these claims unless they can prove their statements are true. As noted above, the company must also pay $100,000 for the alleged activity.

Lions Not Sheep

Lions Not Sheep is a self-proclaimed lifestyle brand that sells sweatshirts, hats, and shirts online.

In its allegations against Lions Not Sheep, the FTC alleged that the company has violated the Made in USA Labeling Rule since May 2021. According to the Complaint, the company intentionally removed tags disclosing that items were made in a foreign country. Instead of leaving the original tags, the FTC alleged that the company replaced them with Made in USA tags despite the products being “wholly imported with limited finishing work performed in the United States.” To make matters worse, the FTC found a video posted on the internet featuring the company’s owner blatantly claiming he could hide the fact that his shirts were made in China.

In addition to charging the company with violating the Made in the USA Labeling Rule, the FTC charged the company with violating mandatory country-of-origin labeling rules, which require all products covered by the Textile Act to include labels disclosing the manufacturer or marketer name and country where the product was manufactured. The company will be prohibited from making these claims and forced to pay $211,335.

Primary Takeaway

With the FTC now levying significant fines under the new Made in USA rule, the potential cost of non-compliance has also significantly increased. Companies should provide notice to their marketing teams and carefully review any existing claims to ensure that Made in USA claims are adequately substantiated and that marketing materials are not conveying unintended implied claims.

Article By Anthony V. Lupo, Dan Jasnow, and Destiny Planter of ArentFox Schiff LLP

For more antitrust legal news, click here to visit the National Law Review.

A Rule 37 Refresher – As Applied to a Ransomware Attack

Federal Rule of Civil Procedure 37(e) (“Rule 37”) was completely rewritten in the 2015 amendments. Before the 2015 amendments, the standard was that a party could not generally be sanctioned for data loss as a result of the routine, good faith operation of its system. That rule didn’t really capture the reality of all of the potential scenarios related to data issues nor did it provide the requisite guidance to attorneys and parties.

The new rule added a dimension of reasonableness to preservation and a roadmap for analysis. The first guidepost is whether the information should have been preserved. This rule is based upon the common law duty to preserve when litigation is likely. The next guidepost is whether the data loss resulted from a failure to take reasonable steps to preserve. The final guidepost is whether or not the lost data can be restored or replaced through additional discovery. If there is data that should have been preserved, that was lost because of failure to preserve, and that can’t be replicated, then the court has two additional decisions to make: (1) was there prejudice to another party from the loss OR (2) was there an intent to deprive another party of the information. If the former, the court may only impose measures “no greater than necessary” to cure the prejudice. If the latter, the court may take a variety of extreme measures, including dismissal of the action. An important distinction was created in the rule between negligence and intention.

So how does a ransomware attack fit into the new analytical framework? A Special Master in MasterObjects, Inc. v. Amazon.com (U.S. Dist. Court, Northern District of California, March 13, 2022) analyzed Rule 37 in the context of a ransomware attack. MasterObjects was the victim of a well-documented ransomware attack, which precluded the companies access to data prior to 2016. The Special Master considered the declaration from MasterObjects which explained that, despite using state of the art cybersecurity protections, the firm was attacked by hackers in December 2020. The hack rendered all the files/mailboxes inaccessible without a recovery key set by the attackers. The hackers demanded a ransom and the company contacted the FBI. Both the FBI and insurer advised them not to pay the ransom. Despite spending hundreds of hours attempting to restore the data, everything prior to 2016 was inaccessible.

Applying Rule 37, the Special Master stated that, at the outset, there is no evidence that any electronically stored information was “lost.” The data still exists and, while access has been blocked, it can be accessed in the future if a key is provided or a technological work-around is discovered.

Even if a denial of access is construed to be a “loss,” the Special Master found no evidence in this record that the loss occurred because MasterObjects failed to take reasonable steps to preserve it. This step of the analysis, “failure to take reasonable steps to preserve,” is a “critical, basic element” to prove spoliation.

On the issue of prejudice, Amazon argued that “we can’t know what we don’t know” (related to missing documents). The Special Master did not find Amazon’s argument persuasive. The Special Master concluded that Amazon’s argument cannot survive the adoption of Rule 37(e). “The rule requires affirmative proof of prejudice in the specific destruction at issue.”

Takeaways:

If you are in a spoliation dispute, make sure you have the experts and evidence to prove or defend your case.
When you are trying to prove spoliation, know the new test and apply it in your analysis (the Special Master noted that Amazon did not reference Rule 37 in its briefing).
As a business owner, when it comes to cybersecurity, you must take reasonable and defensible efforts to protect your data.

Article By Gretchen E. Moore of Strassburger McKenna Gutnick & Gefsky

For more cybersecurity and media legal news, click here to visit the National Law Review.

Wegmans Settles With NYAG for $400,000 Over Data Incident

The New York Attorney General recently announced a data security-related settlement with Wegmans Food Markets. The issue arose in April 2021 regarding a cloud-based incident. At that time a security researcher notified Wegmans that the company had an Azure cloud storage container that was unsecured. Upon investigation, the company determined that the container had been misconfigured and that three million customer records had been publicly accessible since 2018. The records included email addresses and account passwords.

Of concern for the AG, among other things, were that the passwords were salted and hashed using SHA-1 hashing, rather than PBKDF2. Similarly, the AG found concerning the fact that the company did not have an asset inventory of what it maintained in the cloud. As a result, no security assessments were conducted of its cloud-based databases. The NYAG also took issue with the company’s lack of long-term logging: logs for its Azure assets were kept for only 30 days. Finally, the company kept checksums derived from customer driver’s license information, something for which the NYAG did not feel the company had a “reasonable business purpose” to collect or maintain.

The NYAG argued that these practices were both deceptive and unlawful in light of the promises Wegman’s made in its privacy policy. It also felt that the practices were a violation of the state’s data security law. As part of the settlement, Wegmans agreed to pay $400,000. It also agreed to implement a written information security program that addresses, among other things:

asset management that covers cloud assets and identifies several items about the asset, including its owner, version, location, and criticality;

access controls for all cloud assets;

penetration testing that takes into account cloud assets, and includes at least one annual test of the cloud environment;

central logging and monitoring for cloud assets, including keeping cloud logs readily accessible for 90 days (and further stored for a year from logged activity);

customer password management that includes hashing algorithms and a salting policy that is at least commensurate with NIST standards and “reasonably anticipated security risks;” and

policies and procedures around data collection and deletion.

Wegmans agreed to have the program assessed within a year of the settlement, with a written report by the third-party assessor provided to the NYAG. It will also conduct at-least-annual reviews of the program. As part of that review it will determine if any changes are needed to better protect and secure personal data.

Putting It Into Practice: This case is a reminder for companies to think not only about assets on its network, but its cloud assets, when designing a security program. Part of these efforts include clearly identifying locations that house personal information (as defined under security and breach laws) and evaluating the security practices and controls in place to protect that information. The security program elements the NYAG has asked for in this settlement signal its expectations of what constitutes a reasonable information security program.

Article By Kari M. Rollins and Liisa M. Thomas of Sheppard, Mullin, Richter & Hampton LLP

For more data privacy legal news, click here to visit the National Law Review.

Are You Being Served? Court Authorizes Service of Process Via Airdrop

In what may be the first of its kind, a New York state court has authorized service via token airdrop in a case regarding allegedly stolen cryptocurrency assets. This form of alternative service is novel but could become a more routine practice in an industry where the identities of potential parties to litigation may be difficult to ascertain using blockchain data alone.

Background on the Dispute

According to the Complaint in the case, the plaintiff LCX AG (“LCX”) is a Liechtenstein based virtual currency exchange. As alleged in the Complaint, on or about January 8, 2022, the unknown defendants (named in the Complaint as John Does 1-25) illegitimately gained access to LCX’s cryptocurrency wallet and transferred $7.94 million worth of digital assets out of LCX’s control. Cryptocurrency wallets are similar in many ways to bank accounts, in that they can be used to hold and transfer assets. In the same way a thief can transfer funds from a bank account if they gain access to that account, thieves can also transfer cryptocurrency assets if they gain access to the keys to the wallet holding digital assets.

Following the alleged theft, LCX and its third-party consulting firm determined that the suspected thieves used “Tornado Cash,” which is a “mixing” service designed to hide transactions on an otherwise publicly available blockchain ledger by using complicated transfers between unrelated wallets. While Tornado Cash and other mixing services have legal purposes such as preserving the anonymity of parties to legitimate transactions, they are also utilized by criminals to launder digital funds in an illicit manner.

Even the use of these mixing services, however, can often also be unwound. This is especially true in transactions of large amounts of cryptocurrency, similar to how transactions utilizing complex money laundering schemes in the international banking system can be unwound. According to the blockchain data platform Chainalysis, although Illicit crypto transactions reached an all-time high of $14 billion in 2021, these suspected nefarious transactions accounted for 0.15% of crypto volume last year, down from 0.62% in 2020.

While the Complaint alleges the suspected thieves used Tornado Cash, LCX believes its hired consultants were able to unwind those mixing services to identify a wallet which is alleged to still hold $1.274 million of the allegedly stolen assets.

Unlike bank accounts which have associated identifying information, there are often no registered addresses or other identifying information connected to digital wallets. This makes it difficult to provide the actual proof of service required to institute an action or obtain a judgement against an individual where the only known information is their digital wallet addresses. Service via token airdrop into those wallet addresses solves that issue.

Service Via Airdrop

Service of lawsuits is traditionally made on the defendant personally at a home or business address via special process servers. In cases where service on the individual is not possible for some reason, many states authorize alternative means of service if the plaintiff can show that the alternative means of service likely to provide actual notice of the litigation to the defendant. For example, courts have historically allowed notice via newspaper publication as an alternative means of service where the defendant cannot be serviced personally.

Here, the Court permitted service via “airdrop” in which a digital token is placed in a specific cryptocurrency wallet, similar to how a direct deposit can place funds in a traditional bank account. This particular token contained a hyperlink to the associated court filings in the case, and a mechanism which allowed the data of any individual who clicked on the hyperlink to be tracked. While this is a novel way to serve notice of a lawsuit, similar airdrops have been used to communicate with the owners of otherwise anonymous cryptocurrency wallet owners. Such was the case recently when actor Seth Green had his Bored Ape non-fungible token (“NFT”) stolen and the unknowing buyer of the stolen NFT was otherwise difficult to locate.

While this type of digital service is new, it could be implemented in many disputes in the future regarding digital assets. Similar to the authorization of service that was seen recently in the Facebook Biometric Information Privacy Act litigation (where notice was served on potential class members via email and directly on the Facebook platform), service via airdrop may be the most efficient way to inform potential lawsuit participants of the pending dispute and how they can protect their rights in that dispute.

This type of airdropped service is not without issues, though. First, transactions on the blockchain are largely publicly available, meaning any individual with the wallet address would also be able to see service of the lawsuit notice. Additionally, many users are hesitant to click on unknown links (such as the one in the airdropped LCX) due to legitimate cybersecurity concerns.

While service via airdropped token is unlikely to replace traditional methods of service, it may be a useful means of serving process on unknown persons where there is a digital wallet linked to the acts which the applicable lawsuit relates.

Article By Bryan M. Westhoff, Daniel L. McAvoy, and Jonathan E. Schmalfeld of Polsinelli PC

For more litigation legal news, click here to visit the National Law Review.

Italian Garante Bans Google Analytics

On June 23, 2022, Italy’s data protection authority (the “Garante”) determined that a website’s use of the audience measurement tool Google Analytics is not compliant with the EU General Data Protection Regulation (“GDPR”), as the tool transfers personal data to the United States, which does not offer an adequate level of data protection. In making this determination, the Garante joins other EU data protection authorities, including the French and Austrian regulators, that also have found use of the tool to be unlawful.

The Garante determined that websites using Google Analytics collected via cookies personal data including user interactions with the website, pages visited, browser information, operating system, screen resolution, selected language, date and time of page views and user device IP address. This information was transferred to the United States without the additional safeguards for personal data required under the GDPR following the Schrems II determination, and therefore faced the possibility of governmental access. In the Garante’s ruling, website operator Caffeina Media S.r.l. was ordered to bring its processing into compliance with the GDPR within 90 days, but the ruling has wider implications as the Garante commented that it had received many “alerts and queries” relating to Google Analytics. It also stated that it called upon “all controllers to verify that the use of cookies and other tracking tools on their websites is compliant with data protection law; this applies in particular to Google Analytics and similar services.”

Article By the Privacy and Cybersecurity Practice Group at Hunton Andrews Kurth

For more data privacy and cybersecurity legal news, click here to visit the National Law Review.

Category: Communication Media & Internet

New Survey Shows that Americans are Ready for More Deliveries by Drone

Like this:

NYS Sexual Harassment Hotline Goes Live

Like this:

Government Brings First Cryptocurrency Insider Trading Charges

Like this: