January 26, 2023

5 Trends to Watch: 2023 Data Privacy & Cybersecurity

You've Reached Your
Free Article Limit This Month
Register for free to get unlimited access to all OnPractice content.
Register Now
  1. An Increase in Extortion-Only Cyber Attacks - While ransomware attacks have been on the rise since 2020, a recent trend has emerged where threat actors are bypassing ransomware malware and encryption tactics and going straight to data theft. If a victim company does not pay the extortion demand, the threat actors engage in increasingly aggressive tactics, like publicly posting the stolen data for sale on a shame site and contacting employees and customers of the victim company to apply external pressure on the victim to make the payment.

  2. Continued Increase in Legal Requirements for Company-Held Data - An increasing number of proposed data security laws and regulations, such as the FTC Safeguards Rule and the EU NIS2 Directive that came into force in 2023, are mandating specific data security measures for companies regulated by those laws, in particular, financial institutions and other highly-regulated industries. These granular laws are leaving behind the more general requirements of the past, which required companies to implement and maintain more vague "reasonable and appropriate" security standards, in favor of requirements that more closely align with recognized data security standards (e.g., NIST, ISO). The laws prescribe not only security measures, but also policies and procedures, incident response plans, and accountability.

  3. Increasing Vendor Due Diligence - Conducting diligence on vendor data security practices has arguably risen to the level of industry standard and practice. Conducting due diligence on vendor data privacy practices, including such things as how they handle law enforcement requests, the countries to which they transfer personal information, and their relationships with subprocessors, is less common. Facing increasing scrutiny (and significant fines for breaches) from regulators in the United States and in the European Union regarding the use of processors, controllers are increasingly demanding more information about their vendors' data privacy practices including requesting that vendors substantiate that they have "flowed down" privacy-related provisions found in their data processing agreements (DPA) to subprocessors. For a guide on how to apply the new European Standard Contractual Clauses to all contracts, see Greenberg Traurig's Complete Handbook for Cross Border Transfers of Personal Information.

  4. Enforcement of California's Privacy Law -In August 2022, the California Attorney General's office published its first enforcement action and imposed its first fine in relation to an eCommerce website's use of targeted advertising technology. Although enforcement of the California Privacy Rights Act (CPRA) is not permitted until July of 2023, the California Attorney General may attempt to ramp up its enforcement of the California Consumer Privacy Act (CCPA) until that date. After July, it is likely the California Privacy Protection Agency will try to make its mark by initiating enforcement actions and warnings to companies that have not updated their compliance programs to account for the new law.

  5. More Privacy Class Action Litigation Based on Wiretapping Laws - "Session replay" refers to a tool that records and analyzes customers' interactions with a business's website or phone application to improve functionality and user experience. Over the last few years, a trend has emerged of plaintiffs alleging the use of session replay software violates anti-wiretapping laws which were intended to prevent eavesdropping and secret recordings. It is likely that plaintiffs will continue to assert these arguments in an attempt to impose statutory damages through litigation by shoehorning AdTech tools into violations of wiretapping statutes.

ALM expressly disclaims any express or implied warranty regarding the OnPractice Content, including any implied warranty that the OnPractice Content is accurate, has been corrected or is otherwise free from errors.

More From Greenberg Traurig

The New York Court of Appeals: A Triumph of Merit Selection

By Henry M. Greenberg Greenberg Traurig May 25 , 2023

The current court is a triumph of the merit selection process that New Yorkers voted for in 1977.

Attorney Fees Awards Under the Clean Streams Law

By David Mandelbaum Greenberg Traurig May 24 , 2023

In February, the Pennsylvania Supreme Court decided that the Environmental Hearing Board could award attorney fees and litigation costs to a prevailing third-party appellant under the Clean Streams Law.

GT's The Performance Review Episode 20: All Secrets Revealed: Employee Investigations

By Philip I. Person Greenberg Traurig May 24 , 2023

In this episode, Sue Ann Van Dermyden, co-founder and senior partner at one of the nation’s top investigations firms, joins Philip Person and Ryan Bykerk to discuss the ins and outs of employee investigations.

More From Cybersecurity

Labor Department Releases New Guidance on Agency Enforcement of PUMP for Nursing Mothers Act

By Patricia Anderson Pryor Jackson Lewis P.C. May 19 , 2023

The U.S. Department of Labor Wage and Hour Division (WHD) has published guidance for agency officials responsible for enforcing the “pump at work” provisions of the Fair Labor Standards Act (FLSA), including those enacted under the 2022 Providing Urgent Maternal Protections for Nursing Mothers Act (PUMP Act).

Finding the Delta: Understanding the Differences in How State Privacy Laws Define Corporate Affiliates

By David A. Zetoony Greenberg Traurig May 15 , 2023

All modern privacy statutes regulate when personal information can be shared with third parties, whether those third parties are service providers, vendors, contractors, or business partners.

Florida Adds a New Twist to Consumer Privacy Patchwork

By David P. Saunders McDermott Will & Emery May 10 , 2023

On May 9, 2023, the Florida legislature passed the Florida Digital Bill of Rights (FDBR), which adds a new twist to the growing body of state consumer privacy laws.

Featured Stories