Some old, some new requirements in NH and NJ laws

Two new US state laws have been approved for New Jersey and New Hampshire already this year. As part of our commitment to keeping up with the latest law requirements, we have pulled out a few takeaways. Quick Overviews The essence of the New Jersey and New Hampshire privacy laws, otherwise referr...

Balancing user convenience and consent in system updates

Over Thanksgiving, a Facebook post from a local community police department caught my attention, warning about an automatic feature called NameDrop in the Apple iOS17 update. Once I returned to work, I decided to delve into the issue surrounding this automatic feature. It also reminded me that th...

Privacy Ref and CyberDefenses Bring Privacy and Security Together

There is a saying that you can have security without privacy, but you cannot have privacy without security. While privacy and security are both concerned with the protection of information held by an organization, security provides the means to meet the business requirements identified to meet pr...

Privacy Impact Assessments: Organization-specific or Generic PIAs

I recently had a conversation with a colleague about privacy impact assessments, PIAs, and the tools available to administer them. We quickly became philosophical, trying to weigh whether a generic tool would work or if something that is organization specific is necessary.

Safe Harbor Found “Invalid”, Now What?

Transferring personal information from the EU to the US has been a challenge. Today it may have become more difficult with the EU Court of Justice finding that Safe Harbor is invalid. For those 4,000 or so businesses that use Safe Harbor for data transfers the question  is how to go ahead.

Tom Brady, Joe Namath, and Privacy

Like many Americans I grew up idolizing football players, quarterbacks in particular. Joe Namath and Tom Brady are among those I have enjoyed watching play. Who would of thought that these two men who played in different eras would provide examples for a privacy discussion for business.

Crisis Communication Plans and Data Breaches

Think of a data breach as not only a possibility, but also a likely crisis scenario for your company. A breach will cost your company not only money but can deeply damage its reputation. When was the last time your company reviewed its crisis communication scenarios and, most importantly, added d...

“It’s only an email address!”

Facebook, Ubisoft, and Morningstar are all recent examples of data breaches that involved the unauthorized release of email addresses. In one of several conversations I have had about these events some people could not understand why others were upset about the release; after all, they are only e...

Privacy and the Cloud

Cloud computing provides an opportunity for businesses to lower costs and increase their computing infrastructure’s flexibility. When utilizing a cloud service provider for additional storage, computing power, or a full application you should look into the privacy implications as these are ...

SMB privacy: no free pass

Like larger enterprises, small and medium businesses (SMBs) collect personal information about their customers, employees, vendors and other stakeholders; it is just part of doing business. Establishing an SMB privacy program would be very beneficial for these businesses, but for the majority of ...