Category Archives: Uncategorized

Recent developments surrounding 23andMe’s bankruptcy proceedings and the proposed transfer of millions of consumers’ genetic profiles have intensified scrutiny of the fragmented legal framework governing biometric and genetic privacy in the United States.

Over the past week, renewed public and regulatory attention has focused on one of the most consequential privacy controversies in recent years: the treatment of consumer genetic data during the bankruptcy and restructuring of direct‑to‑consumer DNA testing company 23andMe. Regulators, consumer advocates, and lawmakers continue to raise concerns regarding whether highly sensitive genetic information may be transferred, sold, or repurposed during insolvency proceedings with insufficient consumer protections.

The controversy has exposed significant structural weaknesses in U.S. privacy law. Unlike financial records or traditional healthcare data maintained by HIPAA‑covered entities, consumer genetic information collected by direct‑to‑consumer testing companies frequently falls outside comprehensive federal privacy regulation. As a result, millions of consumers who voluntarily submitted DNA samples for ancestry and wellness purposes now face uncertainty regarding how their immutable genetic information may be handled during corporate restructuring, acquisition, or liquidation.

At the center of the issue lies a broader legal question: whether existing privacy and bankruptcy laws are adequate to protect highly sensitive biological data in an era of increasingly valuable consumer genomics.

This article examines the legal implications of the 23andMe proceedings, the intersection of bankruptcy and privacy law, and the emerging compliance considerations for organizations handling genetic and biometric data.

---

I. Why Genetic Data Occupies a Unique Legal Category

A. The Sensitivity and Permanence of Genetic Information

Genetic data is fundamentally different from most categories of personal information. DNA data can reveal:

• Familial relationships
• Disease predispositions
• Ethnic and ancestral background
• Behavioral and biological characteristics

Unlike passwords or financial account numbers, genetic data cannot realistically be changed after exposure or misuse. Moreover, genetic information implicates not only the individual consumer, but also biological relatives and future generations.

Courts, regulators, and scholars increasingly characterize genetic information as among the most sensitive categories of personal data in existence.

---

B. Limited Federal Protection

Despite its sensitivity, consumer genetic data remains subject to a fragmented regulatory framework.

1. HIPAA Limitations

The Health Insurance Portability and Accountability Act (HIPAA) generally applies only to:

• Covered entities
• Healthcare providers
• Health plans
• Business associates

Direct‑to‑consumer genetic testing companies often fall outside HIPAA’s scope because they operate directly with consumers rather than within traditional healthcare ecosystems.

As a result, many consumers incorrectly assume that genetic testing companies are governed by the same legal standards applicable to hospitals and insurers.

---

2. GINA’s Narrow Scope

The Genetic Information Nondiscrimination Act (GINA) provides certain protections against discrimination in:

• Employment
• Health insurance underwriting

However, GINA does not comprehensively regulate:

• Data retention
• Data sales
• Commercial transfers
• Bankruptcy proceedings
• Life or disability insurance uses

This leaves substantial gaps in consumer protection.

---

II. The Bankruptcy Problem: Data as a Transferable Asset

A. Genetic Data in Corporate Insolvency

The 23andMe proceedings have highlighted a difficult reality: personal data is often treated as a transferable business asset during bankruptcy.

Under Section 363 of the Bankruptcy Code, companies may sell assets during restructuring proceedings. Those assets may include:

• Customer databases
• User profiles
• Research datasets
• Genetic information repositories

Because consumer genomic databases possess substantial commercial and pharmaceutical value, they can become among the most significant assets in a bankruptcy estate.

---

B. Privacy Policies and Bankruptcy Transfers

The Bankruptcy Code imposes certain limitations on transfers of personally identifiable information (PII). Specifically, transfers generally must remain “consistent with” the company’s existing privacy policy unless additional protections are implemented.

However, this framework presents several challenges:

• Privacy policies are often broad and discretionary
• Consumers rarely understand downstream transfer implications
• Policies may permit amendment after acquisition
• Bankruptcy courts historically prioritize creditor recovery

These concerns became particularly acute given the scale of the genetic datasets involved.

---

C. Appointment of a Consumer Privacy Ombudsman

In response to mounting regulatory pressure, the bankruptcy court approved the appointment of a consumer privacy ombudsman to oversee data handling and evaluate the privacy implications of any sale or transfer.

This development is notable because it reflects increasing judicial recognition that:

• Genetic information creates extraordinary privacy risks
• Traditional bankruptcy procedures may inadequately protect consumers
• Data governance considerations are becoming central to restructuring proceedings

---

III. International and Regulatory Reactions

A. FTC and State Attorney General Concerns

The Federal Trade Commission and multiple state attorneys general expressed concerns regarding the handling of consumer genetic data during the proceedings.

Regulators emphasized risks involving:

• Secondary use of genetic data
• Transfers to unknown purchasers
• Inadequate consent mechanisms
• Data security vulnerabilities

Several attorneys general publicly advised consumers to:

• Delete stored genetic data
• Withdraw research consent
• Request destruction of biological samples

---

B. International Data Protection Concerns

International regulators also intervened. The UK Information Commissioner’s Office (ICO) and Canada’s Office of the Privacy Commissioner issued joint statements emphasizing that any purchaser of 23andMe assets would remain subject to applicable privacy laws governing genetic data.

The ICO specifically noted concerns regarding:

• Genetic profiles
• Health reports
• Self‑reported medical conditions
• Long‑term downstream use of data

This demonstrates the increasingly global nature of genetic privacy governance.

---

IV. Emerging Legislative Responses

A. State Genetic Privacy Laws

Recent legislative activity suggests growing momentum toward stronger protections for genetic information.

Several states have enacted or proposed laws addressing:

• Explicit consent for genetic data transfers
• Consumer deletion rights
• Restrictions on secondary use
• Enhanced disclosure obligations

Rhode Island lawmakers recently advanced legislation prompted in part by concerns arising from the 23andMe proceedings.

---

B. Proposed Federal Reforms

Privacy advocates and legislators have also renewed calls for federal reform, including proposals such as the “Don’t Sell My DNA Act.”

Potential reform areas include:

• Opt‑in consent requirements for transfers
• Bankruptcy‑specific privacy restrictions
• Mandatory deletion rights
• Expanded FTC authority

Whether Congress will enact comprehensive legislation remains uncertain, but the political momentum surrounding genetic privacy continues to increase.

---

V. Compliance Implications for Organizations

Organizations collecting biometric or genetic information should view the 23andMe controversy as a significant compliance warning.

1. Data Minimization

Organizations should collect and retain only data reasonably necessary for defined purposes. Data minimization remains one of the most effective risk‑reduction mechanisms.

---

2. Enhanced Consent Mechanisms

Consent frameworks should clearly address:

• Research uses
• Potential corporate transactions
• Data sharing practices
• Long‑term retention policies

---

3. Bankruptcy and M&A Preparedness

Privacy governance programs should incorporate:

• Transactional data transfer protocols
• Consumer notification procedures
• Due diligence regarding privacy representations
• Restrictions on downstream purchaser use

---

4. Vendor and Third‑Party Oversight

Organizations partnering with genetic testing or biometric analytics providers should carefully evaluate:

• Security controls
• Data retention practices
• Cross‑border transfer risks
• Contractual limitations on data use

---

5. Incident Response and Security

Given the sensitivity of genetic information, organizations should implement:

• Multi‑factor authentication
• Encryption protocols
• Access controls
• Continuous monitoring mechanisms

The 2023 breach affecting millions of 23andMe users illustrates the severe consequences of inadequate safeguards.

---

Conclusion

The 23andMe bankruptcy proceedings have become a defining moment in modern privacy law, exposing profound gaps in the United States’ regulatory approach to genetic information. The controversy underscores that genetic data cannot be treated as an ordinary commercial asset; its sensitivity, permanence, and familial implications demand heightened legal protections.

As lawmakers, regulators, and courts continue grappling with these issues, organizations handling genetic and biometric data must proactively strengthen governance frameworks, reassess consent and retention practices, and prepare for increased regulatory scrutiny.

If your organization requires guidance regarding genetic privacy compliance, biometric data governance, consumer consent frameworks, or privacy considerations in mergers, acquisitions, or bankruptcy proceedings, please contact us at:

LR Law PLLC Contact Us Page

California’s forthcoming enforcement of the Delete Act’s centralized deletion mechanism (DROP) signals a structural shift in U.S. privacy regulation, requiring data brokers to operationalize large‑scale consumer deletion requests while confronting heightened regulatory scrutiny and accountability.

The United States privacy landscape continues to evolve toward stronger consumer control over personal information. Among the most consequential developments in the past week has been increased attention to California’s Delete Act, which establishes a centralized consumer deletion system requiring registered data brokers to delete personal information upon request through a single portal known as the Data Broker Requests and Opt‑Out Platform (DROP).

This regulatory innovation marks one of the most ambitious structural interventions in the data broker ecosystem to date. Unlike earlier privacy statutes that required consumers to individually contact each company holding their data, the Delete Act introduces a unified mechanism enabling consumers to issue a single deletion request that must be honored across the entire data broker registry.

The implications for organizations operating in the data brokerage sector—or companies indirectly relying on brokered datasets—are profound. The law imposes new operational, technical, and legal obligations that will reshape data governance practices, vendor management, and compliance architecture.

This article analyzes the Delete Act’s framework, the compliance obligations facing regulated entities, and the broader ramifications for the U.S. privacy regulatory environment.

---

I. The Delete Act: Statutory Framework and Policy Objectives

California enacted the Delete Act (SB 362) to strengthen consumer rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) by targeting a specific and often opaque sector of the digital economy: data brokers.

Data brokers are entities that collect, aggregate, and sell personal information about individuals with whom they typically have no direct relationship. These entities frequently obtain data from third‑party sources, including advertising networks, public records, online services, and consumer data suppliers.

Under prior frameworks, consumers theoretically possessed deletion rights under the CCPA. In practice, however, exercising those rights proved burdensome because individuals were required to identify and contact each broker independently.

The Delete Act addresses this enforcement gap by creating a centralized system that dramatically simplifies the process for consumers while simultaneously imposing systemic obligations on registered brokers.

---

II. The DROP System: Centralized Consumer Deletion Requests

The cornerstone of the Delete Act is the Data Broker Requests and Opt‑Out Platform (DROP), administered by the California Privacy Protection Agency (CPPA).

The system allows California residents to submit a single deletion request, which is then transmitted to all data brokers registered with the state. Each broker must subsequently delete the consumer’s personal information within a defined timeframe and confirm compliance.

The design reflects a regulatory philosophy increasingly visible in modern privacy law: shifting the burden of compliance from individuals to organizations that process personal data.

According to early reporting, the system could generate large volumes of simultaneous deletion requests, requiring data brokers to rapidly scale technical infrastructure and operational procedures.

---

III. Compliance Obligations for Data Brokers

Entities qualifying as data brokers under California law must prepare for several key obligations under the Delete Act.

A. Mandatory Data Deletion

Upon receipt of a DROP request, a broker must delete personal information associated with the consumer across its systems and any downstream uses.

This obligation extends to:

• Data warehouses
• Analytics datasets
• Third‑party sharing arrangements
• Derived profiles and aggregated data where identifiable

In addition, brokers must ensure that deleted data is not subsequently re‑collected or reintroduced through third‑party sources without appropriate safeguards.

B. Verification and Authentication Mechanisms

Companies must implement procedures to verify the identity of consumers submitting deletion requests through DROP while ensuring compliance with data minimization principles.

Over‑collection of verification data itself presents a potential compliance risk under California law and other privacy regimes.

C. Vendor and Downstream Partner Controls

Because brokered data frequently flows through complex supply chains, organizations must ensure that deletion requests propagate through:

• Data processors
• Data buyers
• Partner platforms

This requirement introduces a contractual and technical cascade across the data ecosystem.

D. Annual Auditing and Recordkeeping

The Delete Act also introduces enhanced oversight mechanisms, including audit requirements and reporting obligations designed to ensure brokers are properly honoring deletion requests.

Documentation will likely become a critical element of defensible compliance programs.

---

IV. Operational Challenges for the Data Broker Industry

While the DELETE Act’s objective—enhancing consumer privacy—is widely supported, the operational challenges it creates for industry participants are substantial.

1. High‑Volume Request Processing

Centralized opt‑out mechanisms may trigger large spikes in requests immediately after launch. Brokers must therefore build scalable infrastructure capable of processing mass deletion events.

2. Data Mapping Complexity

Many brokers rely on fragmented or legacy datasets that lack clear indexing by consumer identity. Locating all instances of a particular consumer’s data may require extensive data mapping and restructuring.

3. Supply Chain Coordination

Because data brokers often distribute data to multiple partners, effective deletion may require real‑time communication across distributed data networks.

4. Re‑Collection Risks

Even after deletion, brokers must ensure that automated ingestion pipelines do not inadvertently re‑import the same data from third‑party sources.

These challenges illustrate how privacy regulation is increasingly transforming technical architecture, not merely legal documentation.

---

V. Broader Regulatory Implications

The Delete Act’s centralized deletion framework could become a model for future privacy legislation across the United States.

Several states are already considering similar mechanisms for regulating data brokers and enhancing consumer control over personal information.

Meanwhile, broader concerns about the data broker ecosystem—including the potential use of brokered data for government surveillance and location tracking—have intensified scrutiny of the sector.

These developments suggest that regulators view data brokers as a focal point for addressing systemic privacy risks in the digital economy.

---

VI. Strategic Compliance Considerations

Organizations that operate as data brokers—or rely heavily on brokered datasets—should consider implementing several proactive measures:

1. Comprehensive Data Inventory and Mapping

Maintaining a precise inventory of personal data assets and flows is essential for efficiently identifying records subject to deletion requests.

2. Automated Deletion Workflows

Companies should implement automated workflows capable of executing deletion commands across multiple systems simultaneously.

3. Vendor Governance Frameworks

Contracts with data partners should include provisions requiring compliance with deletion requests and cooperation with regulatory investigations.

4. Consumer Request Management Systems

Organizations should deploy tools that integrate with centralized platforms like DROP while maintaining audit trails documenting compliance.

5. Privacy‑by‑Design Data Collection

Long‑term compliance may require rethinking data collection strategies, including minimizing the acquisition of personal data where possible.

---

Conclusion

California’s Delete Act represents a significant evolution in U.S. privacy regulation by fundamentally reconfiguring how consumers exercise their deletion rights against data brokers. The introduction of the centralized DROP system transfers the burden of operational complexity from individuals to organizations that collect and monetize personal data.

For data brokers and organizations reliant on brokered datasets, the coming months will require substantial investments in compliance infrastructure, data governance processes, and technical deletion capabilities.

If your organization needs guidance on navigating Delete Act compliance, building defensible deletion workflows, or assessing regulatory exposure under evolving state privacy laws, please contact us for assistance at: https://lrlawpllc.com/contact-us/

As California’s Delete Act (SB 362) officially rolls out the Drop Request and Opt‑out Platform (DROP) beginning January 1, 2026, data brokers and digital platforms face the first U.S. state‑level statutory mechanism empowering consumers to demand deletion of their personal data at scale — a development that will reverberate across federal and state privacy compliance strategies.

Compliance

Subheading:
As California’s Delete Act (SB 362) officially rolls out the Drop Request and Opt‑out Platform (DROP) beginning January 1, 2026, data brokers and digital platforms face the first U.S. state‑level statutory mechanism empowering consumers to demand deletion of their personal data at scale — a development that will reverberate across federal and state privacy compliance strategies.

---

Introduction

On January 1, 2026, California’s Delete Act went into effect with full activation of its DROP mechanism — a centralized deletion and opt‑out platform for data subjects to demand removal of their personal information from registered data brokers. This statutory enforcement marks a watershed in American privacy law because it introduces mandatory operational deletion obligations for a broad class of data controllers, with deadlines, enforcement expectations, and audit requirements unprecedented in the U.S. statutory landscape.

While California has long been at the vanguard of state privacy regulation — beginning with the California Consumer Privacy Act (CCPA) and its amendment via the California Privacy Rights Act (CPRA) — the Delete Act extends privacy obligations into the once opaque world of data brokers, compelling them to operationalize deletion rights in a manner analogous to GDPR’s right to erasure (Art. 17).

This post analyzes the Delete Act’s compliance implications, enforcement mechanisms, operational challenges, and strategic considerations for privacy professionals and legal counsel advising entities subject to Californian and interstate data privacy regimes.

---

What Is the Delete Act and DROP?

The Delete Act (California Civil Code § 1798.99) represents a legislative effort to give consumers a centralized, one‑stop mechanism to demand deletion of personal data from data brokers — entities that collect, aggregate, or sell personal information about individuals that they do not directly interact with. DROP, administered by the California Privacy Protection Agency (CPPA), became available to consumers as of January 1, 2026.

Key features include:

• Mandatory Registration: Data brokers must register annually with the CPPA to remain operational.
• Deletion Obligations: Brokers are required to begin processing and respond to deletion requests submitted through DROP no later than August 1, 2026.
• Audit Requirements: Beginning January 1, 2028, brokers must undergo independent compliance audits triennially, with results submitted to the CPPA.
• Consumer Empowerment: Californians can submit deletion requests centrally — instead of contacting each broker individually — thereby streamlining enforcement of privacy rights historically difficult to exercise in practice.

These provisions build on CCPA/CPRA rights, such as access, deletion, and opt‑out, while introducing a statutory deletion mechanism unique in the U.S. context.

---

Strategic Compliance Implications

The Delete Act’s enforcement brings several operational and legal dimensions that stakeholders must navigate:

1. Expanded Duty to Act — Material Processing Obligations

Prior state privacy laws primarily obligated entities to provide notice, facilitate consumer requests, and implement privacy rights such as access and opt‑out. The Delete Act goes a step further by imposing a *processing obligation to *actively delete data upon request, with timelines and expectations defined by statute and regulation. This shift has meaningful implications for internal data governance and record retention policies.

From a legal perspective, deletion obligations intersect with other statutes (e.g., financial recordkeeping, health privacy laws under HIPAA where retention is mandated). Organizations must carefully harmonize deletion workflows with other compliance imperatives to avoid conflicting legal obligations — an exercise well‑familiar to counsel advising on complex regulatory intersections.

---

2. Enforcement Expectations and Risk Management

The CPPA oversees enforcement of the Delete Act. Non‑compliance with deletion requests or registration requirements may expose registrants to administrative penalties and enforcement actions (mirroring CPRA enforcement mechanisms).

• Administrative Penalties: The CPPA can impose fines for each violation as determined by the statutory framework.
• Audit Exposure: Mandatory audits create a systematic compliance check that can reveal broader systemic weaknesses in governance, controls, and documentation.

Legal teams should embed audit readiness into operational planning, with clear data inventory, deletion workflows, verification procedures, and evidence of timely responses to deletion requests.

---

3. Operational Challenges and Process Integration

Implementing deletion requests at scale — especially for large brokers with millions of records — presents unique challenges:

• Identity Verification: Ensuring that deletion requests are legitimate is paramount to avoid wrongful deletion of unrelated persons’ data, a concern amplified where individuals share common identifiers.
• Data Mapping: Effective compliance necessitates comprehensive data mapping to ensure that deletion directives extend to all relevant systems, including third‑party processors and downstream recipients where contractual frameworks permit.
• Interfacing with Regulatory Timelines: Operational processes must be synchronized with statutory deadlines (e.g., the August 1, 2026 effective response deadline, and Jan. 1, 2028 audit requirements), requiring governance controls that can withstand external scrutiny.

These operational dimensions echo broader compliance governance themes — privacy by design, accountability, and robust vendor management — that privacy professionals have long championed.

---

Comparative Perspective: California and GDPR

While the Delete Act stands as a uniquely American statutory construct, it parallels certain GDPR principles:

• Right to Erasure (GDPR Art. 17): GDPR grants EU residents the right to have personal data erased where certain conditions are met. The Delete Act operationalizes a similar outcome but targets the ecosystem of data brokers rather than data controllers more broadly.
• Transparency and Access: GDPR emphasizes transparency of processing and access rights; the Delete Act augments this by providing a centralized mechanism for consumers to enforce those rights against intermediaries historically resistant to such demands.

For global counsel advising multinational clients, drawing these parallels underscores the necessity of harmonized privacy programs that can accommodate state privacy rights alongside international obligations.

---

Interplay With Other U.S. Privacy Laws

The Delete Act simultaneously interacts with the broader landscape of U.S. privacy regulation:

• In 2025–2026, 20 states now have comprehensive consumer privacy laws with varying definitions of personal data, rights, and obligations — requiring nuanced compliance frameworks across jurisdictions.
• Other states’ laws (e.g., Indiana, Rhode Island) also went into effect on January 1, 2026, each imposing unique requirements such as privacy policy content or consumer rights mechanics.

Holistic compliance thus requires cross‑jurisdictional coordination, ensuring that entities subject to multiple regimes integrate rights, obligations, and operational processes in a unified governance system.

---

Best Practices for Compliance Teams

To navigate the Delete Act’s requirements effectively, organizations should consider the following:

Conduct a Data Broker Inventory and Mapping

• Identify all operational data brokers subject to the Delete Act and maintain an updated registry of such entities.
• Map categories of personal data, processing purposes, and retention schedules to facilitate deletion responses upon request.

Implement Robust Identity Verification Controls

• Ensure that consumers submitting deletion requests are verified in a consistent, secure manner before deletion workflows initiate.

Integrate Deletion Workflows Across Systems

• Embed deletion directives into internal systems and contracts with processors to ensure end‑to‑end compliance.

Design for Audit Readiness

• Establish documentation protocols, logging of deletion request responses, and evidence of compliance measures to support upcoming audit cycles.

---

Conclusion

California’s Delete Act represents a transformative development in U.S. privacy law — one that elevates operational deletion obligations into statutory compliance responsibilities with tangible deadlines and oversight expectations. As DROP becomes fully operational in 2026, data brokers and entities processing brokered personal data must adapt internal systems, governance mechanisms, and legal strategies to address deletion, transparency, and audit requirements.

This new frontier in privacy compliance underscores a broader trend toward empowering individuals and imposing accountability obligations on intermediaries that have historically escaped rigorous scrutiny. Organizations that anticipate these trends and implement structured, defensible programs will be better positioned to manage regulatory risk, preserve consumer trust, and align with emerging norms across jurisdictions.

If your organization needs guidance on the Delete Act, multi‑state privacy compliance strategies, or implementation of deletion, access, and opt‑out mechanisms in operational workflows, please contact us at https://lrlawpllc.com/contact-us/.

Navigating the Complexities of Data Protection in the Wake of 23andMe’s Bankruptcy

The recent bankruptcy filing of 23andMe, a pioneer in direct-to-consumer genetic testing, has ignited significant concerns regarding the privacy and security of sensitive genetic data. With over 15 million customers entrusting their DNA information to the company, questions arise about the fate of this highly personal data amidst financial turmoil. This development underscores the pressing need for robust data protection measures and comprehensive legal frameworks to safeguard individuals’ genetic information.​

Background on 23andMe’s Bankruptcy

Founded in 2006, 23andMe offered consumers insights into their ancestry and health predispositions through genetic testing. Despite its initial success and a valuation reaching up to $6 billion after going public in 2021, the company faced declining demand for its services and suffered a significant data breach in 2023. These challenges culminated in a voluntary Chapter 11 bankruptcy filing, aiming for a court-supervised sale of its assets, including its extensive genetic data repository.

Legal and Ethical Implications

The bankruptcy of a company handling sensitive genetic data presents unique legal and ethical challenges:

Data Ownership and Control: Customers have the right to control their personal information. However, bankruptcy proceedings may complicate the enforcement of these rights, especially if data assets are sold to third parties.

Regulatory Oversight: The absence of comprehensive federal privacy legislation in the U.S. places the onus on state laws to protect consumer data. States like California, New York, and Indiana have reminded customers of their rights to request data deletion under existing privacy laws.

Role of Privacy Ombudsman: In bankruptcy cases involving significant personal data, the appointment of a privacy ombudsman can oversee the sale and transfer of data assets, ensuring compliance with privacy laws and ethical standards.​

Consumer Actions and Recommendations

In light of 23andMe’s bankruptcy, consumers should take proactive steps to protect their genetic information:​

Request Data Deletion: Utilize the company’s data deletion procedures to remove personal information from their databases. Detailed instructions are typically available on the company’s website. ​

Stay Informed: Monitor communications from 23andMe and relevant regulatory bodies regarding the status of personal data and any actions required

Advocate for Stronger Protections: Support initiatives aimed at enacting comprehensive data privacy legislation to prevent similar issues in the future.

The downfall of 23andMe serves as a critical reminder of the vulnerabilities associated with the handling of sensitive genetic data. It highlights the urgent need for robust legal frameworks and proactive consumer engagement to ensure the protection of personal information in an era where data is a valuable asset.​

For personalized guidance on navigating data privacy challenges and ensuring compliance with evolving regulations, contact us. Our team of experienced data privacy attorneys is here to assist you in safeguarding your personal information and upholding your privacy rights.

Understanding the Intersection of AI and Data Privacy

Artificial Intelligence (AI) has become a cornerstone of modern business operations, driving innovation and efficiency across various sectors. However, as AI systems increasingly process vast amounts of personal data, concerns about data privacy have escalated. Businesses must navigate the complex landscape where AI and data privacy intersect to maintain compliance and foster consumer trust.

The Data-Hungry Nature of AI

AI systems thrive on data, utilizing large datasets to learn patterns and make decisions. This dependency raises significant privacy concerns, as the collection and processing of personal information can lead to unauthorized use or exposure. The scale of data handled by AI amplifies these risks, making robust privacy protections essential.

Regulatory Responses to AI and Data Privacy

In response to these challenges, regulatory bodies worldwide are implementing frameworks to govern AI’s use of personal data. The European Union’s General Data Protection Regulation (GDPR) addresses automated decision-making and profiling, emphasizing the need for transparency and accountability in AI systems.

Similarly, the proposed EU AI Act seeks to impose strict compliance requirements on AI applications, categorizing them based on risk levels and mandating robust risk management protocols.

Best Practices for Businesses

To align with evolving regulations and protect consumer data, businesses should consider the following practices:

• Data Minimization: Collect only the data necessary for specific AI functions to reduce exposure risks.
• Transparency: Clearly inform users about data collection practices and the purposes of AI processing.
• Robust Security Measures: Implement advanced security protocols to safeguard data against breaches.
• Regular Audits: Conduct periodic assessments of AI systems to ensure compliance and identify potential vulnerabilities.
• Human Oversight: Maintain human involvement in AI decision-making processes to address biases and errors effectively.

The Role of Privacy-Enhancing Technologies

Privacy-enhancing technologies (PETs) are instrumental in mitigating AI-related privacy risks. Techniques such as differential privacy, homomorphic encryption, and federated learning enable data analysis while preserving individual privacy.

Conclusion

As AI continues to evolve, businesses must proactively address data privacy concerns to comply with regulations and maintain consumer trust. Implementing best practices and leveraging PETs can help navigate the complexities of AI-driven data processing. For personalized guidance on integrating AI responsibly within your organization, contact us.

Navigating the Legal Landscape of the My Health My Data Act in the Wake of Emerging Litigation

In a landmark legal development, an online retailer has been targeted with the inaugural class-action lawsuit under Washington State’s My Health My Data Act (MHMDA). The lawsuit alleges that the retailer unlawfully harvested sensitive location data from users through advertising software embedded in third-party mobile applications. This case not only underscores the escalating enforcement of health data privacy laws but also serves as a critical touchstone for businesses and consumers striving to comprehend and navigate the intricate provisions of the MHMDA.

Background of the My Health My Data Act

Enacted to fortify the privacy of consumer health data, the MHMDA imposes stringent obligations on entities that collect, process, or share such information. The Act’s purview extends beyond traditional healthcare providers to encompass any organization handling health-related data, thereby broadening the spectrum of accountability. Key provisions of the MHMDA include:

-Consent Requirements: Businesses must obtain explicit consent from consumers before collecting or sharing health data.

-Data Minimization: Entities are mandated to collect only data that is necessary for the specified purpose.

-Consumer Rights: The Act grants consumers the right to access, delete, and withdraw consent for the collection or sharing of their health data.

-Prohibition of Geofencing: The use of geofencing around sensitive locations, such as healthcare facilities, to collect data or target advertisements is expressly prohibited.

The Lawsuit: A Closer Examination

The lawsuit in question accuses the retailer of deploying advertising software within certain third-party mobile applications to clandestinely gather users’ location data and online marketing identifiers. This practice, as alleged, contravenes the MHMDA’s stipulations by:

Lack of Informed Consent: Users were purportedly unaware that their sensitive location data was being collected, thereby violating the Act’s consent requirements.

Unauthorized Data Sharing: The collected data was allegedly shared with third parties without obtaining explicit consumer consent.

Geofencing Violations: The retailer is accused of employing geofencing techniques to amass data from users in proximity to sensitive health-related locations, infringing upon the Act’s prohibitions.

This lawsuit is particularly noteworthy as it represents the first legal action under the MHMDA, setting a precedent for how courts may interpret and enforce the Act’s provisions.

Implications for Businesses

The initiation of this lawsuit serves as a clarion call for businesses operating within Washington State and beyond. To mitigate legal risks and ensure compliance with the MHMDA, organizations should consider the following measures:

-Conduct Comprehensive Data Audits: Assess the types of data collected, the methods of collection, and the purposes for which data is used to ensure alignment with the MHMDA’s requirements.

-Implement Robust Consent Mechanisms: Develop clear and conspicuous consent forms that inform consumers about data collection practices and obtain explicit permission prior to data acquisition.

-Enhance Data Security Protocols: Adopt advanced security measures to protect health data from unauthorized access or breaches.

-Review and Revise Data Sharing Practices: Ensure that any sharing of health data with third parties is conducted in compliance with the Act, including obtaining necessary consents and providing opt-out options.

-Educate and Train Employees: Provide regular training to staff on the MHMDA’s provisions and the organization’s data privacy policies to foster a culture of compliance.

Implications for Consumers

For consumers, this lawsuit highlights the importance of vigilance regarding personal data privacy. Individuals are encouraged to:

-Exercise Data Rights: Utilize the rights granted under the MHMDA to access, delete, or withdraw consent for the collection of health data.

-Be Cautious with App Permissions: Regularly review and manage app permissions to control the sharing of location and health-related data.

-Stay Informed: Keep abreast of privacy policies and practices of frequently used applications and services.

Broader Legal Context

The MHMDA has already influenced legislative trends, inspiring similar laws in other jurisdictions. Nevada has enacted a comparable statute, and Connecticut has amended its Data Privacy Act to incorporate provisions akin to those in the MHMDA. Additionally, New York is considering its own version of the Act, reflecting a growing movement towards enhanced consumer health data protections nationwide.

The filing of the first class-action lawsuit under Washington’s My Health My Data Act marks a pivotal moment in the realm of data privacy law. It underscores the necessity for businesses to diligently adhere to data protection statutes and for consumers to proactively safeguard their personal information. As legal interpretations of the MHMDA evolve, staying informed and compliant will be paramount for all stakeholders involved.

For personalized guidance on navigating data privacy challenges and ensuring compliance with evolving regulations, contact us. Our team of experienced data privacy attorneys is here to assist you in safeguarding your business and maintaining the trust of your clients.

Understanding the Imperative for Businesses to Adapt to New Data Privacy Regulations

In today’s rapidly evolving digital environment, data privacy has become a paramount concern for businesses worldwide. The year 2025 has ushered in significant changes in data privacy laws, compelling organizations to reassess and enhance their compliance strategies. This article delves into the recent developments in data privacy regulations and offers guidance for businesses aiming to navigate this complex landscape effectively.

The Surge of State-Level Data Privacy Laws in the United States

The absence of a comprehensive federal data privacy law in the United States has led to a proliferation of state-specific regulations. As of February 2025, sixteen states have enacted their own comprehensive privacy laws, each with unique requirements and enforcement mechanisms. This fragmented regulatory environment presents a formidable challenge for businesses operating across state lines, necessitating meticulous attention to varying compliance obligations.

The Push for Federal Data Privacy Legislation

Recognizing the complexities arising from disparate state laws, federal lawmakers have intensified efforts to establish a unified data privacy framework. In February 2025, House Republicans formed a working group dedicated to drafting legislation that would set federal privacy standards, aiming to replace the current patchwork of state laws. This initiative underscores the growing consensus on the need for cohesive national data privacy regulations to provide clarity and uniformity for businesses and consumers alike.

International Data Transfers and Compliance Challenges

Global commerce increasingly involves cross-border data flows, making international data transfer regulations a critical concern for businesses. The European Union’s General Data Protection Regulation (GDPR) continues to influence global data privacy standards, with stringent rules governing the transfer of personal data outside the EU. Recent enforcement actions have highlighted the importance of robust compliance programs to navigate the complexities of international data transfers and avoid substantial penalties.

Artificial Intelligence and Data Privacy Concerns

The integration of Artificial Intelligence (AI) into business operations has introduced new data privacy challenges. AI systems often rely on vast amounts of personal data, raising concerns about data protection and ethical use. In response, regulators are focusing on AI governance, with proposed legislation aiming to ensure that AI applications adhere to privacy standards and do not infringe upon individual rights. Businesses leveraging AI technologies must stay abreast of these developments to ensure compliance and maintain consumer trust.

Strengthening Data Protection Measures

In light of the evolving regulatory landscape, businesses must proactively enhance their data protection measures. Key strategies include:

• Conducting Comprehensive Data Audits: Regularly assess the types of personal data collected, processed, and stored to ensure compliance with applicable laws.
• Implementing Robust Security Protocols: Employ advanced encryption, access controls, and continuous monitoring to safeguard data against breaches.
• Establishing Clear Data Handling Policies: Develop and enforce policies that delineate procedures for data collection, usage, retention, and disposal.
• Providing Employee Training: Educate staff on data privacy principles and their roles in maintaining compliance to foster a culture of accountability.

The Role of Chief Privacy Officers

The complexities of modern data privacy requirements have elevated the role of Chief Privacy Officers (CPOs) within organizations. CPOs are now integral to strategic decision-making, ensuring that data privacy considerations are embedded in all aspects of business operations. Their responsibilities encompass overseeing compliance efforts, managing data breaches, and liaising with regulatory bodies to navigate the intricate web of data privacy laws effectively.

Conclusion

The dynamic nature of data privacy regulations in 2025 demands that businesses remain vigilant and adaptable. By understanding the current regulatory environment, implementing robust data protection measures, and fostering a culture of privacy compliance, organizations can navigate the complexities of data privacy laws effectively. For personalized guidance and assistance in developing comprehensive data privacy strategies, contact us.

The European Data Protection Supervisor (EDPS) has recently issued a comprehensive set of guidelines aimed at ensuring data protection compliance when using generative AI systems within EU institutions, bodies, offices, and agencies (EUIs). These guidelines, issued under the Regulation (EU) 2018/1725, offer practical advice for processing personal data while employing generative AI systems.

Key Highlights:

1. Scope and Purpose
   • The guidelines focus on practical advice for EUIs on processing personal data using generative AI systems, ensuring compliance with Regulation (EU) 2018/1725.
   • They aim to cover as many scenarios as possible without prescribing specific technical measures, emphasizing the general principles of data protection.
2. Definition and Applications of Generative AI
   • Generative AI is defined as a subset of AI using machine learning models designed to produce a wide variety of outputs, including text, images, and audio.
   • These systems rely on foundation models, such as large language models, which are trained on extensive datasets and can be fine-tuned for specific tasks.
3. Use of Generative AI by EUIs
   • EUIs can develop, deploy, and use generative AI systems for public services, provided they meet all legal requirements, especially data protection.
   • The Regulation applies fully to any personal data processing activities, regardless of the technology used, and mandates clear accountability among the actors involved in the AI supply chain.
4. Personal Data Processing
   • Personal data processing can occur at various stages of the AI lifecycle, including data collection, training, and system interaction.
   • EUIs must ensure that personal data processing is lawful, meeting at least one ground for lawfulness as per the Regulation, and ensuring compliance with data minimisation and accuracy principles.
5. Role of Data Protection Officers (DPOs)
   • DPOs are tasked with advising and assisting in compliance, ensuring the AI systems’ lifecycle processes align with data protection requirements.
   • They must provide advice on data protection impact assessments (DPIAs) and ensure that all processes are properly documented and transparent.
6. Data Protection Impact Assessments (DPIAs)
   • DPIAs are mandatory for processing operations likely to pose high risks to individuals’ rights and freedoms, especially when new technologies are used.
   • The assessment should involve regular monitoring and reviews to manage evolving risks throughout the AI system’s lifecycle.
7. Ensuring Data Minimisation and Accuracy
   • Data minimisation requires that only adequate, relevant, and necessary personal data are processed.
   • Data accuracy must be maintained throughout the AI system’s lifecycle, with regular monitoring and validation of data used in training and outputs.
8. Transparency and Individual Rights
   • EUIs must inform individuals about personal data processing activities, providing comprehensive and up-to-date information.
   • The exercise of individual rights, such as access, rectification, and erasure, should be facilitated, ensuring proper management and traceability of data.
9. Automated Decision-Making
   • The use of generative AI does not automatically imply automated decision-making within the Regulation’s meaning, but safeguards must be ensured for any automated decisions.
   • EUIs must guarantee individuals’ rights to human intervention, to express their views, and to contest decisions.
10. Addressing Bias and Fair Processing
    • Generative AI systems can amplify biases, necessitating oversight and accountability to ensure fair processing and avoid discrimination.
    • EUIs should implement measures to detect and mitigate bias, ensuring that AI systems are transparent, explainable, and auditable.
11. Data Security
    • Generative AI systems pose unique security risks, requiring tailored controls and continuous monitoring to mitigate potential vulnerabilities.
    • EUIs should implement robust security measures, regular assessments, and training for staff to address evolving security threats.

Conclusion

These guidelines from the EDPS represent a critical step in ensuring that the deployment of generative AI systems by EUIs aligns with the stringent data protection standards established by Regulation (EU) 2018/1725. By adhering to these orientations, EUIs can leverage the benefits of generative AI while safeguarding individuals’ fundamental rights and freedoms.

For more detailed information, visit the EDPS website: EDPS Generative AI Guidelines.

---

This summary provides an overview of the key points from the EDPS guidelines on generative AI and personal data protection. As always, our firm remains committed to ensuring compliance with the latest data protection regulations and helping our clients navigate the complexities of integrating new technologies while safeguarding personal data. For any inquiries or further assistance, please feel free to contact us.

The California Privacy Protection Agency (CPPA) has issued its inaugural enforcement advisory, emphasizing the critical need for data minimization practices among entities covered under the California Consumer Privacy Act (CCPA). This advisory, released on April 2, 2024, highlights the importance of adhering to data minimization obligations in consumer requests and outlines the regulatory framework and enforcement strategies associated with these obligations.

Key Points of the Advisory:

1. Foundation of Data Minimization
   • The advisory underscores data minimization as a “foundational principle” of the CCPA. It aims to promote voluntary compliance and enhance both business and consumer benefits through proper data handling practices.
   • Data minimization is detailed under California Civil Code § 1798.100(c) and corresponding CCPA regulations, which mandate that entities collect only necessary personal information to fulfill consumer requests.
2. Observed Compliance Issues
   • The CPPA has identified improper practices among some entities, where consumers are asked to provide excessive personal information beyond what is necessary for CCPA-related requests. This advisory seeks to address and correct such practices.
3. Advisory vs. Guidelines
   • Unlike formal regulations, the advisory does not implement, interpret, or make specific the laws enforced by the CPPA. It does not establish substantive policy or rights, nor does it offer legal advice or reflect the views of the CPPA’s Board.
   • The advisory serves as guidance to encourage voluntary compliance and does not provide a safe harbor from potential violations. The CPPA clarifies that adherence to the advisory does not offer alternative relief from enforcement actions.
4. Enforcement and Education Mission
   • The CPPA aims to balance enforcement with public education about rights and responsibilities under the CCPA. Enforcement advisories are intended to foster compliance but also signal the agency’s readiness to take necessary enforcement actions.
   • CPPA Executive Director Ashkan Soltani and Deputy Director of Enforcement Michael Macko emphasize the dual role of these advisories in promoting compliance and readiness to act against violations.
5. Specific Areas of Focus
   • The advisory identifies several key areas where data minimization is crucial, including handling user opt-out preference signals, requests for data sale and sharing opt-outs, use and disclosure of sensitive personal information, and identity verification.
   • In each scenario, the CPPA stresses the importance of collecting information only “beyond what is necessary” to respond to consumer requests effectively.
6. Practical Scenarios and Compliance Tips
   • The advisory provides practical “factual scenarios” to help entities understand their data minimization obligations and implement best practices. These scenarios include situations involving sale and sharing opt-out requests and identity verification processes.
   • Entities are encouraged to periodically assess their data minimization practices to reduce exposure risks and enhance data governance.

Conclusion

The CPPA’s enforcement advisory marks a significant step in ensuring robust compliance with data minimization principles under the CCPA. By highlighting the necessity of minimal data collection and providing practical guidance, the advisory aims to safeguard consumer privacy while promoting responsible data practices among covered entities.

For more detailed information, please refer to the full advisory issued by the CPPA.

---

This summary offers a comprehensive overview of the CPPA’s first enforcement advisory on data minimization under the CCPA. Our law firm remains dedicated to guiding clients through compliance with data privacy regulations and addressing any challenges that arise. For further assistance, please contact us.

In an era where information is the cornerstone of all business transactions, understanding and navigating the complex web of data privacy laws is not just advisable; it’s imperative. Data Privacy Attorneys are the specialized navigators in this domain, guiding businesses through the intricacies of compliance, risk management, and ethical data governance. This post delves deeper into the multifaceted role of these attorneys and how they safeguard your business’s future.

Understanding the Role of a Data Privacy Attorney

Specialized Expertise in a Complex Field:
Data Privacy Attorneys are legal experts specializing in laws and regulations governing personal data’s collection, storage, use, and disposal. Their expertise extends across various jurisdictions and includes understanding industry-specific regulations.

Strategic Advisory:
Beyond legal advice, these attorneys provide strategic insights into incorporating privacy by design into business operations, helping companies leverage data while respecting privacy norms.

In-Depth Look at US Federal and State Laws

Federal Frameworks and Regulations:

• Health Insurance Portability and Accountability Act (HIPAA): Specific to healthcare, HIPAA mandates the protection of personal health information.
• Children’s Online Privacy Protection Act (COPPA): Governs how to collect and use personal information from children under 13.
• Gramm-Leach-Bliley Act (GLBA): Pertains to financial institutions and dictates how they must handle consumers’ personal financial information.

State-Specific Regulations and Variances:

• California Consumer Privacy Act (CCPA) & California Privacy Rights Act (CPRA): Grant consumers significant control over their personal data, including the right to know, delete, and opt-out of the sale of personal information.
• New York SHIELD Act: Requires businesses to implement specific security features to protect the private information of New York residents.

Global Compliance: Beyond Borders

The European Union’s General Data Protection Regulation (GDPR):
A comprehensive data protection law that impacts any business dealing with EU residents’ data, mandating stringent consent protocols, rights to erasure, and severe penalties for non-compliance.

Cross-Border Data Transfer and International Laws:
Navigating the legalities of transferring data across borders, dealing with international data protection laws, and understanding regional nuances like the Asia-Pacific Economic Cooperation (APEC) Privacy Framework.

Proactive Risk Management and Strategic Planning

Risk Assessments and Audits:
Conducting detailed assessments to identify vulnerabilities in data handling and processing, followed by recommendations for fortifying data protection measures.

Policy Development and Training:
Crafting internal policies and procedures that comply with relevant laws and educating employees about their roles in protecting data.

Incident Response and Litigation Support

Breach Response Management:
Guiding businesses through the immediate steps post-breach, including notification protocols, regulatory reporting, and public relations strategies.

Litigation and Regulatory Investigations:
Representing businesses in legal proceedings related to data breaches or non-compliance allegations and negotiating with regulatory authorities.

The Bottom Line

The value of a Data Privacy Attorney extends far beyond navigating legal complexities; they are strategic advisors, risk assessors, and defenders of business integrity in the face of evolving data usage norms. As the reliance on data grows and the regulatory landscape continues to evolve, their role becomes increasingly critical in safeguarding not just data but the very future of businesses. Engaging with a Data Privacy Attorney is not just about compliance; it’s about committing to ethical, secure, and sustainable business practices in an increasingly digital world. Ensure your business is ahead of the curve by consulting with of firm today.