Explore

Federal Court Rules OPM Improperly Granted Broad Access to Sensitive Employee Data

Federal Court Rules OPM Improperly Granted Broad Access to Sensitive Employee Data

A recent federal court decision has found that the Office of Personnel Management (OPM) improperly granted extensive access to systems containing sensitive personnel information. The court determined that OPM failed to adequately demonstrate a legitimate need for certain individuals to view these records. This ruling emphasizes that efforts to modernize government information technology systems do not inherently justify access to confidential employee data, underscoring the critical importance of privacy safeguards and robust cybersecurity controls. This decision aligns with a series of federal cases from 2025–2026 that challenged access to agency data systems under the Privacy Act of 1974 and the Administrative Procedure Act. These cases commonly involved agencies providing the U.S. Department of Government Efficiency (DOGE), established by executive order in January 2025 to modernize federal technology, with broad access to systems holding sensitive personal data. Plaintiffs in these cases argued that su...

Regulatory Landscape for U.S. Employers Evolves with Focus on AI, Privacy, and Workforce Integrity

Regulatory Landscape for U.S. Employers Evolves with Focus on AI, Privacy, and Workforce Integrity

Regulatory Landscape for U.S. Employers Evolves with Focus on AI, Privacy, and Workforce Integrity

California Leads U.S. in Employee Digital Privacy Rights Amid Fragmented Federal Law

California Leads U.S. in Employee Digital Privacy Rights Amid Fragmented Federal Law

Workplace privacy law in the U.S. is currently fragmented, lacking a comprehensive federal framework. This absence means that individual states are responsible for enacting their own restrictions. In most states, employers typically retain ownership of internal corporate data and can utilize it for training models without requiring explicit employee consent. However, California stands out as the sole state that extends consumer data privacy rights to human resources and employee records through the California Consumer Privacy Act (CCPA). Under the CCPA, employees are classified as 'consumers,' granting them the right to request formal disclosure of collected data, correct inaccuracies, and demand the deletion of nonessential records. Furthermore, California Assembly Bill 1883 specifically prohibits workplace monitoring tools that employ artificial intelligence (AI) to gather neural data or identify an individual’s neural state. The emerging concept of 'employee digital twins' (EDTs), virtual representation...

California Leads Efforts to Develop GPS Backup System Amid Rising Interference Concerns

California Leads Efforts to Develop GPS Backup System Amid Rising Interference Concerns

California is spearheading the development of a backup system for GPS, a critical technology increasingly vulnerable to interference. Recent incidents, such as GPS jamming affecting a 40-mile expanse of airspace near Dallas-Fort Worth International Airport and navigation problems for United Airlines flights near Los Angeles International Airport, highlight the urgent need for such a system. Internationally, widespread jamming has been observed in the Middle East, and Russian satellites have been interfering with GPS signals across Europe. Russia and China already possess ground-based complements and backups to GPS, recognizing the severe consequences of a compromised GPS system for telecommunications, public safety, and defense. A one-day GPS outage could cost the American economy $1.6 billion, according to an economic analysis by The Brattle Group. California is currently testing the world's first ground-based, 5G-powered 3D Positioning, Navigation, and Timing (PNT) system in Santa Clara County, which aim...

10 Cybersecurity Vulnerabilities AI Startups Should Audit Before a Product Launch

10 Cybersecurity Vulnerabilities AI Startups Should Audit Before a Product Launch

A guide for AI startups on the 10 most critical cybersecurity vulnerabilities to audit before launching a product, from data poisoning to prompt injection.

Norton Rose Fulbright Expert Discusses Data Breach Response Strategies in Webinar

Norton Rose Fulbright Expert Discusses Data Breach Response Strategies in Webinar

Norton Rose Fulbright Expert Discusses Data Breach Response Strategies in Webinar

European Union Council Proposes Simplification of Data Protection and Cyber Rules

European Union Council Proposes Simplification of Data Protection and Cyber Rules

On October 21, 2026, the Council of the European Union agreed on a proposal aimed at simplifying parts of the EU's data protection, privacy, and cybersecurity regulations. This initiative, part of the 'Digital Omnibus' series, seeks to make these rules clearer and easier for businesses, public bodies, and individuals to follow, while maintaining robust personal data protection. Key proposed changes include clarifying the definition of pseudonymized data in relation to individual identification, providing more guidance for organizations dealing with unfounded or excessive data subject access requests (DSARs), and lightening information obligations in low-risk scenarios. The proposal also suggests a clearer definition of 'scientific research' with targeted exemptions for research organizations and longer deadlines for reporting personal data breaches. Additionally, it introduces a single EU-wide list of high-risk processing activities and common templates for regulatory compliance. Extra safeguards are propo...

California Enacts New Corporate Slavery Disclosure Law, Requiring Historical Records Search

California Enacts New Corporate Slavery Disclosure Law, Requiring Historical Records Search

California Governor Gavin Newsom signed Assembly Bill 2599, a new law that mandates large companies operating in California to conduct a records search for specified slavery-related conduct that occurred before the Thirteenth Amendment. This legislation, the first of its kind in the United States, requires covered entities to submit an affidavit of their findings to the California Civil Rights Department, which will then be made public. Companies subject to AB 2599 must have been in existence on or before December 31, 1964 (or have a predecessor from that period), do business in California, and have annual worldwide gross receipts exceeding $100 million. The records search must cover any involvement in buying, selling, using enslaved persons as collateral, providing loans for their purchase, or insuring such transactions. Ropes & Gray LLP has issued a memorandum detailing the requirements of this new law.

Clear Channel Outdoor Seeks Counsel for Privacy and Technology Role Amidst Evolving Data Regulations

Clear Channel Outdoor Seeks Counsel for Privacy and Technology Role Amidst Evolving Data Regulations

Clear Channel Outdoor Seeks Counsel for Privacy and Technology Role Amidst Evolving Data Regulations

Protegrity Addresses AI Data Security Challenges for Enterprises

Protegrity Addresses AI Data Security Challenges for Enterprises

Protegrity Addresses AI Data Security Challenges for Enterprises

California Laws Offer Robust Protections Against Identity Theft and Credit Reporting Errors

California Laws Offer Robust Protections Against Identity Theft and Credit Reporting Errors

California residents are afforded significant legal protections against identity theft and credit reporting inaccuracies through the California Consumer Credit Reporting Agencies Act (CCRAA) and the California Identity Theft Act. These state-specific laws supplement federal regulations like the Fair Credit Reporting Act (FCRA) and the Fair Debt Collection Practices Act (FDCPA), providing additional safeguards for personal identifying information and consumer credit. According to R23 Law, a firm specializing in consumer protection, these acts allow victims to pursue claims for actual damages, statutory damages, emotional distress, and attorney's fees in cases of violations. However, identity theft alone does not automatically establish liability against creditors or credit reporting agencies; legal evaluation is necessary to determine if specific obligations were breached. The firm emphasizes the importance of prompt action by victims, including filing reports with the Federal Trade Commission and local law...

UPMC Emphasizes Secure Communication Protocols for Employees and Patients Amidst Rising Cyber Threats

UPMC Emphasizes Secure Communication Protocols for Employees and Patients Amidst Rising Cyber Threats

UPMC, a non-profit healthcare provider and insurer headquartered in Pittsburgh, PA, is reinforcing its secure communication infrastructure for both employees and patients. The organization utilizes distinct platforms to manage internal operations and patient interactions, primarily Microsoft Office 365 for employees and the MyUPMC patient portal for patient-provider communication. This dual-platform approach is designed to ensure HIPAA compliance and protect sensitive health information. Employees access their UPMC email through the official Outlook Web Access (OWA) portal, requiring multi-factor authentication (MFA) to safeguard clinical data and internal communications. For patients, the MyUPMC portal serves as a secure, encrypted messaging system, allowing them to request appointments, view lab results, and communicate with their care teams without using standard, unencrypted email services. UPMC stresses that standard emails are not suitable for Protected Health Information (PHI) due to security risks.