As we discussed in part three of this series, “Navigating the Complexities of Regulatory Data Incident Investigations,” when an organization is the subject of regulatory data incident investigations, it must navigate a tangled regulatory web. Extricating itself from that web is the ultimate goal. But what form does that take?Continue Reading That’s a Wrap…or Not? Regulatory Data Incident Investigation Resolutions and the Path Forward
In the latest episode of Regulatory Oversight, Troutman Pepper Partner Judy Jagdmann is joined by Oregon Attorney General (AG) Ellen Rosenblum to discuss her journey from being a federal prosecutor and state trial and appellate judge, to becoming Oregon’s AG.Continue Reading From the Courtroom to the Capitol: Oregon AG Ellen Rosenblum Talks Leadership, Advocacy, and the Journey to Public Service
In an era where privacy, security, and artificial intelligence are at the forefront of many business operations, staying informed about the latest developments is crucial. Our 2023 Privacy Year in Review is an in-depth analysis of the past year’s significant advancements and challenges in these areas.Continue Reading Navigating the Privacy Landscape: Insights from Troutman Pepper’s 2023 Privacy Year in Review
On January 16, New Jersey became the first state this year to enact a comprehensive privacy law, S332, which applies to businesses conducting operations in the state or targeting its residents. As noted in this article by our privacy team, similar to other state comprehensive privacy laws, S322 grants consumers the right to confirm, correct, delete, obtain a copy of their personal data, and opt out of its processing for targeted advertising, sale, or profiling. Controllers and processors are obligated to limit data collection, establish security practices, and provide a privacy notice. They are also required to conduct a data protection assessment for processing activities that pose a heightened risk of harm to consumers. The New Jersey Attorney General’s Office has exclusive authority to enforce violations, treating them as “unlawful practices” under the New Jersey Consumer Fraud Act. The law takes effect on January 16, 2025, with an 18-month grace period for organizations to correct violations before enforcement actions are taken.
The U.S. Department of Health and Human Services (HHS) has drawn criticism for heavily redacting a recommendation letter to the U.S. Drug Enforcement Administration (DEA) concerning the rescheduling of cannabis. HHS said the redactions were justified under Exemption 5 of the Freedom of Information Act (FOIA), which protects inter-agency or intra-agency memorandums or letters that would not be available by law to a party other than an agency in litigation with the agency. As Stephen C. Piepgrass, Agustin E. Rodriguez, Jean Smith-Gonnell, and Cole White noted in a recent article published by Law360, this has sparked debates about the balance between necessary secrecy and the public’s right to government information. Legal challenges to these redactions are expected. The deliberative process privilege, which safeguards deliberative discussions within government corridors, is often invoked in the context of FOIA.
Since 1967, the federal Freedom of Information Act (FOIA) has provided the public with the right to access records or information from any federal agency, except those records protected under legal exemptions. Each state has implemented its own public records laws, with differences regarding how such records are retained and who they can be shared with, as well as nuances among state guidelines for response times, exemptions, fees, and which branches of government are included.
It is indeed a tangled regulatory web woven to potentially trap an organization in the wake of a data incident. Navigating this web can involve significant resources, time, and stress. As we discussed in part two of this series, “Your organization has suffered a data incident: Now here are the regulators it will likely encounter,” Reuters Legal News and Westlaw Today, Oct. 16, 2023, there is no shortage of regulators likely to come calling. Organizations therefore have little margin for error when assessing and responding to an incident.
The principle of open government is foundational to a healthy democracy, and the availability of government records upon request from the public is one of its chief cornerstones. In the U.S., the primary mechanism by which the public gains access to government records is the Freedom of Information Act (FOIA). FOIA serves as a pivotal tool for ensuring governmental transparency by allowing the public to make requests to governmental entities to access specific government records.
In the latest episode of Regulatory Oversight, Troutman Pepper RISE attorneys Jean Gonnell and Cole White are joined by AGA’s Bruce Turcott, legal editor of the Cannabis Law Deskbook, to discuss the evolution of cannabis regulation in Colorado and Washington, the first two states to legalize marijuana. They discuss the challenges and successes of implementing cannabis laws, including the development of licensing systems, the impact of local authority on licensing, and the role of receiverships in the industry.
The cannabis space is young in Virginia, but valuable lessons from the past could provide an edge to those paying close attention.