UPDATE: U.S. Attorneys’ Offices Adopt Policy Incentivizing Self-Disclosure of Corporate Misconduct (Feb. 27, 2023)

On January 17, 2023, Assistant Attorney General (AAG) Kenneth A. Polite, Jr. delivered remarks to an audience at the Georgetown University Law Center, announcing changes to the Criminal Division’s Corporate Enforcement Policy (CEP). These changes to the CEP follow the September 15, 2022 direction from U.S. Deputy Attorney General Lisa Monaco, which we previously covered, for each Department of Justice (DOJ) Department to publish policies around voluntary self-disclosure, and to clarify the benefits of self-reporting. Although the Criminal Division already has such a policy, AAG Polite noted that the DAG’s direction was an opportunity to take stock of the existing policy and strengthen it.

Continue Reading

A bi-partisan coalition of 33[1] state Attorneys General sent a comment letter[2] to the Federal Trade Commission (FTC) highlighting the risks to consumers from corporate surveillance and data collection. The November 17, 2022, letter was filed as part of the FTC’s Advanced Notice of Proposed Rulemaking on Commercial Surveillance and Data Security.[3] The Attorneys General raised concerns about the collection of particular types of data, including health information, location tracking, and more seemingly innocuous information like calendar appointments. The officials, who are often the top consumer protection officers for their respective states, also highlighted concerns about how the data is stored, sold, and how difficult it is for consumers to opt out of data collection.

This bi-partisan effort comes in a time of increased state-level data privacy enforcement actions.  Virginia,[4] Connecticut,[5] Colorado,[6] Utah,[7] and California[8] all have state laws that protect their citizens’ data security, or have privacy laws taking effect in 2023. And attorneys general have recently brought a series of enforcement efforts that run the gamut of data and company types, including a recent multi-state settlement with Google regarding location tracking, a New York agreement with EyeMed Vision Care LLC, and a settlement between 46 attorneys general and Carnival Cruise Line regarding an “unstructured” data breach. The attorneys general’s attention to “unstructured” data is particularly noteworthy because it focuses on data that is collected and retained in a disorganized fashion, often in email.

Despite the attorneys general’s letter, many businesses will continue to obtain and keep sensitive information in the ordinary course of business. Companies should consider minimizing the data retained, and keeping only that required, while making it easier for consumers to opt out of providing information. The states’ enforcement efforts—and the pending FTC rule-making—suggest that scrutiny of data collection will increase in the future. This will be an area to watch in the new year.

For more information about McGuireWoods’ State Attorneys General Practice, please visit the page here.

[1] The coalition was led by Massachusetts, Connecticut, Illinois, New Jersey, North Carolina, and Oregon, and joined by Arizona, Colorado, Delaware, Washington D.C., Hawaii, Idaho, Indiana, Iowa, Maine, Maryland, Minnesota, Michigan, Montana, Nebraska, Nevada, New Hampshire, New Mexico, New York, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Texas, Utah, Vermont, Washington, and Wisconsin.

[2] https://www.mass.gov/doc/ftc-comments-letter-on-corporate-surveillance/download

[3] https://www.ftc.gov/legal-library/browse/federal-register-notices/commercial-surveillance-data-security-rulemaking

[4] https://lis.virginia.gov/cgi-bin/legp604.exe?211+sum+SB1392

[5] https://www.cga.ct.gov/2022/act/Pa/pdf/2022PA-00015-R00SB-00006-PA.PDF

[6] https://leg.colorado.gov/bills/sb21-190

[7] https://le.utah.gov/~2022/bills/static/SB0227.html

[8] https://oag.ca.gov/privacy/ccpa

Compliance with out of state investigative requests, like warrants, just got a little trickier for California companies. Under existing law, California technology and communications companies are required to produce specified user data in response to an out of state warrant as if that warrant was issued by a California court. But now there is one caveat—companies do not have to do so when the warrant relates to an out of state abortion investigation. On September 27, 2022, California Governor Gavin Newsom signed a bill (AB-1242) that, in part, prohibits technology and communications companies headquartered or incorporated in California from providing user data to out-of-state law enforcement or government entities investigating abortions that would be lawful under California law. The new law also prohibits California companies from assisting the out-of-state entities in investigating or enforcing abortion violations. For California corporations, the law acts as a shield against warrants, court orders, subpoenas, or other legal processes from states attempting to enforce abortion laws that conflict with California law.

Continue Reading