North Star Health Alliance, a group of hospitals in New York, sued LockBit ransomware group after a data breach stole patient data, GovInfoSecurity reports. The hospitals sued LockBit to force the return of its data from cloud vendor Wasabi Technologies.Full story
The U.S. National Institute of Standards and Technology published drafted guidance for businesses' cybersecurity programs. The guidance aims to help businesses develop cybersecurity programs that fit the needs of the organization while also navigating cyber risks.Full story
The European Data Protection Board adopted 17 Jan. a report on the results of its 2023 coordinated enforcement action regarding data protection officer responsibilities and efficacy required under the EU General Data Protection Regulation. Informed by 15,108 stakeholder responses, the EDPB report outlines notable challenges DPOs and their organizations are faced with in terms of resources and training while offering recommendations to support improvements.
The U.S. Federal Trade Commission will enter a new multilateral agreement, the Global Cooperation Arrangement for Privacy.
Gov. Phil Murphy, D-N.J., signed New Jersey's comprehensive privacy bill, Senate Bill 332, into law 16 Jan. The law is set to take effect one year after its signing date in January 2025. There is no indication or mandate on a timetable for commencing attorney general rulemaking before the law takes effect.
Consumer Reports along with Boltive released a report showing nine out of 10 health care companies continue to share customers' personal data despite privacy laws that should limit the practice.
Santa Clara County, California, Chief Privacy Officer Chris Pahl, CIPP/C, CIPP/E, CIPP/G, CIPP/US, CIPM, CIPT, FIP, gives recommendations for how to get started in the privacy industry, which he entered more than 20 years ago. He explains how the field has changed and recommends assessing your current skills, networking with others in the industry and exploring certifications to gain professional experience.Full story
The Malaysia Department of Personal Data Protection will soon develop seven guidelines on how to manage personal data, Malaymail reports. The rules, which are to be developed under the Personal Data Protection Act 2010, involve data protection officers, notices of data breaches, portability, cross border data transfers and more.
IAB Europe expressed concerns to members of European Parliament over a draft report on a procedural regulation proposed for the EU General Data Protection Regulation.
The U.K. Information Commissioner's Office announced fines totaling 250,000 GBP to two companies for marketing phone calls to people on the U.K's "do not call" register. Poxell was fined 150,000 GBP for allegedly making more than 2.6 million marketing phone calls without consumer consent.