On 10 March 2022, the Information Commissioner’s Office (ICO) issued a monetary penalty notice to a professional services firm (the Firm) to the tune of £98,000 for a breach of Article 5(1)(f) of the General Data Protection Regulation (GDPR).
The Firm was the victim of a ransomware attack which it first became aware of on
On May 13, 2021, the New York Department of Financial Services (NYDFS) announced a $1.8 million settlement with two related insurance companies, relating to violations of two different requirements of the NYDFS cybersecurity regulation during the period 2018 to 2019.
Read a discussion of the May 13 settlement by David Kessler, Susan Ross and Patrick
On March 3, 2021, the New York Department of Financial Services (NYDFS) announced a Consent Order with a NYDFS-licensed Maine-based mortgage banker and loan servicer settling alleged violations of the NYDFS cybersecurity regulations. (In the matter of Residential Mortgage Services, Inc., March 3, 2021).
As a result of the regular safety and soundness
On December 18, 2020, the US Department of the Treasury (Office of the Comptroller of the Currency), Federal Reserve Board and Federal Deposit Insurance Corporation (FDIC) jointly announced a 53-page proposed rule that would require banks to notify their regulators within 36 hours of a “computer-security incident” that rises to the level of a “notification
When an entity (Affected Entity) experiences a data breach incident (Breach Incident), it is instantly faced with a number of issues that it must address with urgency. Among such, an Affected Entity must manage crucial regulatory compliance obligations that may be triggered by the Breach Incident. The most obvious of these obligations arise under the
In response to the growing use of artificial intelligence (AI) by banks, the Hong Kong Monetary Authority (HKMA) has provided guidance to the banking industry on the use of AI applications. These are high level principles (set out briefly below) which banks are expected to take into account when designing and
The Securities and Futures Commission (the SFC) has issued a circular (the Circular) to licensed corporations (LCs) on the use of external electronic data storage providers[1] (EDSPs) and updated the frequently asked questions on the premises for business and record keeping in light of the Circular.
In addition
The Australian Treasury has recently released draft legislation[1] with respect to Consumer Data Right (CDR) for a second round of public consultation. Under the proposed CDR regime, businesses in certain sectors of the economy will be compelled to provide consumers (individuals and business customers) with access to particular data, including their transactions,
It has been 3 months since Australia’s Notifiable Data Breach Scheme (NDB Scheme)[1] came into force and, already, the Office of the Australian Information Commissioner (OAIC) is receiving many notifications of cyber-attacks and other data breaches – both voluntarily and under the NDB Scheme.
We will see even greater awareness