ConvenientConnect, a company focused on innovative security…

ConvenientConnect, a company focused on innovative security measures for IoT devices, is located in Sacramento, California. The company spent $50 million to become compliant with the CCPA. After the November 2020 California election, the CEO held a meeting with the company’s top management to determine a plan to become compliant with CPRA by 2023. Which recommendations did the Privacy Officer likely make concerning the company’s privacy policy?

The definition of ‘covered entities’ in data breach notifica…

The definition of ‘covered entities’ in data breach notification laws varies among the states. Some states limit the definition of the term to those that conduct business in that state. Georgia’s definition of ‘covered entities’ is even narrower, applying only to:

Marie Sorbonne decided to learn about her family’s heritage…

Marie Sorbonne decided to learn about her family’s heritage by taking a DNA test that was provided by an online company, WeAreDNA. The company sent Marie a test to collect her saliva. Marie learned the results of her saliva test on the website maintained by WeAreDNA. The company does not post a privacy notice on its website. What classes of privacy might concern Marie?

Caly Children’s Hospital in San Francisco, California, outso…

Caly Children’s Hospital in San Francisco, California, outsourced the storage of patients’ personal information to a third-party vendor SecureMed. Hackers accessed SecureMed’s cloud storage, exfiltrated the personal information of Caly’s patients, and then encrypted the information left on SecureMed’s servers. Hackers then requested a ransom from SecureMed related to the Caly data. SecureMed paid the ransom, but the patients’ personal information was not returned. The patients sued Caly Children’s Hospital. Are the patients likely to be successful in their lawsuit against the hospital?

NextDoor Neighbor Mortgage, a mortgage lender, collects priv…

NextDoor Neighbor Mortgage, a mortgage lender, collects private financial data on its customers as part of its routine business practices. In 2019, the email account of Don Irvine, an employee of the company, was accessed by an unauthorized person. That unauthorized person potentially gained access to a significant amount of sensitive personal data related to mortgage loan applications. When Don reported this incident to his supervisor, Don explained that he did not know whether the personal data was encrypted at the time of the incident. No investigation was conducted in 2019. In 2021, mortgage regulators learned of the incident and initiated an investigation. As the new Privacy Officer for NextDoor Neighbor Mortgage, the CEO has asked you what steps NextDoor Neighbor Mortgage should have taken in 2019 in response to the email incident. What do you advise the CEO?

Rocky Rocker, a well-known musical performer, checks into th…

Rocky Rocker, a well-known musical performer, checks into the Los Angeles Drug Treatment Resort (LADTR) on July 1. Within a week of his stay at this drug treatment program, videotapes of Rocky on the grounds of LADTR have been posted on social media by paparazzi. These posts prompt Chris Columbo, a local police detective, to visit the president of LADTR. Detective Chris is investigating a vehicle wreck where Rocky was the driver. Rocky is accused of being under the influence of illegal drugs at the time of the wreck. This wreck occurred in Los Angeles on June 30. Detective Chris believes that the LADTR will have the results of medical tests that will establish that Rocky was under the influence of illegal drugs at the time of his admission to LADTR, which was shortly after the vehicle wreck. Is it likely that Detective Chris will be able to obtain Rocky’s records that are held by LADTR?