Concepts to Review

COIT - Consumerization of information technology (COIT) and BYOD.

• Consumers use their same device for home and work.

• Many benefits for workplace to let employees be more productive on their own device.

• Security concerns

• Monitoring a BYOD device is a privacy concern

Redaction - More generally, court rules today require redaction of certain personal information by the litigants themselves. Redaction is the practice of discovering, identifying, and removing or blocking information from documents being produced pursuant to a discovery request or as evidence in a court proceeding.

CCPA Definition of business -entity does business in California meets one of the following additional requirements:

• Has annual gross revenues exceeding $25 million. (Note that this number may be adjusted upward by the California)

• “Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.”

• Receives 50 percent or more of annual revenue results from sales of consumers’ personal information.

What are 3 exceptions to breach notification state laws - you don't need to follow state breach notification if this is true:

• Most common exception allowed by states is for entities that are subject to other, more stringent data breach noti cation laws. is includes HIPAA-covered entities and financial institutions subject to and in compliance with the GLBA.

• Second, most states allow exceptions for entities that already follow breach notification procedures as part of their own information security policies as long as these are compatible with the requirements of the state law. i.e. follow CT or MA informatoin security laws

• Third, in most states, a safe harbor exists for data that was encrypted, redacted, unreadable or unusable.