by Ilan Jenkins | Apr 18, 2025 | Data Retention, Europe, GDPR
A recent decision from the Higher Regional Court of Dresden, Germany, highlights the need for controllers to ensure their processors are deleting data when they’re supposed to and to obtain a specific written confirmation that all personal data has in fact been...
by Ilan Jenkins | Jan 14, 2025 | Cybersecurity, Health Information, HIPAA, Regulators, United States, US HHS
Always a crowd favorite when negotiating Business Associate Agreements and Data Processing Agreements alike, breach notification periods almost always generate lively discussion. One party wants “immediate” notification of data breaches; one says it can...
by Ilan Jenkins | Mar 25, 2024 | Data Retention, Europe, GDPR, Policies, Regulators, United States
I’ve previously posted about data retention being one of the hardest data privacy compliance tasks for organizations to complete. This holds true for organizations large and small in all sectors. Finding your data, cataloging it, deciding on retention periods,...
by Ilan Jenkins | Jan 4, 2024 | Biometric Data, HIPAA, State Privacy Laws, United States
And also provides a grammar lesson. In Mosby v. Ingalls Memorial Hospital, the Illinois Supreme Court determined that the HIPAA exclusion in the IL Biometric Information Privacy Act (BIPA) is broader than the plaintiffs argued. The plaintiffs, hospital nurses, claimed...
by Ilan Jenkins | Jan 2, 2024 | Colorado, United States
The Colorado Attorney General’s office published its final list of “valid” and “recognized” universal opt-out mechanisms (“UOOM” for short). The sole finalist was the Global Privacy Control. Buried at the bottom of the...
