Photo of Susan Fahringer

Susan Fahringer has extensive experience representing some of the world’s leading innovators in privacy, IP, and complex commercial litigation.

Just a few years ago, the legal landscape governing health-related personal information was relatively simple: Protected Health Information was regulated under Health Insurance Portability and Accountability Act, a discrete set of rules that applies to a specified set of healthcare plans, clearinghouses, and providers. While narrowly targeted statutes governed particular types of health data and

As of July 18, 2023, Oregon has joined 11 other states to pass a comprehensive consumer privacy law. The Oregon Consumer Privacy Act requires various disclosures around the collection and processing of personal data, provides consumers with rights to their data, and imposes obligations on controllers and processors, including honoring global opt-out signals. This Update

Amazon and Microsoft won summary judgment in two class action lawsuits filed in federal court in the U.S. District Court for the Western District of Washington asserting violations of the Illinois Biometric Information Privacy Act. While the facts of the cases are unique—the defendants received a data set that was developed by a third party

After a five-day trial and only an hour of deliberation, the nation’s first trial under the Illinois Biometric Information Privacy Act (BIPA) ended with a bang. The jury found that the defendant, BNSF Railway Company, recklessly or intentionally violated BIPA 45,600 times (once per class member), resulting in a $228 million judgment.

Click here to

In February, the Texas attorney general brought the first enforcement action under Texas’ Capture of Use of Biometric law. CUBI was the first state law to govern the collection and use of biometric data, predating the more well-known Illinois law by seven years.

This update explores (1) the key differences between CUBI and the Illinois

For the second year in a row, amidst a wave of biometric lawsuits in other states, Maryland legislators have introduced a new biometric privacy law mimicking the Illinois Biometric Information Privacy Act (BIPA). In 2021, a similar proposed law (HB 0218) failed to make it past committee hearings and was withdrawn by its sole sponsor, Maryland House Delegate Sara Love.
Continue Reading Maryland Legislators Once Again Push for a BIPA-Style Biometric Privacy Bill

What Is the Ordinance?

New York City’s new biometrics ordinance goes into effect today, Friday, July 9. The ordinance regulates the use of “biometric identifier information” in “commercial establishments.” It is the first law of its kind in the State of New York.

  • “Biometric identifier information” is broadly defined to mean “a physiological or biological

The California Consumer Privacy Act of 2018 (CCPA) regulates a company’s offerings of financial incentives and price or service differences related to the collection, retention, or sale of personal information. Cal. Civ. Code Section 1798.125(a)(2); Final Text of CCPA Regulations, 999.301(j), 999.307, 999.336. Although the CCPA became effective on January 1, 2020, the regulations were not issued in final form until June 1, 2020. As a result, many companies are still in the process of developing their approach to complying with the CCPA’s requirements–particularly those that relate to financial incentives. If your company offers programs that may fall within the definition of “financial incentives” or “price or service differences,” you should be aware of the CCPA’s requirements related to those types of offerings, including the requirement to provide notice of the financial incentive and disclose a good faith estimate of the value of the consumer’s data that forms the basis of the offering. The California Attorney General is expected to begin enforcing the CCPA on July 1, 2020.
Continue Reading CCPA Compliance: Financial Incentives Requirements

The California Consumer Privacy Act (CCPA) went into effect three months ago, on January 1, 2020. Although enforcement by the California attorney general cannot begin until July 1, private plaintiffs have been able to bring claims under the law’s limited private right of action since the beginning of the year.

The CCPA is already having an impact on litigation. Two high-profile cases filed after January 1 directly allege violations of the CCPA and have attracted attention. Other cases that either allege CCPA violations or otherwise cite to the statute have received less notice. Even if the cases do not result in decisions that are binding on future litigants, the arguments are worth a look because they may signal trends for which privacy litigators should be prepared. To that end, this privacy quick tip aims to paint a broader picture of how the CCPA has been referenced in litigation and identify a few potential trends to keep an eye on.
Continue Reading CCPA in Litigation: 2018 to Present