CCPA’s Risk Assessments, Cybersecurity Audits and Automated Decision-Making

We’re nearly one year out from the new Securities and Exchange Commission cyber rules coming into force. This session examines how the rules have been addressed in practice – both by companies and the SEC. It also addresses trends and updates to Form 8-K filings for cybersecurity incidents, discusses how Cooley companies and others have approached the 10-K disclosures, and reviews any SEC enforcement actions and what they mean for our interpretation of these rules.

During this session, we discuss the scope and requirements of the MHMD Act, as well as noncompliance risks – including a private right of action. We also touch upon other similar US state laws that followed enactment of the MHMD Act. Cooley lawyers Andrew Epstein and Kristin Marshall lead this foundational presentation to help participants design risk-mitigation strategies in their compliance journey.  

Join us for an informative webinar discussing the anniversary of the General Data Protection Regulation (GDPR). Our practitioners share their insights on the top 10 things that happened last year and what to expect in the coming year. Learn about the latest developments in GDPR compliance and how to stay ahead of the curve.

The California Consumer Privacy Act (CCPA) imposes requirements on regulated businesses relating to conducting cybersecurity audits, risk assessments and use of automated decision-making technology. In late 2023, the California Privacy Protection Agency posted discussion drafts of regulations to guide its anticipated rulemaking on these topics. In this session, we discuss the current state of the CCPAs’ compliance requirements relating to risk assessments, cybersecurity audits and automated decision-making, along with some general best practices Cooley recommends that regulated businesses consider when addressing these topics.

Companies are understandably keen to harness the transformative power of artificial intelligence (AI) by incorporating it into their business processes and consumer and enterprise offerings. The speed of innovation in this area presents possible risks to individuals’ privacy rights – in particular, those whose personal data may be used as part of the AI training dataset. Governments and regulators are playing catch-up. The European Union has reached political agreement on the EU AI Act, and President Joe Biden issued an executive order establishing standards for AI safety and security. In an uncertain and rapidly evolving regulatory environment, what can companies do to protect themselves? This session explores the legal risks of using personal data to train AI models and practical strategies to mitigate those risks – including alternatives to using personal data.