Odia Kagan

Presentation to Philadelphia area privacy professionals on the latest developments and Article 29 Working Party guidance on aspects of GDPR. We focused our discussion on the transparency guidance and how to draft GDPR compliant privacy notices.

Ballard Spahr privacy and data security attorneys Philip N. Yannella and Odia Kagan join Rebecca Perry, Director of Professional Services at Jordan Lawrence, to discuss the steps that U.S. companies need to take to prepare for GDPR, how to prioritize the compliance obligations, and the key takeaways from the multitude of guidance documents recently issued by EU regulators.

Privacy and data security considerations in M&A transactions and vendor management

Speaking on legal considerations on securing the endpoint.

The European Commission's proposed e-privacy regulation sets forth obligations on handling electronic communications and clarifies obligations for seeking consent for the use of cookies. Meant to bring the e-privacy directive in line with the General Data Protection Regulation (GDPR), the regulation imposes steep penalties for failure to comply for companies worldwide, including in the United States. The alert lays out what this means for companies and what they can do to prepare.

If you are tracking users for behavioral advertising, make sure to fully and conspicuously disclose this and provide and opt out - FTC tells Turn, Inc in a proposed settlement agreement.

The alert discusses the 12-step checklist published by the Irish Data Protection Commissioner (DPC) detailing actions companies can take now to better prepare for compliance with the General Data Protection Regulation (GDPR), the new EU privacy regulation which takes effect in May 2018.

The FTC has announced enforcement actions against two app developers that allegedly violated the Children’s Online Privacy Protection Act (COPPA) by using persistent identifiers to serve advertising to children. The developers—LAI Systems, LLC (LAI) and Retro Dreamer (Retro)—will pay a combined $360,000 in civil penalties

Recent statutory amendments passed in California and Nevada expanding the definition of “personal information” will significantly impact the security measures businesses operating in these states must implement when handling personal information of customers residing there

In response to a growing demand for cybersecurity guidance in the health care industry, the National Institute of Standards and Technology (NIST), through its National Cybersecurity Center of Excellence, recently published a step-by-step practice guide (the Guide) on protecting medical information stored in and shared between mobile devices. The Guide is the first in NIST’s new 1800 series of publications, designed to help companies protect their information systems (the 1800 Series).

I was interviewed for this article about the steps taken by OPM in the aftermath of the breach into its records.

Inaugural event hosted by Ballard Spahr LLP

After three years of negotiation and debate within the institutions of the European Union, agreement is near on the new EU data protection legislation, which would radically transform the regulatory landscape. In this talk, we discussed the key elements of the proposed reforms and how they may affect U.S. lawyers and multinational companies.

The ability to collect and analyze big data holds much promise for improving our lives, from the advancement of scientific discoveries to facilitating and improving services provided to consumers. This promise also poses great risk from a privacy perspective, both to consumers: who may be giving away more information than they bargained for, and to companies: whose risk of incurring a data breach incident or running afoul of increasing regulation.

In this presentation I discussed the big… Show more

The ability to collect and analyze big data holds much promise for improving our lives, from the advancement of scientific discoveries to facilitating and improving services provided to consumers. This promise also poses great risk from a privacy perspective, both to consumers: who may be giving away more information than they bargained for, and to companies: whose risk of incurring a data breach incident or running afoul of increasing regulation.

In this presentation I discussed the big data “trend”, its implication on the right to privacy and what both companies and consumers need to do in order to minimize their risks and maximize their rewards from Big Data.
Show less

In this panel discussing cybersecurity considerations for businesses, I discussed the steps to be taken from an administrative perspective to mitigate cybersecurity risks and achieve compliance with applicable laws, regulations and industry standards.

Recommended best practices and key take aways from the recent FTC report on privacy and security considerations in the "Internet of Things".

On February 3, the Securities and Exchange Commission’s Office of Compliance Inspections and Examinations (OCIE) published a Risk Alert that summarizes the OCIE’s observations from its recent examinations of registered broker-dealers and investment advisers. It is likely that future examinations will focus on the areas that the OCIE Risk Alert flagged as lacking including: third party provider management, incident reporting and cyber insurance.

Prudential bank regulators and other supervisory authorities have put cybersecurity front and center in 2015 by issuing guidance that sets forth their expectations of improved cybersecurity and that incorporates cybersecurity assessments into the scope of examinations.

Spoke about data breaches, privacy policies and the NIST Cybersecurity Framework.

With data breaches, cyberterrorism and governmental enforcement of the protection of privacy on the rise, corporations are facing an increased likelihood of claims, legal proceedings and costs. Without a proper understanding of the privacy and data security issues facing the corporation, and effective oversight of the policies and procedures the corporation has in place, directors and officers risk potential liability, as well as breaching their fiduciary duty of loyalty and due care.

In… Show more

With data breaches, cyberterrorism and governmental enforcement of the protection of privacy on the rise, corporations are facing an increased likelihood of claims, legal proceedings and costs. Without a proper understanding of the privacy and data security issues facing the corporation, and effective oversight of the policies and procedures the corporation has in place, directors and officers risk potential liability, as well as breaching their fiduciary duty of loyalty and due care.

In this presentation, we discussed the issues facing corporations in connection with privacy and cybersecurity and the steps directors and officers can take to mitigate these risks. Show less

Corporations are increasingly relying on cloud systems to store their data. This workshop provided a general discussion on the various implications of cloud computing, particularly its impact on privacy issues, litigation and discovery, and intellectual property, covering tactical considerations and best practices as corporations move more data to the cloud.

Meeting one-on-one with entrepreneurs to answer questions and offer advice as part of the Quorum’s office hours.

In a series of new bills amending existing California privacy laws, the State of California increases the protections presently provided to its residents by broadening the requirements for reporting breach of personal data; requiring providers to disclose how their site or service responds to “do not track” signals sent by web browsers; and requiring companies that maintain health information, or provide hardware or software, including mobile applications, to refrain from sharing, selling or… Show more

In a series of new bills amending existing California privacy laws, the State of California increases the protections presently provided to its residents by broadening the requirements for reporting breach of personal data; requiring providers to disclose how their site or service responds to “do not track” signals sent by web browsers; and requiring companies that maintain health information, or provide hardware or software, including mobile applications, to refrain from sharing, selling or using patient medical information without consent. Show less

According to a recent study, 73% of people panic when they realize that they have misplaced their phone; 21% even felt desperate or sick under such circumstances. With smartphones becoming a staple of our daily existence and the convenience and ease of carrying and using just one device, many have started using their personal mobile devices for work related tasks. This phenomenon, often referred to as "Bring Your Own Device" or "BYOD", raises a variety of legal issues both for the user and for… Show more

According to a recent study, 73% of people panic when they realize that they have misplaced their phone; 21% even felt desperate or sick under such circumstances. With smartphones becoming a staple of our daily existence and the convenience and ease of carrying and using just one device, many have started using their personal mobile devices for work related tasks. This phenomenon, often referred to as "Bring Your Own Device" or "BYOD", raises a variety of legal issues both for the user and for the corporation.

In this presentation I explored some of these issues, including: the employee's expectation of privacy, adequately securing the corporate information on the device, e-discovery and specific compliance issues for regulated organizations Show less

Co-Presented a CLE presentation, as part of Pepper's Berwyn CLE Series, on issues including the employee's expectation of privacy, adequately securing the corporate information on the device, e-discovery and specific compliance issues for regulated organizations.

A report recently published by NIST sets forth steps federal agencies and the private sector providers who cater to them need to take to ensure the security of data stored and processed in the cloud. As has happened with previous NIST reports, these criteria will likely be used as benchmarks for assessing regulatory compliance, and serve as the gold standard for transactions completely within the private sector as well.

Following up on the recent report by the National Institute of Standards and Technology (NIST), I was interviewed on Federal News Radio's show "Federal Drive" about the protection of personally identifiable information and dealing with security breaches, particularly by federal agencies.

In this "brave new world" of medical devices with connectivity to the Internet, the FDA recommends that manufacturers take special care to protect the devices from cybersecurity risks.

In an age in which safeguarding the privacy of a person’s information is becoming increasingly challenging, the National Institute of Standards and Technology (NIST) encourages organizations to devote time and resources to develop a system of privacy controls that would enable them to mitigate the risks to privacy.

Presentation at a New York Law Journal CLE Conference

The “Jumpstart Our Business Startups Act” excpeted to be enacted into law in the coming days, reduces certain securities laws reporting and registration requirements and creates "crowdfunding" - a new way to raise capital.

Served as a judge in a transactional IP "moot court".

"Bring Your Own Device," or "BYOD," raises a variety of legal issues both for the user and for the corporation. This webinar addresses some of these issues, including: the employee's expectation of privacy, adequately securing the corporate information on the device, e-discovery and specific compliance issues for regulated organizations.