All news with #ccpa tag

🔒 Attorney General Rob Bonta has sued 23andMe (now Chrome Holding Co.) for failing to protect sensitive genetic and personal information after a 2023 breach exposed data of nearly 7 million customers, including 855,541 Californians. The suit alleges inadequate safeguards against credential-stuffing, missed detection opportunities, a coding error in the DNA Relatives feature, and misleading public statements about security. It seeks injunctions and statutory penalties under multiple California laws, including CCPA and the California Genetic Information Privacy Act.

🛑 The California Privacy Protection Agency ordered Rickenbacher Data LLC, operating as Datamasters, to stop selling Californians' health and personal information and fined the firm $45,000 for failing to register as a data broker under the California Delete Act. Regulators found Datamasters bought and resold hundreds of millions of records—names, emails, addresses and phone numbers—targeting people by medical conditions, age, perceived race, political views and purchases. The agency ordered deletion of previously acquired California records by the end of December, requires any newly received Californian data to be purged within 24 hours, and imposed five years of compliance measures; CalPrivacy also fined S&P Global $62,600 for an administrative registration lapse.

🔐 The author contends that cyber risk failures are often architectural and cultural, not purely technological, and argues for an ongoing cyber risk management process integrated with information security governance. He outlines a practical, strategic recipe—stakeholder mapping, framework selection (e.g., NIST CSF, ISO 27001), KPIs/KRIs, asset and threat assessments, and guardrails for cloud and generative AI workloads. The piece stresses building a mature risk culture, aligning GRC with the CISO role, enforcing technical controls and secure development practices (SAST/DAST/SCA), and running tabletop exercises to improve resilience and compliance with laws such as GDPR, CCPA and LGPD.

🛡️ Data brokers compile extensive personal dossiers and sell them without consent. This guide explains the challenges of locating and removing your information, outlines typical data collected, and describes practical steps to submit opt-out or deletion requests. It recommends tracking requests in a spreadsheet, citing laws like CCPA or GDPR, and repeating removals every 3–6 months or using paid services.