Remove tag health-information
article thumbnail

$10,000,000 civil penalty for disclosing personal data without consent

Data Protection Report

As part of the order, the company agreed to post “clearly and conspicuously” on its websites and apps for the next two years: Between October 2019 and [date], we shared the personal of information of consumers visiting our website and apps with other companies without their permission. Cerebral disclosed that its breach impacted nearly 3.2

article thumbnail

Historic Charges: First Enforcement Action Filed by New York Department of Financial Services Under Cybersecurity Regulation

Data Matters

2 Because First American’s violations included the exposure of millions of documents containing nonpublic information (NPI), the total penalty potentially could be substantial. limit user access privileges to information systems that provide access to NPI (23 NYCRR § 500.07). The NYDFS Cybersecurity Regulation. e) and 500.01(g),