Blog

Security, Privacy and the Law

Security and privacy issues encountered by businesses often require immediate and discreet solutions. We cover topics that arise from guiding our clients through the process of complying with the ever-growing number of state, federal and international laws governing information security, identity theft, surveillance and other privacy issues.

Security, Privacy and the Law
Expanded Protections for Reproductive Health and Gender-Affirming Care: What Massachusetts Providers Need to Know
Blog September 04, 2025
On August 7, 2025, Massachusetts Governor Maura Healey signed into law an Act Strengthening Healthcare Protections in the Commonwealth (the “Act”), which amends the state’s existing “Shield Law” protections for providers of reproductive health and gender-affirming care (“Protected Care”)…
Massachusetts to Consider Adopting a Comprehensive State Consumer Privacy Law (Again)
Blog April 16, 2025
After years of proposed state privacy legislation, Massachusetts lawmakers are poised to once again consider enacting a comprehensive state consumer privacy law in the Commonwealth this legislative session…
Post-Election Privacy & Cybersecurity Law Developments to Watch
Blog November 11, 2024
What should privacy and cybersecurity practitioners and specialists consider after the 2025 inauguration? There are a few notable issues that may shape how businesses think about their privacy and cybersecurity programs…
NY State Education Department Bans Facial Recognition Technology
Blog October 23, 2023
In late September, the NY State Education Department issued a two-page order providing that NY public schools may not purchase or utilize facial recognition technology. The Department relied on a report issued by the NY Office of Information Technology Services in August that was critical of the privacy implications of facial recognition technology, but left open the door for the use of other types of biometric technology in schools…
Colorado's Newly Released Data Privacy Regulations Get Specific Regarding Design and Technical Specifications
Blog April 06, 2023
We have written previously regarding Colorado's adoption of the Colorado Privacy Act (CPA)—describing its provision of consumer data rights, how it may function within the context of the cannabis industry, and how business might consider the law as they renew their insurance coverage. And all this before the state released regulations accompanying the CPA. On March 15, 2023, the Colorado Attorney General filed the final rules implementing the CPA to go into effect July 1…
California Trails Closely Behind UK to Protect Children's Privacy
Blog September 27, 2022
Recently signed into law by California Governor Gavin Newsom on September 15, 2022, the California Age-Appropriate Design Code Act (“AADC”) changes the playing field for certain businesses that provide online services, products, or features accessible to children under the age of 18. Although California models its new law after the Children's Code passed by the UK, the AADC is first state law of its kind in the US…
Federalism Rankles National Privacy Debate:  California Weighs in on the proposed American Data Protection and Privacy Act
Blog August 09, 2022
As states have continued to debate and pass new comprehensive privacy statutes – such as those in Virginia and Colorado – a common refrain from business leaders is the need for a comprehensive federal privacy statute that will lessen the need to comply with a patchwork of state laws.  Indeed, the absence of serious privacy protections at the federal level – something akin to PIPEDA in Canada or the GDPR in Europe – has long spurred states to act as online data gathering and brokering has……
Colorado Privacy Act:  The Cannabis Industry Prepares for Enforcement
Blog June 17, 2022
As we wrote last year, Colorado is among the vanguard of privacy-focused states—including California, Washington, and Virginia—to adopt significant state-level privacy legislation.  One year out from enforcement of the Colorado Privacy Act (which begins on July 1, 2023), businesses should begin to put their compliance frameworks in place, as some of the Colorado Privacy Act's significant requirements will need substantial investment beforehand to afford consumers the rights that they are……
A Comprehensive Privacy Law May Be Heading for Massachusetts, And Businesses Should Prepare (originally on the MassTLC Blog)
Blog March 16, 2022
Eds. Note:  This post was originally published on the MassTLC Blog. Get ready: there's a good chance that comprehensive data privacy legislation is coming to the Commonwealth.  If your business is not already compliant with the European Union's or UK's General Data Protection Regulation (GDPR), or the California Consumer Privacy Act (CCPA), then you might have some work to do. Proposals for general data protection legislation are not new to Massachusetts…
1 of 2

ABOUT

The Foley Hoag Security, Privacy and the Law Blog focuses on the security and privacy issues encountered by businesses that often require immediate and discreet solutions. Here we cover topics that arise from guiding our clients through the process of complying with the ever-growing number of state, federal and international laws governing information security, identity theft, surveillance and other privacy issues.

Our lawyers assist clients with questions on how to legally and ethically investigate abusive e-mail, take down infringing Web sites, maintain surveillance of company facilities and information systems, and remediate breaches of security. We work with clients to ensure the legality and success of existing security policies and protocols and help them develop new programs when necessary. Our lawyers have managed unexpected crises ranging from surprise inspections by government investigators to obtaining emergency court orders needed to secure stolen company computers from rogue insiders.

Blog Authors