Keating Muething & Klekamp PLL Home Page https://www.kmklaw.com/cybersecurity-privacy Thu, 11 Jun 2026 12:53:24 -0400 The Future of Health Data Privacy Is Here—With or Without HIPRA https://www.kmklaw.com/cybersecurity-privacy/the-future-of-health-data-privacy-is-here-with-or-without-hipra cybersecurity-privacy/the-future-of-health-data-privacy-is-here-with-or-without-hipra Wed, 17 Dec 2025 09:00:01 -0500 Health data privacy is entering a new era—and the warning signs are already here. While the Health Information Privacy Reform Act (HIPRA) proposed by Senator Bill Cassidy may not make its way through Congress, its message to digital health companies and HIPAA-covered entities is unmistakable: the regulatory gap around consumer health data is closing fast.

]]> Indiana & Kentucky Privacy Laws Go Live in the New Year https://www.kmklaw.com/cybersecurity-privacy/indiana-kentucky-privacy-laws-go-live-in-the-new-year cybersecurity-privacy/indiana-kentucky-privacy-laws-go-live-in-the-new-year Mon, 08 Dec 2025 09:00:02 -0500 As businesses prepare for the holiday season and the new year inches closer, now is the time to revisit Indiana and Kentucky’s comprehensive data privacy laws taking effect on January 1, 2026.  As data privacy laws travel east and become effective across the Midwest, many businesses that target consumers in Indiana and Kentucky will have increased risk despite previous efforts to comply with more onerous regulations.  In addition to Indiana, nine other state AGs have joined a Bipartisan Consortium of regulators intending to coordinate and share resources to enforce their respective state privacy laws. These laws will have an impact on businesses, including those based in Ohio, that collect or process personal data from residents of these neighboring states. The laws establish new consumer rights, impose obligations on businesses, and set forth substantial penalties for non-compliance. Below is an overview of the key provisions in each law and what businesses should do to prepare for the new year.

]]> New York Bans Sale of Certain Supplements to Minors https://www.kmklaw.com/cybersecurity-privacy/new-york-bans-sale-of-certain-supplements-to-minors Nicole E. Cloyd cybersecurity-privacy/new-york-bans-sale-of-certain-supplements-to-minors Wed, 15 Nov 2023 09:00:03 -0500 On October 25, 2023, New York Governor Kathy Hochul signed into law a bill (the “Act”) banning the sale of over-the-counter weight loss and muscle building supplements to children under the age of 18. This Act is the first law in the United States to ban the sale of such supplements to children and is set to take effect in April of 2024.

]]> GDPR Compliance: What is Privacy Shield 2.0? https://www.kmklaw.com/cybersecurity-privacy/gdpr-compliance-what-is-privacy-shield-2-0 Nicole E. Cloyd, Kennedy E. Brooks cybersecurity-privacy/gdpr-compliance-what-is-privacy-shield-2-0 Thu, 11 Aug 2022 09:00:04 -0400 Four years ago, the European Union (“EU”) began enforcement of the General Data Protection Regulation (“GDPR”). The GDPR is a comprehensive data privacy law enacted to create a standardized and cohesive data privacy framework across all EU member countries. The GDPR has since encouraged the adoption of data privacy laws throughout the world,[1] such as the California Consumer Privacy Act. Businesses in the United States that process[2] personal data of European residents, after it has transferred from a country in the European Economic Area to the United States, must ...

]]> Connecticut's Data Privacy Law https://www.kmklaw.com/cybersecurity-privacy/connecticut-data-privacy-law Nicole E. Cloyd cybersecurity-privacy/connecticut-data-privacy-law Mon, 13 Jun 2022 09:00:05 -0400 The new Connecticut data privacy law—inconveniently titled “An Act Concerning Personal Data Privacy and Online Monitoring” (hereinafter referred to as “CPDPA”) was signed into law on Tuesday, May 10, 2022 and will have an effective date of July 1, 2023. The CPDPA is moderately similar to both the Colorado Privacy Act (the “CPA”) and the Virginia Consumer Data Privacy Act (“VCDPA”), with only a few minor differences.

The CPDPA applies businesses that conduct business in the state of Connecticut or produce products or services targeted to residents of ...

]]> The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) https://www.kmklaw.com/cybersecurity-privacy/the-california-consumer-privacy-act-and-the-california-privacy-rights-act Nicole E. Cloyd cybersecurity-privacy/the-california-consumer-privacy-act-and-the-california-privacy-rights-act Mon, 06 Jun 2022 09:00:06 -0400 The California Consumer Privacy Act (“CCPA”), which went into effect January 1, 2020, created rights and obligations related to the collection and sale of consumer personal data. The California Privacy Rights Act (“CPRA”) was a ballot measure that was approved by California voters on November 3, 2020. The CPRA significantly amends and expands the CCPA. Notably, the majority of the provisions revising the CCPA do not become “operative” until January 1, 2023, and enforcement will apply only to violations occurring on or after January 1, 2023.

]]> The Utah Consumer Privacy Act https://www.kmklaw.com/cybersecurity-privacy/the-utah-consumer-privacy-act Nicole E. Cloyd cybersecurity-privacy/the-utah-consumer-privacy-act Tue, 31 May 2022 09:00:07 -0400 On March 24, 2022, Utah Governor Spencer Cox signed the Utah Consumer Privacy Act (“UCPA”) into law. The UCPA, which will become effective December 31, 2023, largely mirrors the Virginia Consumer Data Privacy Act (“VCDPA”), explained in more detail here, or Europe’s General Data Protection Regulation (“GDPR”).

]]> The Colorado Privacy Act https://www.kmklaw.com/cybersecurity-privacy/the-colorado-privacy-act Nicole E. Cloyd cybersecurity-privacy/the-colorado-privacy-act Mon, 23 May 2022 09:00:08 -0400 The Colorado Privacy Act (the “CPA”) was signed into law on July 8, 2021 by Governor Jared Polis, only 6 months after Virginia enacted its data privacy law, the Virginia Consumer Data Privacy Act (“VCDPA”).

]]> The Virginia Consumer Data Protection Act https://www.kmklaw.com/cybersecurity-privacy/the-virginia-consumer-data-protection-act Nicole E. Cloyd cybersecurity-privacy/the-virginia-consumer-data-protection-act Mon, 16 May 2022 09:00:09 -0400 On March 2, 2021, Virginia Governor Ralph Northam signed the Virginia Consumer Data Protection Act (the “VCDPA”) into law. The VCDPA, which will become effective January 1, 2023, creates rights and obligations related to the collection and processing of consumer personal data. While many of these rights are similar to what we have seen under the California Consumer Protection Act (“CCPA”) or Europe’s General Data Protection Regulation (“GDPR”), many rights, such as the right to appeal the denial of a consumer data request and the establishment of a 30-day cure ...

]]> State Data Privacy Law Series https://www.kmklaw.com/cybersecurity-privacy/state-data-privacy-law-series Nicole E. Cloyd cybersecurity-privacy/state-data-privacy-law-series Thu, 12 May 2022 09:00:10 -0400 With the passing of the Utah Consumer Privacy Act and Connecticut Data Privacy Act, data privacy laws are back in the focus of business owners across America. Five states now have comprehensive data privacy protection for consumers—California, Virginia, Colorado, Utah, and Connecticut.

]]>