The novel coronavirus has upended business operations on a global scale, and mitigation efforts continue to be implemented to help organizations stay afloat during this unprecedented pandemic. On March 19th, the European Data Protection Board (EDPB), an informal working group comprised of representatives of each of the national data protection authorities in the EU, issued a statement regarding data processing activities during this public health crisis, emphasizing that while data protection rules should not hinder the fight against COVID-19, it is still imperative that certain prescribed steps be taken to ensure the protection of personal data.

In her latest ACC Docket article, Outside GC's Lakshmi Sarma Ramani discusses the use of prize promotions, such as sweepstakes and contests, by nonprofit organizations, highlighting their obligation to comply with federal and state prize promotion laws despite being exempt from other tax laws.  

Outside GC's Lakshmi Sarma Ramani regularly advises nonprofit organizations on a wide range of legal and business issues. In her latest ACC Docket article, Ramani reminds nonprofits to be mindful of their anticorruption responsibilities in the U.S and abroad, including those arising under the U.S. Foreign Corrupt Practices Act (FCPA).  

Despite the global angst preceding the GDRP’s effective date, there’s been seemingly little news about enforcement efforts against noncompliant businesses. But, the reality is that EU regulators have been very busy working behind the scenes. As of February, 2019, nearly 100,000 claims under the GDPR have been lodged with EU national data protection authorities (“DPAs”), many relating to telemarketing and promotional e-mails. Similarly, just over 40,000 data breaches were reported to the DPAs; and 255 investigations into EU cross-border processing activities were initiated, mostly as a result of complaints filed by individuals.

In her latest ACC Docket article, Outside GC attorney Lakshmi Sarma Ramani reviews U.S. state fundraising regulations which apply to nonprofit organizations and their corporate partners.

In the wake of an historic, multi-state lawsuit filed against a “Business Associate” earlier this month, it is imperative that companies with business associate agreements (BAA) in place with health care/plan customers review internal data security policies and procedures to ensure they are in compliance with their obligations arising under HIPAA, state privacy laws and the BAAs.

Outside GC Member Stephan Grynwajc continues to keep a close eye on the fate of the EU-U.S. Privacy Shield data-sharing arrangement.