Data Security Rules
October 19, 2026
On December 20, 2024 the FTC issued its final complaint and decision and order against Marriott and Starwood, Docket No. C-4807, alleging deceptive and unfair data security behind three breaches between 2014 and 2020. The order mandates a specified security program, biennial outside assessments, deletion requests and loyalty point restoration for 20 years.
Read more →
Privacy Litigation
October 19, 2026
In 2015 the Supreme Court held 5 to 4 that the Los Angeles ordinance letting any police officer inspect a hotel's guest registry on demand was facially invalid under the Fourth Amendment, because operators had no opportunity for precompliance review. The city amended the provision in 2017 so that officers request the operator's consent.
Read more →
State AG Enforcement
October 19, 2026
On October 9, 2024 the attorneys general of 49 states and the District of Columbia settled with Marriott over the Starwood reservation database breach and a later intrusion using franchise employee credentials. Marriott agreed to pay $52 million divided among the states and to a detailed, court-ordered security program, without admitting liability.
Read more →
Employee Privacy
October 19, 2026
Michigan's Bullard-Plawecki Employee Right to Know Act, in force since January 1, 1979, gives employees of employers with four or more workers a right to review and copy their personnel records, but excludes eight categories of material, bars records of off-duty associations and political activity, requires mailed notice before disciplinary records go to outsiders, and lets employees sue.
Read more →
Breach Notification
October 19, 2026
Michigan's breach duty is section 12 of the Identity Theft Protection Act, MCL 445.72. It requires notice unless the entity determines, with ordinary prudence, that the breach is not likely to cause substantial loss, injury or identity theft. Insurers are carved out to a parallel regime in the Insurance Code, and Senate Bills 360 to 364 would add Attorney General notice.
Read more →
VPPA
October 19, 2026
Michigan's Preservation of Personal Privacy Act bars businesses that sell, rent or lend books, sound recordings or videos from knowingly disclosing records identifying what a customer bought. Until 2016 PA 92 took effect on July 31, 2016, it carried $5,000 in statutory damages; claims over pre-amendment disclosures then produced a run of federal rulings on its limitations period.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Minnesota's Consumer Data Privacy Act, Minn. Stat. 325M.10 to 325M.21, has applied since July 31, 2025 to entities that control or process data on 100,000 Minnesotans, or 25,000 with a sale-revenue test. It adds a third-party list right and a written policy inventory to the familiar model, and since January 31, 2026 the Attorney General may sue without a warning letter.
Read more →
Breach Notification
October 19, 2026
Minnesota's private-sector breach statute, Minn. Stat. 325E.61, has changed little since 2006. It requires notice to residents whose unencrypted personal information was or is reasonably believed acquired, without a risk-of-harm exception or a day count, adds a 48-hour credit bureau notice above 500 persons, and leaves government entities to a separate statute with its own rules.
Read more →
Automated Decision-Making
October 19, 2026
Paragraph (g) of Minn. Stat. 325M.14, subdivision 1, gives a consumer profiled for a significant decision the right to question the result, be told the reason, learn (if feasible) what might have changed it, review the data used and obtain reevaluation on corrected data. Colorado, Tennessee and California treat the same ground differently, and the statute does not define most of its terms.
Read more →
Breach Notification
October 19, 2026
Tennessee replaced its breach statute twice in two years. Public Chapter 692 of 2016 set a 45-day deadline and dropped the encryption exception; Public Chapter 91 of 2017 rewrote section 47-18-2107 in full, restoring encryption by reference to FIPS 140-2, keeping 45 days, adding a materiality test and a credit bureau duty, and keeping a customer's right to sue.
Read more →
AI & Privacy
October 19, 2026
Tennessee's Ensuring Likeness, Voice, and Image Security Act, enacted as Public Chapter 588 and effective July 1, 2024, renamed the state's 1984 publicity statute, added a voice right that covers simulations, and created civil liability for public distribution of unauthorized voices or likenesses and for tools whose primary purpose is producing a particular person's voice or likeness.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Tennessee's privacy statute, enacted as Public Chapter 408 of 2023 and in force since July 1, 2025, combines a $25 million revenue floor with high consumer counts, broad entity exemptions, a permanent 60-day cure, an affirmative defense for programs aligned to the NIST Privacy Framework, and court-awarded treble damages for willful violations.
Read more →