Following a December 29, 2025 notice published by the Cyberspace Administration of China, institutions that handle personal information of children in China must report on their handling activities by January 31 each year (starting January 31, 2026); Several recently effective U.S. state comprehensive data privacy laws impact whether/how institutions may engage in targeted advertising to minors; The same U.S. state laws also impact whether/how institutions may “sell” minors’

China’s Ministry of Public Security (“MPS”) penalized Dior Shanghai for breaching personal information protection obligations, following an investigation into a data breach incident. MPS identified the following violations during the investigation: failure to implement a cross-border transfer mechanism; failure to fully inform data subjects about how their personal information would be handled by an overseas recipient; failure to obtain separate consent for cross-border trans

On April 25, 2025, TC260 issued the recommended standard Data Security Technology – Security Requirements for Handling of Sensitive...

On July 18, 2025, the CAC issued guidance on reporting the appointment of personal information protection officers. Handlers that reached...

On March 28, 2025, the Cyberspace Administration of China released a draft amendment to the Cybersecurity Law(“Draft Amendment”) for...

• In a letter to a congressional Privacy Working Group, officials from California and New Jersey argued against preemptive federal...

The CAC and three additional departments jointly announced plans to strengthen PIPL enforcement in 2025 by applying special measures to...

Recently, the CAC released the final Measures for the Administration of Compliance Audits on Personal Information Protection...

AI agreements pose many legal risks, including in the areas of data privacy, intellectual property, liability, and bias. Counsel can...

On January 8, 2025, the DOJ issued a new final rule to prohibit or restrict transfers of bulk sensitive personal data and certain U.S....

On August 27, the European Union and China launched a new Cross-Border Data Flow Communication Mechanism to address problems regarding...

On August 9, 2024, the Guangzhou Internet Court published an opinion in the first cross-border data transfer case in China. The case ...

On September 24, China’s State Council released finalized Regulations on Network Data Security Management, which took effect on January...

On March 19, 2024, China issued the Regulation on the Implementation of the Law of the PRC on the Protection of Consumer Rights and...

Generative AI poses both opportunities and risks for organizations. Higher education institutions should strongly consider drafting AI...

On September 6, 2023, the Cyberspace Administration of China (CAC) imposed a fine of RMB 50 million (approximately $7 million USD) on the...

On September 28, 2023, Chinese regulatory authorities published Draft Measures on regulating and facilitating cross-border transfers; the...

This publication was posted on 7/28/2023 (Updated 10/25/2023).

In late May 2023, cybercriminals gained unauthorized access to the personal information of IHEs’ students, employees, and other community...

By now, nearly everyone has heard of “blockchains” and “NFTs,” and some universities are even using them to issue and validate...