Compliance Stuff

In addition to the immediate operational impacts, data breaches can trigger a range of legal consequences for clients— from the obligation to provide notice to regulators, individuals, and business partners, to the burden of defending regulatory oversight investigations and class action litigation —not to mention the pressure to mitigate effects on end clients and reputational damage. In the U.S., all 50 states, as well as the District of Columbia and three of the territories, have data breach notification laws with varying requirements, but generally the entity that owns the data (called a “controller”) must notify natural persons if there is unauthorized access to certain categories of their “personal information” (which includes SSNs and financial information). If a vendor suffers a data incident, they must notify the controller, often “immediately,” after which the obligation to provide the notices to the data subjects shifts to the controller . Most industrialized countries have ...

The White House just released new rules yesterday requiring federal contractors to agree not to engage in racially discriminatory DEI activities and to take certain compliance steps. President Trump’s March 26 executive order is focused on “ensuring merit-based and efficient contracting and employment.” The order gives federal agencies 30 days to begin incorporating a related clause on diversity, equity, and inclusion programs into covered contracts. Here’s what federal contractors and subcontractors can expect and five steps you should consider taking now. DEI-Related Contract Clauses The  executive order  directs federal agencies to include a new DEI-related clause in all contracts covered by the Federal Property and Administrative Services Act. The rules also apply to subcontractors and their lower-tier subcontractors. Here are the key aspects you should note: Contract Terms:   Contractors will need to agree not to engage in discriminatory DEI activities based on race...

Johnny C. Taylor Jr., SHRM-SCP, president and CEO of SHRM, testified March 25 before the U.S. Senate Special Committee on Aging in Washington, D.C. As the U.S. workforce ages and labor shortages persist, HR leaders are being called to reconsider long-standing assumptions about retirement, talent, and the value of experience. That message  took center stage  when Johnny C. Taylor Jr., SHRM-SCP, president and CEO of SHRM, testified March 25 before the U.S. Senate Special Committee on Aging in Washington, D.C., highlighting both the challenges and opportunities facing older workers. “America’s workforce is changing,” Taylor told lawmakers. “In 1994, about 12% of Americans age 65 and older were working. Today, it’s closer to 20%. And in the years ahead, the fastest-growing segment of our labor force will be individuals age 75 and older. This is not a temporary trend. It’s a structural shift — and it requires us to rethink how we approach work and retirement.” For HR leaders,...

  Takeaways Expected to begin on 07.01.26, Florida Civil Rights Act civil actions must be filed within firm deadlines. As amended by Florida House Bill 1407, any civil action brought under the Act must commence no later than one year after the date of determination of reasonable cause by the Florida Commission on Human Relations or issuance of a Notice of Right to Sue by the Equal Employment Opportunity Commission, whichever is earlier.  The new law resolves conflicting court rulings and limits prolonged employer exposure to claims under the Act. Related link Florida House Bill 1407 Article Amendments to the Florida Civil Rights Act of 1992 (FCRA) finally provide clear deadlines for pursuing claims under the law and certainty for employers and employees.  House Bill 1407  is pending in the Florida Legislature and, if enacted, would take effect on July 1, 2026. FCRA Background Codified in Chapter 760, Florida Statutes, the FCRA prohibits discrimination in employment b...

Washington just became the latest state to enact a so-called “trigger” labor law, which will allow the state’s labor board to regulate private-sector labor relations if the federal framework fails. The new legislation, which takes effect June 11, is part of a growing effort by states to fill perceived gaps at the federal level – a movement that the National Labor Relations Board strongly opposes and is actively challenging in courts . We’ll explain everything employers need to know, plus what you can expect next. Overview Gov. Bob Ferguson signed a bill ( HB 2471 ) into law on March 23 that will expand the power of the state’s Public Employment Relations Commission (PERC) over matters currently reserved for the NLRB under the National Labor Relations Act (NLRA) – if certain triggering conditions are met. HB 2471 emphasizes that protecting workers’ rights under established labor law and maintaining stable labor-management relations is a vital state interest, but the NLRB is pushing bac...

Employers have become highly efficient at onboarding new hires. Electronic systems now allow employees to complete tax forms, benefits elections, and employment paperwork before their first day of work. That efficiency has created a surprisingly common compliance problem with Forms I-9, the document employees must complete to establish their legal right to work in the United States. Many employers assume that if a new employee completes onboarding paperwork before their first day, that earlier date becomes the “hire date” for I-9 purposes. Others use the date the offer was accepted or the date the employee was entered into the HR system. None of those dates are correct. For I-9 purposes, the correct date is the employee’s first day of work for pay . Misunderstanding that rule leads to errors that regularly surface during immigration audits. The Legal Definition of “Hire” Federal immigration regulations define “hire” as the commencement of employment for wages or other remuneration. In ...

Colorado’s legislature enacted one of the first comprehensive U.S. artificial intelligence (AI) laws in 2024, the  Consumer Protections for Artificial Intelligence  (aka, the Colorado AI Act). Now, a working group convened by Gov. Jared Polis  proposed  a near-total rewrite of that law on Tuesday. This isn’t a technical cleanup—it meaningfully changes  how  AI is regulated and  where  legal risk shows up.  The Colorado AI Act currently focuses on “high-risk AI” and imposes heavy governance requirements, impact assessments, and risk programs, while the new proposal narrows the scope to automated tools that “materially influence” meaningful decisions and shifts compliance toward consumer notice, post adverse-decision disclosures, and meaningful human review. In sum, the proposal provides a more business friendly approach to AI regulation. But can the bill cross the finish line? What are the key provisions?  Narrows scope to cover more si...

Key point: Oklahoma becomes the 20th state to enact a broad consumer data privacy law. On March 20, 2026, Oklahoma Governor Kevin Stitt signed  SB 546  into law. In doing so, Oklahoma becomes the 20th state to enact a broadly applicable consumer data privacy law. Passage of a consumer data privacy law in Oklahoma has been a multiyear process. The Oklahoma House first passed a consumer data privacy bill authored by then-Representative Collin Walke in 2021, but the bill stalled in the Senate. The House again passed a bill in 2022, and it again stalled in the Senate. The new law is a more business-friendly blend of the 2022 version of Virginia’s consumer data privacy law and the Texas consumer data privacy law. Ultimately, entities subject to other state privacy laws will not have any new compliance obligations. In the below article, we provide an overview of the new law. Applicability The law applies to controllers and processors that conduct business in Oklahoma or produce a p...