Compliance Stuff

Just over a year after Delaware’s privacy law took effect, state lawmakers are close to expanding its reach by passing a bill that could soon cover more businesses, narrow a key exemption, and expand the definition of sensitive data. Most notably for employers, the pending legislation would also impose significant new obligations on the use of AI in the workplace, capturing resume screeners, interview scoring tools, workforce analytics platforms, and similar technology. If the bill passes as expected, these amendments would take effect on January 1, 2027. What do you need to know about this bill and what are the six steps you should take to prepare? Quick Status Update House Bill 380 would amend Delaware’s Personal Data Privacy Act (DPDPA), which passed in 2023 but took effect in 2025 ( you can read a summary here ). The bill passed the House on May 21 by a 30-9 vote and now sits in the state Senate, where it is expected to soon pass given its strong momentum and institutional backin...

In a significant decision, the Delaware Supreme Court reversed the dismissal of Payscale, Inc.’s breach of contract claims arising from Erin Norman’s alleged violations of the noncompete, non-solicitation, and confidentiality provisions contained in the incentive equity agreement that she signed as an employee. The decision reaffirms: (1) nationwide, 18-month noncompetes may be enforceable when they are sufficiently tied to an employer’s articulated economic interests, (2) contingent equity awards are legally sufficient consideration for restrictive covenants , and (3) a plaintiff may plead circumstantial allegations to support claims for breach of non-solicitation and confidentiality provisions. Background Norman entered into an incentive equity agreement that included noncompete, non-solicitation, and confidentiality provisions. In exchange, she received “Profit Interest Units” (PIUs) in Payscale’s parent holding company. At the time, the PIUs were valued at $0, but the PIUs would v...

What the Blackbaud decision means for managed service providers (MSPs) and the clients who rely on them A recent decision by the Delaware Supreme Court in  Travelers Casualty and Surety Company of America v. Blackbaud, Inc.   materially shifts the litigation landscape for cybersecurity incidents involving Software as a Service (SaaS) providers and MSPs. Key takeaways: Lower pleading burden for plaintiffs (including insurers) Less emphasis on proximate cause at early stages Aggregated claims allowed across multiple customers Higher litigation costs and increased settlement pressure Expanded expectations around what constitutes "commercially reasonable" cybersecurity Bottom line: Cyber incidents are now significantly more likely to survive early dismissal and proceed into expensive discovery. What Happened Blackbaud, a SaaS provider hosting sensitive donor data, experienced a ransomware attack exposing highly sensitive personal and financial information. Its customers (nonprof...

  Virginia is poised to further expand its restrictions on employee non-competes. The Virginia legislature r ecently passed   SB 170   (the “SB 170”), making employee non-competes unenforceable if an employer terminates an employee without cause and does not provide severance or other monetary compensation . This new requirement applies to non-competes for employees at all levels regardless of compensation. Failure to comply with SB 170 can lead to civil penalties and private rights of action with recovery of attorney fees and damages. SB 170 is headed to Governor Abigail Spanberger, who is expected to sign it. This development is the latest in the growing patchwork of state non-compete laws. Although the Federal Trade Commission’s (“FTC’s”) nationwide non-compete rule has been  sidelined , scrutiny of restrictive covenants at the FTC remains. States, such as  Colorado ,  Illinois , and  Minnesota , continue to pass laws seeking to limit or ban employ...