Brian Segobiano

A Minnesota appellate court just took a broad view on what constitutes a “collection agency” and where activity occurs “in Minnesota”—with implications for vendors, assignees, and out-of-state operators. Our new blog post breaks down the ruling and its implications for licensing and compliance risks associated with rental car damage claims and beyond. Read the key takeaways in our latest blog post by CoCo Rodriguez: https://lnkd.in/gUw7S2zm #DebtCollection #Compliance #FinancialServices #MinnesotaLaw

5

Former chief of the privacy and data security unit at the Illinois Attorney General’s Office, Matthew Van Hise - who oversaw data breach-related investigations and litigation – has jumped to BakerHostetler as a partner in its Chicago digital assets and data management practice group. https://lnkd.in/e5F7XUMj

1

🚨 The Minnesota Consumer Data Privacy Act (#MCDPA) goes into effect TOMORROW (7/31)! It's the only data privacy law with a data inventory requirement, something businesses may struggle to develop efficiently. Some organizations may be banking on low enforcement, but if other state privacy laws are an example, we can count on active investigations and enforcement from the Minnesota Attorney General. Learn all about the law and its requirements in our blog: https://pvcy.me/4fe26Yr

8

A number of recent #databreach notices and reports have come from insider activities. #Employees can unfortunately be a big cause of #privacy and #security issues, whether intentional or unintentional. When an issue is found, #HIPAA does lay out specific guidance for #sanctions that should be followed. The other lesson, also part of #compliance, is to monitor system activity and be ready to respond. A recent disclosure of a firing where it took 5 years to find the issues should raise some eyebrows as to why discovery took so long. Will a settlement from this one in a few years? https://lnkd.in/e97iNUxg

3

1 Comment

Lineal continues its series of posts about #crossborder #investigations by discussing navigating #data sovereignty in modern investigations! Here's how your organization can become more jurisdiction-aware! https://lnkd.in/gP_GhRhG #ediscovery #ai #dataprivacy

2

Are you inspecting what you expect? Most agencies have a compliance program in place. For some organizations, a periodic compliance review is also a board or governing body expectation. While it’s easy to have a program on paper, it can be harder to step back and evaluate how well it’s working in practice. At MAC Legacy, we review your existing compliance program to determine whether the key elements and recommendations of the OIG are met and effectively implemented. Our Compliance Review looks closely at the Seven Core Areas: • Policies and Procedures - Review of written compliance policies to ensure they are current, accessible, and aligned with Home Health and Hospice regulations and operational practices. • Compliance Oversight and Governance - Evaluation of leadership involvement, designated compliance roles, reporting structure, and board or governing body oversight. • Education and Training - Assessment of compliance training content, frequency, documentation, and staff understanding across clinical, coding, billing, and operations. • Effective Communication - Review of mechanisms for raising concerns, including confidentiality, non-retaliation practices, and how compliance messaging is shared organization-wide. • Auditing and Monitoring - Evaluation of internal audit activities, monitoring processes, risk areas reviewed, and how results are tracked and trended. • Enforcement and Discipline - Review of standards of conduct, disciplinary guidelines, and consistent enforcement related to compliance expectations. Our approach is aligned with OIG expectations, accreditation standards, and current enforcement priorities, but it’s grounded in practical operations, not theory. If you want confidence going into surveys, growth, leadership transitions, or simply want to know your compliance program is more than a checkbox, this review gives you that assurance. Let’s have a conversation about where you are, and how we can help strengthen what you’ve already built. Contact Us Today - mailto:info@mac-legacy.com #homecare #homehealth #hospice #askmaclegacy

1

🇬🇧 🇺🇸 Connected Vehicles: The New Privacy Battlefield (Nebraska AG v. General Motors) Nebraska AG Mike Hilgers' lawsuit against GM/OnStar illuminates a critical inflection point in privacy enforcement: telematics data as the next frontier of regulatory scrutiny. The Allegations' Core Legal Theory: > GM allegedly collected granular driving data (speed, location, seatbelt usage) through embedded telematics, monetizing it via third-party "driving scores" sold to insurers. The deceptive practice claim: overwhelming consumers with materially misleading disclosures that obscured data commercialization. My insights on this matter: > Consent Theater Doctrine: Courts increasingly reject "privacy policies buried in pages of legalese" as valid consent mechanisms. The allegation that GM's disclosures were "false or misleading" suggests evolution toward substantive consent requirements beyond formal notice. > Multi-Jurisdictional Enforcement Cascade: FTC, Texas, Arkansas, and now Nebraska pursuing parallel actions creates de facto national standard through enforcement convergence. This coordinated state AG strategy bypasses federal legislative gridlock. > Insurance Data Nexus: The direct linkage between driving data and insurance underwriting transforms abstract privacy harms into concrete economic injuries – strengthening standing arguments and damage calculations. This isn't merely about one manufacturer. Connected vehicle data represents $450B market by 2030. The enforcement theory here (that embedded data collection requires explicit, granular consent for secondary uses) threatens entire IoT business models. When your vehicle becomes a surveillance device, who owns the behavioral exhaust? Current legal frameworks assume binary ownership models incompatible with continuous data streams. The Nebraska action exemplifies American privacy enforcement's evolution, which is decentralized, aggressive, and economically grounded. Organizations treating U.S. privacy compliance as secondary to GDPR fundamentally misunderstand the risk landscape. #DataPrivacy #ConnectedVehicles #PrivacyLitigation #Telematics #ConsumerProtection #AutomotiveCompliance #GRC

2