Data Privacy

September 7, 2026

Krispy Kreme, Lakeview Loan, Complete Payroll: Why Data Breach Liability Is Now Every Business’s Problem

A doughnut chain, a mortgage servicer, and a payroll processing company have almost nothing in common as businesses. Different industries, different customers, different sizes. But all three ended up in the same place over the past two years: paying millions of dollars to settle lawsuits after hackers got into systems holding ordinary personal information. If you think your business is too small, too unremarkable, or too far outside the tech world to end up in the same position, these three cases say otherwise.

Krispy Kreme: Employee Data, Not Just Customer Data

Krispy Kreme discovered a data breach in November 2024 that exposed the personal information of 161,676 current and former employees, including Social Security numbers, dates of birth, and financial account access details. The lawsuits that followed alleged the company failed to comply with basic data security obligations under the FTC Act and industry standards, and specifically claimed the sensitive information was never encrypted or redacted. Krispy Kreme agreed to pay roughly 1.6 million dollars to resolve the claims.

December 17, 2024

Browser Tracking Software – Is this a wiretap violation?

by Bellas & Wachowski - Attorneys at Law

Wire Tapping vs. Browser Tracking?

Software like Meta Pixel and Google Analytics that website operators use to track what sites a person visits, or what footprint they leave on those sites, is not subject to the same restrictions as wiretapping a phone line, according to a split decision from the Supreme Judicial Court of Massachusetts, in a case brought against two hospitals.

The court in Vita v. New England Baptist Hospital, et al (SJC-13542), ruled that wiretapping and browser tracking are categorically different pursuits, in its eyes, unless the state legislature decides otherwise. “If the Legislature intends for the Wiretap Act’s criminal and civil penalties to prohibit the tracking of a person’s browsing of, and interaction with, published information on websites, it must say so expressly,” wrote Associate Judge Scott Kafker in the opinion.

October 14, 2024

Consumer Privacy Laws Include Neural Data: What Illinois Business Owners Need to Know

by George Bellas

Neural Data: What Illinois Business Owners Need to Know

California enacted an Amendment to the California Consumer Privacy Act (CCPA) that adds neural data to the list of protected personal sensitive information. For Illinois business owners—especially those conducting business in California or utilizing neurotechnology—this development is worth understanding, as it marks another step in the expanding landscape of data privacy laws. Neural data, often collected through non-invasive neurotechnology tools, is now considered sensitive and will be protected under the same stringent requirements as other personal information like genetic, biometric, and geolocation data.

What is Neural Data and Why is it Important?

June 11, 2024

Using Generative AI in Business? Make Sure to Keep Your Secrets

by George Bellas

Using Generative AI? Keep Your Secrets

Businesses are finding generative AI programs like ChatGPT useful in functions from financial services to human resources. Although still in its early stages, and far from entirely reliable, the technology is evolving quickly and its tools and practices will continue to develop. The Cisco 2024 Data Privacy Benchmark study found that 79% of businesses say they’re deriving measurable value from generative AI for everything from creating documents to coding.

But this use of generative AI has led to a number of cautions, mostly commonly and loudly about the accuracy of the information that apps like ChatGPT generate—including their tendency to “hallucinate” assertions when they don’t actually have answers.