Mengyi Xu – Debevoise Data Blog

Announcement

Debevoise Data Blog: Top 5 Privacy Posts of 2025

By: Charu A. Chandrasekhar, Luke Dembosky, Avi Gesser, Erez Liebermann, Robert Maddox, Julie M. Riewe, Kristin Snyder, Rick Sofield, Sheena Paul, Johanna Skrzypczyk, HJ Brehmer, Martha Hirst, Suchita Mandavilli Brundage, Melyssa Eigen, Ned Terrace, Michelle Shen, Diane Bernabei and Mengyi Xu December 11, 2025

As we approach the end of the year, here are the top 5 privacy posts on the Debevoise Data Blog in 2025. Takeaways for Large Firms from the SEC’s Reg…

Cybersecurity

Maturing Compliance with the Bulk Sensitive Data Rule (Data Security Program) before the July 8, 2025 Safe Harbor Expires

By: Luke Dembosky, Avi Gesser, Erez Liebermann, Rick Sofield, Johanna Skrzypczyk and Mengyi Xu May 28, 2025

All eyes are on the DOJ Bulk Sensitive Data Rule (28 C.F.R. Part 202), and July 8, 2025, when the recently announced good-faith safe harbor expires. The rule, which the…

Artificial Intelligence

South Korea Enacts New AI Law

By: Avi Gesser, Mengyi Xu, Martha Hirst, Cameron Sharp, Diane Bernabei and Michelle Shen March 24, 2025

South Korea has become the latest country to pass a national AI law. The “Basic Act on the Development of Artificial Intelligence and Establishment of Foundation for Trust” (the “Basic…

Automated Decision Making

CPPA Proposed Rulemaking Package Part 2 – Automated Decision-Making Technology

By: Avi Gesser, Matt Kelly, Johanna Skrzypczyk, HJ Brehmer, Amer Mneimneh, Ned Terrace and Mengyi Xu February 13, 2025

In Part 1 of this series, we discussed the annual cybersecurity audit requirements in the proposed rulemaking package (the “Draft Regulations”) of the California Privacy Protection Agency (the “CPPA”). In…

Artificial Intelligence

FINRA’s 2025 Regulatory Oversight Report: Focus on Artificial Intelligence

By: Charu A. Chandrasekhar, Avi Gesser, Jeff Robins, Kristin Snyder, Matt Kelly, Cameron Sharp, Ned Terrace and Mengyi Xu February 5, 2025

On January 28, 2025, FINRA released its 2025 FINRA Annual Regulatory Oversight Report (the “Report”). As was the case in 2024, the Report highlights continuing and emerging trends in artificial…

Enforcement

FTC’s Consent Order Against Marriott: Expectations for Reasonable Security

By: Erez Liebermann, Jim Pastore, Christopher S. Ford, Michael Bloom, Mengyi Xu, Achutha Raman and Michelle Shen January 30, 2025

Introduction On December 20, 2024, the Federal Trade Commission (the “FTC”) finalized a consent agreement (“Consent Order”) with Marriott International, Inc. and its subsidiary Starwood Hotels & Resorts Worldwide LLC…

Artificial Intelligence

Treasury’s Post-2024 RFI Report on AI in Financial Services – Uses, Opportunities, and Risks

By: Charu A. Chandrasekhar, Avi Gesser, Erez Liebermann, Gregory Lyons, Jeff Robins, Jeremy Liss, Ned Terrace and Mengyi Xu January 23, 2025

On December 19, 2024, the U.S. Department of Treasury (“Treasury”) released a report on The Uses, Opportunities, and Risks of Artificial Intelligence in the Financial Services Sector (the “Report”). The…

Artificial Intelligence

Colorado Proposes Extending AI Regulation to Health and Auto Insurers

By: Eric Dinallo, Avi Gesser, Marshal Bozzo, Matt Kelly, Samuel J. Allaman, Melyssa Eigen, Ned Terrace, Stephanie Thomas and Mengyi Xu December 16, 2024

On September 21, 2023, the Colorado Division of Insurance (the “Division”) released Regulation 10-1-1, Governance and Risk Management Framework Requirements for Life Insurers’ Use of External Consumer Data and Information…

Artificial Intelligence