Photo of Kim Phan

Kim is a partner in the firm’s Privacy + Cyber Practice Group, where she is a privacy and data security attorney, who also assists companies with data breach prevention and response, including establishing effective security programs prior to a data breach and the assessment of breach response obligations following a breach.

In this episode of The Crypto Exchange, Troutman Pepper Partner Ethan Ostroff welcomes his colleagues Kim Phan and Addison Morgan to discuss the recent enforcement actions brought by the Federal Trade Commission (FTC) against Celsius Network and its co-founders. In addition to permanently banning Celsius Network from consumers’ assets, the FTC also fined the company a near record-breaking $4.7 billion.

At a White House Roundtable on protecting Americans from allegedly harmful “data broker” practices, Consumer Financial Protection Bureau (CFPB or Bureau) Director Rohit Chopra announced the Bureau’s intention to expand the reach of the Fair Credit Reporting Act (FCRA) to data brokers. He stated, “Next month, the CFPB will publish an outline of proposals and alternatives under consideration for a proposed rule. We’ll soon hear from small businesses, which will help us craft the rule.”

Please join Troutman Pepper Partner Chris Willis and his colleague Kim Phan as they discuss the new California Privacy Rights Act (CPRA) and the creation of the California Privacy Protection Agency (CPPA), California’s first state agency focused exclusively on privacy. They also dive into the CPPA’s recent amendments to the California Consumer Privacy Act (CCPA), discussing the timeline, overview, and technical guidance for companies. And with 23 topical areas of regulation — what we can expect from the CPRA’s next set of rules.

Do companies that use workplace surveillance tools to make hiring and firing decisions risk violating the Fair Credit Reporting Act (FCRA)? According to the Consumer Financial Protection Bureau (CFPB or Bureau) in a recent comment, the answer to that question is yes. The Bureau’s official comment comes in response to a request for information

Please join Troutman Pepper Partners Chris Willis and Kim Phan for an in-depth discussion about the Securities and Exchange Commission’s (SEC’s) recent record retention enforcement actions. Chris and Kim explore the uptick in enforcement actions over the last year, the claims made in these cases, the SEC-imposed requirements and penalties on these companies, what we can expect going forward from the financial services regulators, and what financial institutions should do now to get ahead of these types of enforcement actions.

On March 15, the Consumer Financial Protection Bureau (CFPB) issued a Request for Information (Request) seeking public comment on the business practices of data brokers and how they impact the daily lives of consumers. Specifically, the CFPB is interested in hearing details about the types of data that data brokers collect and sell, as well

On February 9, the U.S. Department of Education (ED) released an announcement about updates that postsecondary institutions must make to their cybersecurity and data protection policies in order to comply with the Federal Trade Commission’s amended Standards for Safeguarding Customer Information (Safeguards Rule), a component of the Gramm-Leach-Bliley Act (GLBA). The effective date for most

As previously reported here, on May 25, 2022, the Consumer Financial Protection Bureau (CFPB or Bureau) published a blog post, examining what it described as the “practice of suppressing payment data” by credit card issuers in connection with their credit reporting. In its blog post, the CFPB alleged its research conducted in 2020

As discussed here, on October 27, 2022, the CFPB released an Outline of Proposals and Alternatives Under Consideration for public comments on the CFPB’s Section 1033 rulemaking. The window for providing written feedback closed on January 25, 2023. Below we have highlighted some of the submissions by industry and consumer groups.

The proposed rules

On January 4, the Consumer Financial Protection Bureau (CFPB) issued its 2022 Fall Rulemaking Agenda containing pre-rule, proposed rule, and final rules under consideration. The CFPB releases regulatory agendas twice a year in voluntary conjunction with a broader initiative led by the Office of Budget and Management to publish a Unified Agenda of Regulatory and Deregulatory actions across the federal government. In the preamble to the Federal Register notice, the CFPB states that the information is current as of September 30, 2022 and identifies regulatory matters the CFPB “reasonably anticipates” having under consideration during the period from December 1, 2022, to November 30, 2023. The CFPB has not yet posted a blog or issued a press release about the agenda.