Ryan M. Duffy

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch. Reasons Behind the Amendment Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026). With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement). CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available. What the Statute Now Says Broader Deletion Right Amended Section 1798.105(a) provides: “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” Suppression Records for Third-Party Data For data obtained from other sources, the law gives businesses a defined way to comply: “A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.” Expanded Downstream Obligations The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records. Preserved Exceptions  Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.” New Online Request Requirement Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice. What Is Required, From Whom, and When Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same.  Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number. Practical Steps to Take Before January 1, 2027 Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions.  Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.

Dale S. Dobuler (Partner-Orlando, FL), Peter M. Moore (Partner-McLean, VA), and Jessica Forbes (Of Counsel-Orlando, FL) will present the Wilson Elser Forum webinar “What Your Coverage Counsel Wants You to Know – But May Not Tell You” on October 22, 2026. When should claims professionals bring in external coverage counsel ‒ and how can they make the most of that relationship? This session explores when external coverage counsel may be warranted, how counsel can support claims professionals beyond addressing disputed or questionable coverage, and ways to maximize counsel’s involvement to achieve the best outcomes. The discussion will also address how to clearly define coverage counsel’s role in matters involving disputed coverage and other coverage-related concerns. Claims professionals will come away with a better understanding of when and how to engage external coverage counsel, how to make effective use of counsel’s expertise, and how to work together efficiently throughout the claims handling process.

New York office partners Larry Lum and Joseph Laird will present the webinar “Risk Transfer: A Comprehensive Approach for Best Outcomes” on October 21, 2026, for Verist, a provider of holistic insurance and risk management solutions for commercial lines clients. The presentation is specifically designed for Verist's real estate clients, hospitality clients, and broker partners. Larry and Joe will focus on practical considerations and best practices surrounding contractual risk transfer and the tender process ‒ areas that can have a meaningful impact on how claims are managed and ultimately resolved ‒ providing strategic insights driving real estate and hospitality excellence.

Lara Lickhalter (Partner-Chicago, IL) was re-elected to the Trucking Industry Defense Association (TIDA) Board of Directors on October 15, 2026, at TIDA's 34th Annual Seminar in San Diego, California. TIDA is a nonprofit association dedicated to sharing knowledge and resources for the defense of the trucking industry. Its membership includes more than 1,600 motor carriers, trucking insurers, defense attorneys, and claims service companies throughout the United States and Canada. Lara was first elected to the TIDA Board in 2023. Lara has more than 15 years of experience litigating catastrophic trucking and transportation claims involving motor carriers, freight brokers, bus lines, and contract carriers. She is a member of Wilson Elser's National Emergency Rapid Response Team.  

Washington, D.C. partners Ryan Duffy and Kathleen Warin secured two significant victories in the U.S. District Court for the District of Columbia on behalf of the Financial Industry Regulatory Authority (FINRA). In two separate cases, former securities brokers sought to expunge customer dispute information from their registration records maintained by FINRA in the Central Registration Depository (CRD) system, which is publicly available through BrokerCheck as required under the Securities Exchange Act of 1934. The plaintiffs each asserted claims for equitable expungement, declaratory judgment, and a permanent injunction. In both cases, the Wilson Elser team successfully argued that the plaintiffs failed to identify any cognizable cause of action against FINRA that would entitle them to expungement relief. Ryan and Kathleen demonstrated that neither the Exchange Act nor FINRA Rules create a private right of action against FINRA for expungement of customer dispute information from the CRD, and that the plaintiffs' claims for equitable relief, declaratory judgment, and a permanent injunction were remedies rather than cognizable causes of action. Both courts agreed in full, granting FINRA's motions to dismiss with prejudice. They held that the Exchange Act's comprehensive regulatory scheme does not authorize private suits against FINRA for actions taken pursuant to its statutory obligations, and that federal courts have overwhelmingly declined to recognize any such private right of action. The courts also rejected the plaintiffs’ arguments that their inherent equitable powers could supply the missing cause of action, reaffirming the well-established principle that equitable expungement, declaratory relief, and injunctive relief are forms of remedy ‒ not independent sources of legal entitlement. Together, these decisions provide critical legal authority and reinforce that brokers have no private right of action against FINRA for expungement of customer dispute information maintained pursuant to its statutory obligations. 

Kirsten L. Curtis (Partner-Portland, OR) and Jane E. Young (Partner-Denver, CO) will present the Wilson Elser Forum webinar “Handling UM/UIM Claims with Confidence: Coverage, Investigation, and Resolution Best Practices” on October 20, 2026. This session provides a comprehensive overview of best practices for adjusting uninsured and underinsured motorist (UM/UIM) claims. Topics include confirming coverage applicability, verifying the insured's status as a covered person, establishing the liability of the uninsured or underinsured tortfeasor, and evaluating damages. The session also covers stacking and offset issues, as well as how UM/UIM obligations interact with policy limits, exhaustion requirements, and inter-company arbitration. Also addressed are common coverage triggers, consent-to-settle provisions, subrogation rights, and jurisdiction-specific variations that adjusters should be aware of when handling these claims. Whether you are new to UM/UIM or looking to sharpen your approach, this session will equip you with practical strategies for handling claims efficiently, accurately, and in compliance with applicable regulations and fair claims practices standards.

David M. Morrow (Partner-Los Angeles, CA) and Michael Diaz (Of Counsel-Los Angeles, CA) successfully defended a commercial property owner and trustee in a habitability action before the Los Angeles County Superior Court. The plaintiff, a tenant at the client’s property in Los Angeles, asserted that the leased property was uninhabitable and a nuisance, alleging breaches of contract and habitability, numerous statutory violations, and seeking attorneys’ fees and punitive damages. David and Michael initially obtained judgment on the pleadings and struck plaintiff’s claims for attorneys’ fees and punitive damages. Based on those orders, they then prevailed on a motion to strike the plaintiff’s complaint and dismiss the action, resulting in a judgment in the client’s favor and dismissal of the case with prejudice. David and Michael later defeated the plaintiff’s post-judgment motion seeking relief, preserving the judgment and securing a complete victory for the client. 

Q: Are employees entitled by law to access their personnel files?   A: There is no federal law that gives private-sector employees the right to view their personnel files. Access is regulated entirely by state-specific laws. There are currently 19 states that legally require employers to permit employees (and sometimes former employees) to view and/or obtain a copy of their personnel file. As of November 8, 2026, that number will increase to 20, when New York’s recently enacted Personnel Records Access Law goes into effect. The majority of states have no law requiring access to personnel files and there is no federal law that confers on current or former employees a statutory right to access their personnel files.  As of October of 2026, the following states provide right of access to current employees: Alaska, California, Colorado, Connecticut, Delaware, Illinois, Iowa, Maine, Massachusetts, Michigan, Minnesota, Nevada, New Hampshire, Oregon, Pennsylvania, Rhode Island, Virgina, Washington, and Wisconsin.  Some states, including New York (as of November 8, 2026), also allow former employees to view their personnel files. Each state has its own caveats to access. For example, Washington allows for a former employee to retain the right of rebuttal or correction for up to two years following their separation from employment.  New York’s new law, Senate Bill 2025-S3460, was signed by Governor Kathy Hochul on September 9, 2026, adding Section 210-b to the New York Labor Law. The law covers public and private sector employers, including individuals, corporations, partnerships, labor organizations, unincorporated associations, other legal businesses and employer agents.  Employers operating in New York should familiarize themselves with the requirements of Section 210-b now, before it goes into effect, and update their document-management and onboarding practices accordingly, as non-compliance may expose them to claims under the New York Labor Law.  What Will New York Law Require? The law in New York will require employers to provide current and former employees with a copy of their personnel records within five (5) business days of a written request, up to twice per calendar year, at no cost to the employee. Employers also must notify employees within ten business (10) days after placing information in a personnel record that is, has been, or may be used to negatively affect the employee’s qualifications for employment, promotion, transfer, additional compensation, or the possibility of disciplinary action. If there is a disagreement with any information within the personnel record, removal or correction of the information may be mutually agreed upon by the employer and the employee. If the employee doesn’t agree with the information the employer places in the file, the employee can submit a written statement explaining the employee’s position, which must become a part of the employee’s personnel record and must accompany the disputed information when it is transmitted to a third party, so long as the original information remains in the file. Employers are not required to permit an employee to review their personnel record more than twice per calendar year, but a notification and review resulting from the placement of negative information in the record does not count toward that limit. Under the new law, to the extent employers create personnel records, without deletions or expungement of information, they are required to maintain them from the date of employment through three years after termination of the employee’s employment. What Types of Documents Are Covered Under New York’s Personnel Records Law? The New York law expressly defines “personnel records” to include the following written information and documents prepared by an employer regarding an employee, for inclusion in the employee’s personnel record: Name, address, date of birth, job title and description  Rate of pay and any other compensation paid to the employee Starting date of employment  The job application of the employee  Resumes or other forms of employment inquiry submitted by the employee to the employer in response to the employer's advertisement  All employee performance evaluations, including but not limited to employee evaluation documents  Written warnings of substandard performance  Lists of probationary periods  Waivers signed by the employee Copies of dated termination notices  Any documents relating to disciplinary action regarding the employee The law applies broadly and is not limited to the above-listed documentation. Examples of documents also likely covered include: 1. Employment agreements and offer letters signed at the start of the employment relationship 2. Handbook and policy acknowledgment forms, such as sign-offs on anti-harassment policies, code of conduct agreements, or confidentiality acknowledgments 3. Performance improvement plans that the employee is asked to sign to confirm receipt 4. Separation-related documents, such as resignation acknowledgments or exit interview forms, to the extent they are placed in the personnel file Note that the law expressly excludes, “information of a personal nature about a person other than the employee if disclosure of the information would constitute a clearly unwarranted invasion of such other person’s privacy.” The law prohibits employers and other persons from discharging, threatening, penalizing, discriminating, or retaliating against employees who exercise their statutory rights.  Practical Tips for New York Employers New York employers should keep several practical points in mind as they prepare to comply with Section 210-b of the Labor Law: 1. Review current practices and protocols. Before November 8, 2026, New York employers should review their personnel record practices and retention procedures. Employers should establish a protocol for tracking and responding to an employee’s request for the employee’s personnel file. Determine whether your organization already provides employees with copies of all signed personnel documents. Employers also should evaluate whether covered personnel records maintained by third-party providers can be produced within five business days.  2. Update onboarding and HR workflows. Ensure that standard operating procedures require HR personnel and managers to provide a copy of every signed document to the employee at the time of signing. Consider building this step into electronic onboarding platforms and document management systems so that copy delivery is automatic rather than dependent on individual compliance to ensure timely compliance with the notification requirements. 3. Leverage electronic signature and document management tools. Employers using e-signature platforms can configure them to send a completed copy of each signed document to the employee automatically, which streamlines compliance and creates a reliable audit trail. 4. Train HR staff and supervisors. Managers and HR professionals who handle personnel paperwork should be informed of the new requirement and understand that every signed document placed in a personnel file must be accompanied by delivery of a copy to the employee. Employers should train HR personnel and managers on the law’s access, notice, retention, and anti-retaliation requirements. 5. Document delivery of copies. Maintain a record confirming that each signed document was provided to the employee. Whether through an electronic system's automatic confirmation, an email transmittal, or a signed acknowledgment of receipt, this documentation can be important if compliance is later questioned. What Are the Risks of Non-Compliance? For companies that violate the law, New York’s Attorney General would be empowered to seek penalties ranging from $500 to $2,500 per violation, and workers who face discrimination or retaliation for asserting their rights would have a private right of action. Broader Considerations New York's enactment of Section 210-b is part of a broader trend of states strengthening employee access to workplace records. For instance, California employers must allow current and former employees to inspect and receive copies of personnel records relating to the employee’s performance or any grievance concerning the employee. In addition, California employers must also provide education and training records upon the employee’s authorized request within a 30-day window. In contrast, employers in the state of Texas are not required to turn over personnel files to current or former employees. Employers operating in multiple jurisdictions should be aware that personnel-file access laws vary significantly from state to state. 

AI State Laws Now Top 150 Around the Country New York – October 19, 2026 – National law firm Wilson Elser, in partnership with Ankura Consulting Group, LLC and Privado AI, recently held an inaugural conference on privacy, security, and AI governance. The program focused on evolving privacy laws and security best practices, with artificial intelligence front and center as organizations navigate a growing patchwork of state AI laws. “Convergence: The Intersection of Privacy, Security & AI Governance” was held September 30 at Wilson Elser’s New York offices, featuring speakers from Wilson Elser, Ankura, Privado AI, and several insurance carriers. JD Cheema, Founder of Privado AI, delivered a keynote on technology-enabled data discovery and AI governance.  “Privacy, security, and AI governance are no longer separate conversations. Agentic AI, tightening regulation, and a more active enforcement environment have brought them into the same room,” said Jana Farmer, partner and cochair of Wilson Elser’s Data Use & AI Governance Practice. “At the moment, there is no comprehensive federal standard governing AI use in the United States.”  “Instead, we’re seeing a rapidly growing patchwork of state laws and regulations,” said Farmer, noting that states including New York, California, Utah, Texas, and Colorado have passed more than 150 AI-related laws in the last year alone. “Given this landscape, businesses should plan for the possibility that some of the use cases of AI technology could become restricted after deployment, so that their AI investments hold up as the rules develop.”  The program paired practitioner-level content with built-in opportunities to connect. Convergence was attended by general counsel, privacy and security leaders, cybersecurity and risk professionals, the insurance and carrier community, and outside advisors who serve them. Conference panels included: Navigating the Privacy and AI Landscape: From New Laws to the Courtroom Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; JD Cheema, Privado; and Christina Van Wert, Senior Manager, Cyber & Professional Lines Group, Tokio Marine HCC.  Topic: Privacy and AI regulation continues to develop on several fronts, and organizations are fielding attention from legislators, regulators, and plaintiffs alike. Through an interactive session, panelists traced the newest privacy and AI legislation, current enforcement priorities, and litigation trends, giving attendees a practical compliance walkthrough they can put to immediate use. Cybersecurity and AI: Governing Agentic Systems Panelists: Dominik Cvitanovic, Wilson Elser; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; Craig Linton, Head of U.S. Underwriting Management for Cyber Risks, Beazley; and Bridget Choi, Cyber Insurance Product Lead, Gallagher. Topic: Agentic AI is reshaping how organizations operate, creating a new class of cybersecurity, contractual, and operational risk. Insurers and insureds alike are asking questions that cut across every industry deploying these systems. Using scenarios drawn from real-world deployments and cyber events, panelists gave attendees practical guidance on governing agentic AI before, during, and after an incident. Cybersecurity Pitfalls and Avoiding the Wrath of Regulators Panelists: Anjali Das, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; and Cody Valdez (former Deputy AG, New Jersey Attorney General’s Office), now an attorney at Wilson Elser. Topic: When a cybersecurity incident hits, regulators are rarely far behind, and they increasingly arrive from several directions at once. A single event can draw parallel scrutiny from the SEC, state financial regulators, health privacy enforcers, and state attorneys general, each with its own rules, deadlines, and enforcement posture. Drawing on recent investigations and enforcement actions, this panel mapped where organizations most often stumble and gave attendees a practical playbook for staying on the right side of the agencies that matter. Implementing AI Across the Business: A Practical Guide to the Risks Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Jonathan Meer, Wilson Elser; Scott Margolis, Managing Director, Data and Information Governance Practice, Ankura; Matthew McQueeny, AAANow.ai and Earnfluencing; and Rahmila Nadi, Women Leading AI Topic: AI is changing how organizations operate, and the legal and operational risks reach well beyond any single department. No one-size-fits-all approach exists, but common themes cut across every business weighing how to adopt AI responsibly. Through scenarios drawn from situations businesses are navigating right now, panelists gave attendees practical, actionable guidance on the legal and business ramifications of putting AI to work. About Wilson Elser’s Data Use & AI Governance Practice  Wilson Elser is a trusted privacy, security, and AI governance firm in the United States and the preeminent defense litigation firm in the privacy and cyber class action space. For more information about the practice, go to: https://www.wilsonelser.com/data-use-ai-governance About Wilson Elser Wilson Elser is the preeminent defense litigation firm in the United States. Over more than four decades, our litigation and trial lawyers have gained a reputation for taking on and prevailing in the most challenging and technical cases, frequently “parachuting in” to assume unresolved matters from other law firms. Our success also derives from winning on our clients’ terms and rigorously adhering to their guidelines. We are ranked 94 in the Am Law 100 and 30 in the National Law Journal’s NLJ 500. For more information, go to www.wilsonelser.com About Ankura, LLC  Ankura is a leading global consulting and expert services advisory firm with a broad range of specialties across industries, including the cybersecurity, data privacy and governance, and artificial intelligence space. The firm combines strategic advisory with deep technical expertise, hands-on implementation, and expert support to address complex business challenges. Ankura has more than 35 locations and supports projects in more than 115 countries. For more information, go to https://ankura.com/ About Privado AI   Privado AI is an agentic data privacy management platform that helps privacy and compliance teams automate manual governance workflows, map data flows, and detect consent-compliance violations at scale. Founded in 2020, the company leverages specialized AI agents to replace traditional, slow, questionnaire-based compliance methods. For more information, go to https://www.privado.ai/

David Glazer (Partner-New York, NY) and Christian Balodis (Associate-New York, NY) coauthored the article “When Is Work ‘Work’? Dibrino, Calix and the Narrowing of Contractual Indemnity,” published as a preview by the New York State Bar Association on October 6, 2026. The article examines how two recent New York decisions ‒ Dibrino v. Rockefeller Center North, Inc. and Calix v. Union Theological Seminary in the City of New York ‒ have narrowed when broadly worded contractual indemnification provisions are triggered. The authors examine how the decisions shift the focus from an injured worker’s general connection to a project, including employment, site presence, or equipment ownership, to whether the specific condition that caused the injury arose from the proposed indemnitor’s actual contractual work. The decisions bring the First Department in line with the stricter approach previously applied in the Second and Third Departments, with significant implications for litigation strategy, discovery, settlement negotiations, and drafting of indemnification provisions. David and Christian explain that these case results are particularly significant for practitioners in the First Department, where courts previously took a broader approach to contractual indemnity. They also discuss how the decisions will change the way indemnity disputes are analyzed going forward, requiring closer attention to the specific condition that caused the injury and which contractor’s work produced it, pointing out that “Indemnity disputes that were once resolved by pointing to the proposed indemnitor’s project involvement will now turn on the granular question of which contractor’s work produced the specific condition that caused the injury.”

New York office partners Larry Lum and Joseph Laird will present the webinar “Risk Transfer: A Comprehensive Approach for Best Outcomes” on October 21, 2026, for Verist, a provider of holistic insurance and risk management solutions for commercial lines clients. The presentation is specifically designed for Verist's real estate clients, hospitality clients, and broker partners. Larry and Joe will focus on practical considerations and best practices surrounding contractual risk transfer and the tender process ‒ areas that can have a meaningful impact on how claims are managed and ultimately resolved ‒ providing strategic insights driving real estate and hospitality excellence.

Dale S. Dobuler (Partner-Orlando, FL), Peter M. Moore (Partner-McLean, VA), and Jessica Forbes (Of Counsel-Orlando, FL) will present the Wilson Elser Forum webinar “What Your Coverage Counsel Wants You to Know – But May Not Tell You” on October 22, 2026. When should claims professionals bring in external coverage counsel ‒ and how can they make the most of that relationship? This session explores when external coverage counsel may be warranted, how counsel can support claims professionals beyond addressing disputed or questionable coverage, and ways to maximize counsel’s involvement to achieve the best outcomes. The discussion will also address how to clearly define coverage counsel’s role in matters involving disputed coverage and other coverage-related concerns. Claims professionals will come away with a better understanding of when and how to engage external coverage counsel, how to make effective use of counsel’s expertise, and how to work together efficiently throughout the claims handling process.

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch. Reasons Behind the Amendment Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026). With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement). CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available. What the Statute Now Says Broader Deletion Right Amended Section 1798.105(a) provides: “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” Suppression Records for Third-Party Data For data obtained from other sources, the law gives businesses a defined way to comply: “A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.” Expanded Downstream Obligations The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records. Preserved Exceptions  Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.” New Online Request Requirement Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice. What Is Required, From Whom, and When Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same.  Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number. Practical Steps to Take Before January 1, 2027 Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions.  Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.

Lara Lickhalter (Partner-Chicago, IL) was re-elected to the Trucking Industry Defense Association (TIDA) Board of Directors on October 15, 2026, at TIDA's 34th Annual Seminar in San Diego, California. TIDA is a nonprofit association dedicated to sharing knowledge and resources for the defense of the trucking industry. Its membership includes more than 1,600 motor carriers, trucking insurers, defense attorneys, and claims service companies throughout the United States and Canada. Lara was first elected to the TIDA Board in 2023. Lara has more than 15 years of experience litigating catastrophic trucking and transportation claims involving motor carriers, freight brokers, bus lines, and contract carriers. She is a member of Wilson Elser's National Emergency Rapid Response Team.  

Washington, D.C. partners Ryan Duffy and Kathleen Warin secured two significant victories in the U.S. District Court for the District of Columbia on behalf of the Financial Industry Regulatory Authority (FINRA). In two separate cases, former securities brokers sought to expunge customer dispute information from their registration records maintained by FINRA in the Central Registration Depository (CRD) system, which is publicly available through BrokerCheck as required under the Securities Exchange Act of 1934. The plaintiffs each asserted claims for equitable expungement, declaratory judgment, and a permanent injunction. In both cases, the Wilson Elser team successfully argued that the plaintiffs failed to identify any cognizable cause of action against FINRA that would entitle them to expungement relief. Ryan and Kathleen demonstrated that neither the Exchange Act nor FINRA Rules create a private right of action against FINRA for expungement of customer dispute information from the CRD, and that the plaintiffs' claims for equitable relief, declaratory judgment, and a permanent injunction were remedies rather than cognizable causes of action. Both courts agreed in full, granting FINRA's motions to dismiss with prejudice. They held that the Exchange Act's comprehensive regulatory scheme does not authorize private suits against FINRA for actions taken pursuant to its statutory obligations, and that federal courts have overwhelmingly declined to recognize any such private right of action. The courts also rejected the plaintiffs’ arguments that their inherent equitable powers could supply the missing cause of action, reaffirming the well-established principle that equitable expungement, declaratory relief, and injunctive relief are forms of remedy ‒ not independent sources of legal entitlement. Together, these decisions provide critical legal authority and reinforce that brokers have no private right of action against FINRA for expungement of customer dispute information maintained pursuant to its statutory obligations. 

Kirsten L. Curtis (Partner-Portland, OR) and Jane E. Young (Partner-Denver, CO) will present the Wilson Elser Forum webinar “Handling UM/UIM Claims with Confidence: Coverage, Investigation, and Resolution Best Practices” on October 20, 2026. This session provides a comprehensive overview of best practices for adjusting uninsured and underinsured motorist (UM/UIM) claims. Topics include confirming coverage applicability, verifying the insured's status as a covered person, establishing the liability of the uninsured or underinsured tortfeasor, and evaluating damages. The session also covers stacking and offset issues, as well as how UM/UIM obligations interact with policy limits, exhaustion requirements, and inter-company arbitration. Also addressed are common coverage triggers, consent-to-settle provisions, subrogation rights, and jurisdiction-specific variations that adjusters should be aware of when handling these claims. Whether you are new to UM/UIM or looking to sharpen your approach, this session will equip you with practical strategies for handling claims efficiently, accurately, and in compliance with applicable regulations and fair claims practices standards.

David M. Morrow (Partner-Los Angeles, CA) and Michael Diaz (Of Counsel-Los Angeles, CA) successfully defended a commercial property owner and trustee in a habitability action before the Los Angeles County Superior Court. The plaintiff, a tenant at the client’s property in Los Angeles, asserted that the leased property was uninhabitable and a nuisance, alleging breaches of contract and habitability, numerous statutory violations, and seeking attorneys’ fees and punitive damages. David and Michael initially obtained judgment on the pleadings and struck plaintiff’s claims for attorneys’ fees and punitive damages. Based on those orders, they then prevailed on a motion to strike the plaintiff’s complaint and dismiss the action, resulting in a judgment in the client’s favor and dismissal of the case with prejudice. David and Michael later defeated the plaintiff’s post-judgment motion seeking relief, preserving the judgment and securing a complete victory for the client. 

Q: Are employees entitled by law to access their personnel files?   A: There is no federal law that gives private-sector employees the right to view their personnel files. Access is regulated entirely by state-specific laws. There are currently 19 states that legally require employers to permit employees (and sometimes former employees) to view and/or obtain a copy of their personnel file. As of November 8, 2026, that number will increase to 20, when New York’s recently enacted Personnel Records Access Law goes into effect. The majority of states have no law requiring access to personnel files and there is no federal law that confers on current or former employees a statutory right to access their personnel files.  As of October of 2026, the following states provide right of access to current employees: Alaska, California, Colorado, Connecticut, Delaware, Illinois, Iowa, Maine, Massachusetts, Michigan, Minnesota, Nevada, New Hampshire, Oregon, Pennsylvania, Rhode Island, Virgina, Washington, and Wisconsin.  Some states, including New York (as of November 8, 2026), also allow former employees to view their personnel files. Each state has its own caveats to access. For example, Washington allows for a former employee to retain the right of rebuttal or correction for up to two years following their separation from employment.  New York’s new law, Senate Bill 2025-S3460, was signed by Governor Kathy Hochul on September 9, 2026, adding Section 210-b to the New York Labor Law. The law covers public and private sector employers, including individuals, corporations, partnerships, labor organizations, unincorporated associations, other legal businesses and employer agents.  Employers operating in New York should familiarize themselves with the requirements of Section 210-b now, before it goes into effect, and update their document-management and onboarding practices accordingly, as non-compliance may expose them to claims under the New York Labor Law.  What Will New York Law Require? The law in New York will require employers to provide current and former employees with a copy of their personnel records within five (5) business days of a written request, up to twice per calendar year, at no cost to the employee. Employers also must notify employees within ten business (10) days after placing information in a personnel record that is, has been, or may be used to negatively affect the employee’s qualifications for employment, promotion, transfer, additional compensation, or the possibility of disciplinary action. If there is a disagreement with any information within the personnel record, removal or correction of the information may be mutually agreed upon by the employer and the employee. If the employee doesn’t agree with the information the employer places in the file, the employee can submit a written statement explaining the employee’s position, which must become a part of the employee’s personnel record and must accompany the disputed information when it is transmitted to a third party, so long as the original information remains in the file. Employers are not required to permit an employee to review their personnel record more than twice per calendar year, but a notification and review resulting from the placement of negative information in the record does not count toward that limit. Under the new law, to the extent employers create personnel records, without deletions or expungement of information, they are required to maintain them from the date of employment through three years after termination of the employee’s employment. What Types of Documents Are Covered Under New York’s Personnel Records Law? The New York law expressly defines “personnel records” to include the following written information and documents prepared by an employer regarding an employee, for inclusion in the employee’s personnel record: Name, address, date of birth, job title and description  Rate of pay and any other compensation paid to the employee Starting date of employment  The job application of the employee  Resumes or other forms of employment inquiry submitted by the employee to the employer in response to the employer's advertisement  All employee performance evaluations, including but not limited to employee evaluation documents  Written warnings of substandard performance  Lists of probationary periods  Waivers signed by the employee Copies of dated termination notices  Any documents relating to disciplinary action regarding the employee The law applies broadly and is not limited to the above-listed documentation. Examples of documents also likely covered include: 1. Employment agreements and offer letters signed at the start of the employment relationship 2. Handbook and policy acknowledgment forms, such as sign-offs on anti-harassment policies, code of conduct agreements, or confidentiality acknowledgments 3. Performance improvement plans that the employee is asked to sign to confirm receipt 4. Separation-related documents, such as resignation acknowledgments or exit interview forms, to the extent they are placed in the personnel file Note that the law expressly excludes, “information of a personal nature about a person other than the employee if disclosure of the information would constitute a clearly unwarranted invasion of such other person’s privacy.” The law prohibits employers and other persons from discharging, threatening, penalizing, discriminating, or retaliating against employees who exercise their statutory rights.  Practical Tips for New York Employers New York employers should keep several practical points in mind as they prepare to comply with Section 210-b of the Labor Law: 1. Review current practices and protocols. Before November 8, 2026, New York employers should review their personnel record practices and retention procedures. Employers should establish a protocol for tracking and responding to an employee’s request for the employee’s personnel file. Determine whether your organization already provides employees with copies of all signed personnel documents. Employers also should evaluate whether covered personnel records maintained by third-party providers can be produced within five business days.  2. Update onboarding and HR workflows. Ensure that standard operating procedures require HR personnel and managers to provide a copy of every signed document to the employee at the time of signing. Consider building this step into electronic onboarding platforms and document management systems so that copy delivery is automatic rather than dependent on individual compliance to ensure timely compliance with the notification requirements. 3. Leverage electronic signature and document management tools. Employers using e-signature platforms can configure them to send a completed copy of each signed document to the employee automatically, which streamlines compliance and creates a reliable audit trail. 4. Train HR staff and supervisors. Managers and HR professionals who handle personnel paperwork should be informed of the new requirement and understand that every signed document placed in a personnel file must be accompanied by delivery of a copy to the employee. Employers should train HR personnel and managers on the law’s access, notice, retention, and anti-retaliation requirements. 5. Document delivery of copies. Maintain a record confirming that each signed document was provided to the employee. Whether through an electronic system's automatic confirmation, an email transmittal, or a signed acknowledgment of receipt, this documentation can be important if compliance is later questioned. What Are the Risks of Non-Compliance? For companies that violate the law, New York’s Attorney General would be empowered to seek penalties ranging from $500 to $2,500 per violation, and workers who face discrimination or retaliation for asserting their rights would have a private right of action. Broader Considerations New York's enactment of Section 210-b is part of a broader trend of states strengthening employee access to workplace records. For instance, California employers must allow current and former employees to inspect and receive copies of personnel records relating to the employee’s performance or any grievance concerning the employee. In addition, California employers must also provide education and training records upon the employee’s authorized request within a 30-day window. In contrast, employers in the state of Texas are not required to turn over personnel files to current or former employees. Employers operating in multiple jurisdictions should be aware that personnel-file access laws vary significantly from state to state. 

AI State Laws Now Top 150 Around the Country New York – October 19, 2026 – National law firm Wilson Elser, in partnership with Ankura Consulting Group, LLC and Privado AI, recently held an inaugural conference on privacy, security, and AI governance. The program focused on evolving privacy laws and security best practices, with artificial intelligence front and center as organizations navigate a growing patchwork of state AI laws. “Convergence: The Intersection of Privacy, Security & AI Governance” was held September 30 at Wilson Elser’s New York offices, featuring speakers from Wilson Elser, Ankura, Privado AI, and several insurance carriers. JD Cheema, Founder of Privado AI, delivered a keynote on technology-enabled data discovery and AI governance.  “Privacy, security, and AI governance are no longer separate conversations. Agentic AI, tightening regulation, and a more active enforcement environment have brought them into the same room,” said Jana Farmer, partner and cochair of Wilson Elser’s Data Use & AI Governance Practice. “At the moment, there is no comprehensive federal standard governing AI use in the United States.”  “Instead, we’re seeing a rapidly growing patchwork of state laws and regulations,” said Farmer, noting that states including New York, California, Utah, Texas, and Colorado have passed more than 150 AI-related laws in the last year alone. “Given this landscape, businesses should plan for the possibility that some of the use cases of AI technology could become restricted after deployment, so that their AI investments hold up as the rules develop.”  The program paired practitioner-level content with built-in opportunities to connect. Convergence was attended by general counsel, privacy and security leaders, cybersecurity and risk professionals, the insurance and carrier community, and outside advisors who serve them. Conference panels included: Navigating the Privacy and AI Landscape: From New Laws to the Courtroom Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; JD Cheema, Privado; and Christina Van Wert, Senior Manager, Cyber & Professional Lines Group, Tokio Marine HCC.  Topic: Privacy and AI regulation continues to develop on several fronts, and organizations are fielding attention from legislators, regulators, and plaintiffs alike. Through an interactive session, panelists traced the newest privacy and AI legislation, current enforcement priorities, and litigation trends, giving attendees a practical compliance walkthrough they can put to immediate use. Cybersecurity and AI: Governing Agentic Systems Panelists: Dominik Cvitanovic, Wilson Elser; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; Craig Linton, Head of U.S. Underwriting Management for Cyber Risks, Beazley; and Bridget Choi, Cyber Insurance Product Lead, Gallagher. Topic: Agentic AI is reshaping how organizations operate, creating a new class of cybersecurity, contractual, and operational risk. Insurers and insureds alike are asking questions that cut across every industry deploying these systems. Using scenarios drawn from real-world deployments and cyber events, panelists gave attendees practical guidance on governing agentic AI before, during, and after an incident. Cybersecurity Pitfalls and Avoiding the Wrath of Regulators Panelists: Anjali Das, Wilson Elser; Nicole Nguyen, Senior Director, Privacy Engineering and Technology Practice, Ankura; John Schrader, Senior Managing Director, Cyber, Privacy & AI Security Practice, Ankura; and Cody Valdez (former Deputy AG, New Jersey Attorney General’s Office), now an attorney at Wilson Elser. Topic: When a cybersecurity incident hits, regulators are rarely far behind, and they increasingly arrive from several directions at once. A single event can draw parallel scrutiny from the SEC, state financial regulators, health privacy enforcers, and state attorneys general, each with its own rules, deadlines, and enforcement posture. Drawing on recent investigations and enforcement actions, this panel mapped where organizations most often stumble and gave attendees a practical playbook for staying on the right side of the agencies that matter. Implementing AI Across the Business: A Practical Guide to the Risks Panelists: Jana Slavina Farmer, AIGP, Wilson Elser; Jonathan Meer, Wilson Elser; Scott Margolis, Managing Director, Data and Information Governance Practice, Ankura; Matthew McQueeny, AAANow.ai and Earnfluencing; and Rahmila Nadi, Women Leading AI Topic: AI is changing how organizations operate, and the legal and operational risks reach well beyond any single department. No one-size-fits-all approach exists, but common themes cut across every business weighing how to adopt AI responsibly. Through scenarios drawn from situations businesses are navigating right now, panelists gave attendees practical, actionable guidance on the legal and business ramifications of putting AI to work. About Wilson Elser’s Data Use & AI Governance Practice  Wilson Elser is a trusted privacy, security, and AI governance firm in the United States and the preeminent defense litigation firm in the privacy and cyber class action space. For more information about the practice, go to: https://www.wilsonelser.com/data-use-ai-governance About Wilson Elser Wilson Elser is the preeminent defense litigation firm in the United States. Over more than four decades, our litigation and trial lawyers have gained a reputation for taking on and prevailing in the most challenging and technical cases, frequently “parachuting in” to assume unresolved matters from other law firms. Our success also derives from winning on our clients’ terms and rigorously adhering to their guidelines. We are ranked 94 in the Am Law 100 and 30 in the National Law Journal’s NLJ 500. For more information, go to www.wilsonelser.com About Ankura, LLC  Ankura is a leading global consulting and expert services advisory firm with a broad range of specialties across industries, including the cybersecurity, data privacy and governance, and artificial intelligence space. The firm combines strategic advisory with deep technical expertise, hands-on implementation, and expert support to address complex business challenges. Ankura has more than 35 locations and supports projects in more than 115 countries. For more information, go to https://ankura.com/ About Privado AI   Privado AI is an agentic data privacy management platform that helps privacy and compliance teams automate manual governance workflows, map data flows, and detect consent-compliance violations at scale. Founded in 2020, the company leverages specialized AI agents to replace traditional, slow, questionnaire-based compliance methods. For more information, go to https://www.privado.ai/

David Glazer (Partner-New York, NY) and Christian Balodis (Associate-New York, NY) coauthored the article “When Is Work ‘Work’? Dibrino, Calix and the Narrowing of Contractual Indemnity,” published as a preview by the New York State Bar Association on October 6, 2026. The article examines how two recent New York decisions ‒ Dibrino v. Rockefeller Center North, Inc. and Calix v. Union Theological Seminary in the City of New York ‒ have narrowed when broadly worded contractual indemnification provisions are triggered. The authors examine how the decisions shift the focus from an injured worker’s general connection to a project, including employment, site presence, or equipment ownership, to whether the specific condition that caused the injury arose from the proposed indemnitor’s actual contractual work. The decisions bring the First Department in line with the stricter approach previously applied in the Second and Third Departments, with significant implications for litigation strategy, discovery, settlement negotiations, and drafting of indemnification provisions. David and Christian explain that these case results are particularly significant for practitioners in the First Department, where courts previously took a broader approach to contractual indemnity. They also discuss how the decisions will change the way indemnity disputes are analyzed going forward, requiring closer attention to the specific condition that caused the injury and which contractor’s work produced it, pointing out that “Indemnity disputes that were once resolved by pointing to the proposed indemnitor’s project involvement will now turn on the granular question of which contractor’s work produced the specific condition that caused the injury.”

New York office partners Larry Lum and Joseph Laird will present the webinar “Risk Transfer: A Comprehensive Approach for Best Outcomes” on October 21, 2026, for Verist, a provider of holistic insurance and risk management solutions for commercial lines clients. The presentation is specifically designed for Verist's real estate clients, hospitality clients, and broker partners. Larry and Joe will focus on practical considerations and best practices surrounding contractual risk transfer and the tender process ‒ areas that can have a meaningful impact on how claims are managed and ultimately resolved ‒ providing strategic insights driving real estate and hospitality excellence.

Dale S. Dobuler (Partner-Orlando, FL), Peter M. Moore (Partner-McLean, VA), and Jessica Forbes (Of Counsel-Orlando, FL) will present the Wilson Elser Forum webinar “What Your Coverage Counsel Wants You to Know – But May Not Tell You” on October 22, 2026. When should claims professionals bring in external coverage counsel ‒ and how can they make the most of that relationship? This session explores when external coverage counsel may be warranted, how counsel can support claims professionals beyond addressing disputed or questionable coverage, and ways to maximize counsel’s involvement to achieve the best outcomes. The discussion will also address how to clearly define coverage counsel’s role in matters involving disputed coverage and other coverage-related concerns. Claims professionals will come away with a better understanding of when and how to engage external coverage counsel, how to make effective use of counsel’s expertise, and how to work together efficiently throughout the claims handling process.

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 923 (Chapter 482, Statutes of 2026), known as the Expanding Privacy Rights Act. The law amends two provisions of the California Consumer Privacy Act (CCPA): (1) the right to delete (Civil Code § 1798.105); and (2) the methods for submitting consumer requests (Civil Code § 1798.130). The legislation was authored by Senator Josh Becker (D-Menlo Park) and sponsored by the California Privacy Protection Agency (also known as CalPrivacy). This amendment takes effect January 1, 2027. A deletion request will now reach personal information that a business bought or received from others, not only what the consumer provided. Online-only businesses must also offer a web form or portal for privacy requests. For most companies, this is an operational change rather than a new program, but it reaches data stores that many request workflows never touch. Reasons Behind the Amendment Under the prior CCPA text, consumers could request deletion only of information a business collected “from the consumer.” The California Legislature found that the existing right “allows consumers to request that a business delete personal information about the consumer which the business has collected from the consumer, but not personal information about the consumer that the business collected from third parties. This creates a gap in protection.” S.B. 923, 2025–2026 Leg., Reg. Sess. § 1(b) (Cal. 2026) (enacted as 2026 Cal. Stat. ch. 482). CalPrivacy, the legislation’s sponsor, noted that “businesses routinely enrich their records with third-party data, creating a significant gap in the right to delete.” CalPrivacy, California Expands Privacy Protections by Strengthening Deletion Rights (Sept. 27, 2026). With respect to the means for the submission of the requests, the current CCPA regulations require a webform only from businesses that are not exclusively online, and only if they have a website. See 11 CCR § 7020(b) (requests "shall be through its website, such as through a webform."). Online-only businesses with a direct consumer relationship still need only an email address under § 7020(a). As Senator Becker, the author of this bill, explained in his statement, “while most businesses must provide two or more methods to submit privacy requests, online-only businesses that have a direct relationship with the consumer are only required to provide an email address for consumers to submit most privacy requests under the CCPA. This single-method requirement for certain businesses creates barriers for consumers because it offers minimal support or guidance.” Assemb. Comm. on Privacy & Consumer Prot., Analysis of S.B. 923, 2025–2026 Leg., Reg. Sess., at 5 (Cal. June 23, 2026) (as amended June 11, 2026) (quoting author's statement). CalPrivacy, which sponsored the bill, says it aligns California with deletion rights in Delaware, Indiana, Maryland, and New Jersey, and stresses that the CCPA’s existing exemptions, including fraud prevention and legal compliance, remain available. What the Statute Now Says Broader Deletion Right Amended Section 1798.105(a) provides: “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from or about the consumer.” Suppression Records for Third-Party Data For data obtained from other sources, the law gives businesses a defined way to comply: “A business that has obtained personal information about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete that data pursuant to subdivision (a) by retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal information remains deleted from the business’s records and is not being used for any other purpose.” Expanded Downstream Obligations The existing duties still apply: the business must “notify any service providers or contractors to delete the consumer’s personal information from their records and notify all third parties to whom the business has sold or shared the personal information,” unless “this proves impossible or involves disproportionate effort.” Service providers and contractors “shall cooperate with the business in responding to a verifiable consumer request.” Because the deletion right is broader, these flow-down duties now reach a larger set of records. Preserved Exceptions  Businesses may still retain information when reasonably necessary to, among other things, “[h]elp to ensure security and integrity” or “[c]omply with a legal obligation.” New Online Request Requirement Amended Section 1798.130(a)(1)(A) provides that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address and make an online method, such as a web form or online portal, available” for requests to know, delete, or correct. An email inbox alone will no longer suffice. What Is Required, From Whom, and When Beginning January 1, 2027, every business subject to the CCPA must honor deletion requests for personal information it holds about a consumer, whether it collected that data from the consumer or got it from a broker, vendor, or other third party. For data collected from other sources, a business complies with the new requirements by keeping a record of the request and only the minimum data needed to make sure the consumer's information stays deleted. Service providers and contractors must assist the business in their responses to the consumer rights requests. At the business's direction, they must delete the data and notify their own downstream service providers and contractors to do the same.  Starting from January 1, 2027, a business that operates exclusively online and has a direct relationship with consumers must now offer an online method, such as a web form or portal, in addition to an email address, for submission of consumer requests. Businesses with brick-and-mortar presence keep their current obligation to offer at least two methods for consumer requests, including a toll-free telephone number. Practical Steps to Take Before January 1, 2027 Compliance with contemporary data privacy laws must involve technical solutions along with legal and compliance ones. Online-only businesses seeking to implement the webform or portal for the first time must be mindful of the privacy laws-related requirements, including the need for verification, the regulatory response timelines, and the recordkeeping requirements related to the fulfilled requests. All businesses subject to CCPA should also take the time to map where personal information sourced from third parties resides in their systems, extend deletion workflows to those systems, and build or check their suppression records workflow. This is also a good time to review the mandatory service provider and contractor agreements to confirm compliance with California’s requirements, including support for deletion rights cooperation and flow-down provisions.  Wilson Elser’s Data Use and AI Governance team can help businesses assess how SB 923 affects their deletion workflows, third-party data sources, vendor agreements, and consumer request intake, and can advise on CCPA compliance and other privacy law questions as they arise.

Lara Lickhalter (Partner-Chicago, IL) was re-elected to the Trucking Industry Defense Association (TIDA) Board of Directors on October 15, 2026, at TIDA's 34th Annual Seminar in San Diego, California. TIDA is a nonprofit association dedicated to sharing knowledge and resources for the defense of the trucking industry. Its membership includes more than 1,600 motor carriers, trucking insurers, defense attorneys, and claims service companies throughout the United States and Canada. Lara was first elected to the TIDA Board in 2023. Lara has more than 15 years of experience litigating catastrophic trucking and transportation claims involving motor carriers, freight brokers, bus lines, and contract carriers. She is a member of Wilson Elser's National Emergency Rapid Response Team.  

Washington, D.C. partners Ryan Duffy and Kathleen Warin secured two significant victories in the U.S. District Court for the District of Columbia on behalf of the Financial Industry Regulatory Authority (FINRA). In two separate cases, former securities brokers sought to expunge customer dispute information from their registration records maintained by FINRA in the Central Registration Depository (CRD) system, which is publicly available through BrokerCheck as required under the Securities Exchange Act of 1934. The plaintiffs each asserted claims for equitable expungement, declaratory judgment, and a permanent injunction. In both cases, the Wilson Elser team successfully argued that the plaintiffs failed to identify any cognizable cause of action against FINRA that would entitle them to expungement relief. Ryan and Kathleen demonstrated that neither the Exchange Act nor FINRA Rules create a private right of action against FINRA for expungement of customer dispute information from the CRD, and that the plaintiffs' claims for equitable relief, declaratory judgment, and a permanent injunction were remedies rather than cognizable causes of action. Both courts agreed in full, granting FINRA's motions to dismiss with prejudice. They held that the Exchange Act's comprehensive regulatory scheme does not authorize private suits against FINRA for actions taken pursuant to its statutory obligations, and that federal courts have overwhelmingly declined to recognize any such private right of action. The courts also rejected the plaintiffs’ arguments that their inherent equitable powers could supply the missing cause of action, reaffirming the well-established principle that equitable expungement, declaratory relief, and injunctive relief are forms of remedy ‒ not independent sources of legal entitlement. Together, these decisions provide critical legal authority and reinforce that brokers have no private right of action against FINRA for expungement of customer dispute information maintained pursuant to its statutory obligations. 

Kirsten L. Curtis (Partner-Portland, OR) and Jane E. Young (Partner-Denver, CO) will present the Wilson Elser Forum webinar “Handling UM/UIM Claims with Confidence: Coverage, Investigation, and Resolution Best Practices” on October 20, 2026. This session provides a comprehensive overview of best practices for adjusting uninsured and underinsured motorist (UM/UIM) claims. Topics include confirming coverage applicability, verifying the insured's status as a covered person, establishing the liability of the uninsured or underinsured tortfeasor, and evaluating damages. The session also covers stacking and offset issues, as well as how UM/UIM obligations interact with policy limits, exhaustion requirements, and inter-company arbitration. Also addressed are common coverage triggers, consent-to-settle provisions, subrogation rights, and jurisdiction-specific variations that adjusters should be aware of when handling these claims. Whether you are new to UM/UIM or looking to sharpen your approach, this session will equip you with practical strategies for handling claims efficiently, accurately, and in compliance with applicable regulations and fair claims practices standards.